WALLIX Bastion and Firebox Integration Guide

Deployment Overview

WALLIX offers privileged access management solutions for large and medium-sized enterprises, public organizations, and cloud service providers. WALLIX Bastion helps these customers to protect critical IT assets, such as data, servers, terminals and connected devices.

Test Topology

This diagram shows the test topology for SSH:

This diagram shows the test topology for the Web UI:

Before You Begin

Before you begin these procedures, make sure that you:

• Install and complete the initial configuration of WALLIX Bastion
• Install and complete the initial configuration of your WatchGuard Firebox
• Install Chrome, Active Directory Domain Services (AD DS), and Remote Desktop Services on your Windows Server
• Allow the user who opens the RDP session on the server access to the collection
• Get the AppDriver.exe and WABChromeLogonUIA.lua files from WALLIX support and save them to your jump server. In this guide we use these file locations:
  • C:\AppDriver\AppDriver.exe
  • C:\AppDriver\WABChromeLogonUIA.lua
• Publish cmd.exe as a RemoteApp program in Remote Desktop Services and select Allow any command-line parameters in the properties

Configure Your Firebox for WALLIX Bastion

Add two user accounts, clilogin and weblogin, to the Firebox with the Device Administrator role. For instructions on how to add users to the Firebox, see Fireware Help.

Configure WALLIX Bastion with SSH Login

In this guide, we log in to the Firebox via the Trusted or Optional port. The Firebox IP address must be the Trusted or Optional port IP address.

Add a User Group

1. Log in to the WALLIX Bastion Web UI.
2. Select User > Groups.
3. Click Add a group.
4. In the Group name text box, type the group name.
5. From the Available Users list, select your user, then click the arrow to move the user to the Selected Users list. If you did not configure other users, only the WALLIX Bastion Web UI login user appears in the list.
6. Do not change the other default settings.

7. Click Apply.

Add an SSH Login Device

1. Select Targets > Devices.
2. Click + Device.
3. In the Name text box, type the device name.
4. In the IP address or FQDN text box, type the Firebox IP address.

5. Click Apply.
6. Select the Services tab.
7. Click + Service.
8. From the drop-down list, select SSH.
9. In the Service name text box, type the service name SSH.
10. In the Port text box, type 4118.
11. Select all Proxy options check boxes.
12. Do not change the other default settings.

13. Click Apply and close.

On the Targets page, Devices tab, the Firebox appears in the list of devices.

Add an SSH Login Account

1. Select Targets > Accounts > Device accounts.
2. Click + Account.
3. From the Device drop-down list, select the device you created previously.
4. From the New local domain drop-down list, select local.
5. In the Account name text box, type the name of a Firebox user account. In this example, we use the clilogin user account. You can also use the default Firebox admin account.
6. In the Account login text box, type the same text you typed in the Account name text box.
7. Do not change the other default settings.

8. Click Apply.
9. Select the Password tab.
10. In the New password and New password confirmation text boxes, type the password.
11. Do not change the other default settings.

12. Click Apply

Add an SSH Login Group

1. Select Targets > Groups.
2. Click + Group.
3. In the Name text box, type the group name.

4. Click Apply.
5. Select the Session management targets tab.
6. Under Account, click + Target(s).
7. From the From drop-down list, select A device and related local accounts.
8. From the Device drop-down list, select the device you created in the Add an SSH Login Device section.
9. From the Service drop-down list, select the service you created in Step 9 of the Add an SSH Login Device section.
10. In the Local accounts section, select the name of the account you created in Step 5 of the Add an SSH Login Account section.

11. Click Add and close.
12. Click Interactive login.
    Steps 12-17 are optional.
13. Click + Target(s).
14. From the From drop-down list, select A device and related services.
15. From the Device drop-down list, select the device you created in the Add an SSH Login Device section.
16. In the Services section, select the service you created in Step 9 of the Add an SSH Login Device section.

17. Click Add and close.
18. Select the Password management targets tab.
19. Click + Target(s).
20. From the From drop-down list, select A device and related local accounts.
21. From the Device drop-down list, select the device you created in the Add an SSH Login Device section.
22. In the Local accounts section, select the name of the account you created in Step 5 of the Add an SSH Login Account section.

