SecureW2 and Wi-Fi Cloud Integration Guide

Deployment Overview

This guide demonstrates how to integrate a WatchGuard Wi-Fi Cloud Captive Portal with SecureW2 authentication for users to authenticate, and receive certificates, for WPA2 Enterprise EAP-TLS Wi-Fi access, and an HTTPS proxy certificate deployed for HTTPS content inspection on a WatchGuard Firebox. WPA2 Enterprise EAP-TLS wireless communication is secured by a certificate pair that requires no password, and the client certificate is unique to the client.

Test Topology

SecureW2 JoinNow MultiOS Management Portal interacts with the WatchGuard AP420 through policies to push certificates to end users.

SecureW2 Network Profile, Redirect URL, and RADIUS

Use the Device Onboarding section in the SecureW2 console to acquire the RADIUS information and portal redirect URL.

1. Open the SecureW2 JoinNow MultiOS Management Portal and select Device Onboarding > Getting started.
2. In the Quickstart Network Profile Generator section, from the Profile Type drop-down list, select Wireless.
3. From the Profile Type drop-down list, select Wireless.
4. In the SSID text box, type the SSID for the network to be secured by TLS.
5. From the Security Type drop-down list, select WPA2-Enterprise.
6. From the EAP Method drop-down list, select EAP-TLS.
7. From the Policy drop-down list, select Default.
8. Click Create. The Network Profiles page appears.
9. In the Functions column, click View, and copy the URL. This is the Redirect Portal URL for deployment in WatchGuard Wi-Fi Cloud.
   

10. Return to the SecureW2 JoinNow MultiOS Management Portal and select AAA Management > AAA configuration.
11. Note the RADIUS Port, Primary and Secondary IP Address, and the Shared Secret.

WatchGuard Wi-Fi Cloud Basic Configuration

For detailed information on WatchGuard Wi-Fi Cloud AP deployment, see the Getting Started Guide.

These instructions use Manage for the Wi-Fi Cloud configuration. You can now also perform these configuration steps with the Discover application. For more information, see About Discover.

Configure WatchGuard Wi-Fi Cloud with the SecureW2 RADIUS Information for EAP-TLS

1. Log in to your WatchGuard account.
2. Select My WatchGuard > Managed Wi-Fi Cloud > Manage.
3. Select Configuration > Device Configuration > RADIUS Profiles.
4. On the RADIUS Profiles tab, click Add RADIUS Profile.
5. In the Profile Name text box, type a friendly description for the profile.
6. In the IP Address text box, type the Primary IP address of the RADIUS server from SecureW2. This IP address requires outbound access in your firewall rules. This is open in the default outgoing policy.
7. In the Authentication Port text box, type the port number listed for the RADIUS server from SecureW2. This port requires outbound access in your firewall rules. This is open in the default outgoing policy.
8. Leave the Accounting Port, in the default setting.
9. In the Shared secret text box, type the shared secret from the SecureW2 RADIUS server.
10. Click Save.

11. Repeat these steps for the second SecureW2 RADIUS server.

Configure WatchGuard Wi-Fi Cloud with the SSID Profile for EAP-TLS

1. In WatchGuard Wi-Fi Cloud, open Manage.
2. Select Configuration > Device Configuration > SSID Profiles.
3. Select Add New Wi-Fi Profile.

4. Type the Profile Name and SSID name for secure EAP-TLS client connections.
5. Expand the Security section, from the Security Mode drop-down list select WPA2 and select 802.1X.
6. From the RADIUS Authentication drop-down list, select the two configured RADIUS servers.

7. Expand the Network section and set the VLAN ID to 30. You will use this VLAN ID in your firewall configuration.

8. Click Save.

Configure WatchGuard Wi-Fi Cloud with the SSID Profile for Splash Page Redirection

1. In WatchGuard Wi-Fi Cloud, open Manage.
2. Select Configuration > Device Configuration > SSID Profiles.
3. Select Add New Wi-Fi Profile.
4. Type the Profile Name and SSID name for client connections.
5. Expand the Security section and verify the Security Mode is set to Open.
6. Expand the Network section and set the VLAN ID to 20. This VLAN ID is used in your firewall configuration.
7. Expand the Captive Portal section and select Enable Captive Portal.
8. Select External Splash Page for Sign-in/Click-through.
9. In the Splash Page URL text box, type the View URL from the SecureW2 configuration.

10. To configure the Walled Garden Sites, click Add and add these four SecureW2 URLs:
    • cloud.securew2.com
    • service.securew2.com
    • pki-services.securew2.com
    • auth.securew2.com

11. Click OK when finished.

12. Add other Walled Garden Sites as required by your operating systems to provide access to their respective App Store or prevent certificate issues.

Operating System	Walled Garden Sites
Mac	*.akamaiedge.net *.akamaitechnologies.com *.apple.com *.apple.com.edgekey.net apple.com captive.apple.com gsp1.apple.com	airport.us appleiphonecell.com ibook.info itools.info thinkdifferent.us apple.com/library/test/success.html
Windows	urs.microsoft.com urs.smartscreen.microsoft.com
Android	*.play.google.com *.store.google.com android.clients.google.com lh3.googleusercontent.com lh6.ggpht.com lh5.ggpht.com lh4.ggpht.com	lh6.googleusercontent.com lh3.