23. Click Add and close.

Configure WALLIX Bastion with Web UI Login

In this guide, we log in to the Firebox via the Trusted or Optional port. The Firebox IP address must be the Trusted or Optional port IP address.

Add an RDP Jump Server Device

1. Select Targets > Devices.
2. Click + Device.
3. In the Name text box, type the device name.
4. In the IP address or FQDN text box, type the jump server IP address.

5. Click Apply.
6. Select the Services tab.
7. Click + Service.
8. From the drop-down list, select RDP.
9. In the Service name text box, type RDP.
10. In the Port text box, type 3389.
11. Select all the Proxy options check boxes.
12. Do not change the other default settings.

13. Click Apply and close.

Add a Jump Server Device Account

1. Select Targets > Accounts > Device accounts.
2. Click + Account.
3. From the Device drop-down list, select the device you created previously.
4. From the New local domain drop-down list, select local.
5. In the Account name text box, type the account name. This account must exist on your jump server.
6. In the Account login text box, type the same text you typed in the Account name text box.
7. Do not change the other default settings.

8. Click Apply.
9. Select the Password tab.
10. In the New password and New password confirmation text boxes, type the password.
11. Do not change the other default settings.

12. Click Apply.

Add Applications

1. Select Targets > Applications.
2. Click Add an application.
3. In the Name text box, type the application name.
4. In the Parameters text box, type /lua_file:C:\AppDriver\WABChromeLogonUIA.lua /e:URL=https://Firebox IP Address:8080/ /e:IgnoreCertificateErrors=Yes.
5. From the Connection policy drop-down list, select RDP.
6. From the Target/Cluster name drop-down list, select administrator@local@JumpServer:RDP.
7. In the Application path text box, type C:\AppDriver\AppDriver.exe.
8. In the Application path text box, type C:\AppDriver.
9. Do not change the other default settings.

10. Click Apply.

Add an Application Account

1. Select Targets > Accounts > Application accounts.
2. Click + Account.
3. From the Application drop-down list, select the application you created previously.
4. From the New local domain drop-down list, select local.
5. In the Account name text box, type the name of a Firebox user account. In this example, we use the weblogin user account. You can also use the default Firebox admin user account.
6. In the Account login text box, type the same text you typed in the Account name text box.
7. Do not change the other default settings.

8. Click Apply.
9. Select the Password tab.
10. In the New password and New password confirmation text boxes, type the password.
11. Do not change the other default settings.

12. Click Apply.

Add a Web UI Login Group

1. Select Targets > Groups.
2. Click + Group.
3. In the Name text box, type the group name.

4. Click Apply.
5. Select the Session management targets tab.
6. Below Account, click + Target(s).
7. From the From drop-down list, select A application and related local accounts.
8. From the Application drop-down list, select the application you created in the Add Applications section.
   The Service drop-down list value is selected automatically.
9. In the Local accounts section, select the name of the account you created in the Add an Application Account section.

11. Click Add and close.
12. Click Interactive login.
    Steps 12-16 are optional.
13. Click + Target(s).
14. From the From drop-down list, select Applications.
15. From the Applications drop-down list, select the application you created in the Add Applications section.

16. Click Add and close.
17. Select the Password management targets tab.
18. Click + Target(s).
19. From the From drop-down list, select An application and related local accounts.
20. From the Application drop-down list, select the application you created in the Add Applications section.
21. In the Local accounts section, select the name of the account you created in the Add an Application Account section.

22. Click Add and close.

Test the Integration

SSH Login

1. Open Putty
2. In the Host Name (or IP Address) and Port text boxes, type the WALLIX Bastion IP address and port number.

3. Click Open.

4. Type your WALLIX Bastion Web UI login user name and password.

4. Select 1.
   You are logged in to the Firebox Command Line Interface (CLI).

To manually enter the Firebox user name and password in Step 4, select 0.

Web UI Login

1. RDP to WALLIX Bastion.
2. Log in with your WALLIX Bastion Web UI user name and password.

3. Select weblogin@local@Application_WebLogin:APP. Click Connect.

4. Click OK.
   WALLIX Bastion starts Chrome, opens the Firebox Web UI, enters the user name and password, and logs in automatically.

To manually enter the Firebox user name and password in Step 3, select Interactive@Application_WebLogin:APP, and click Connect.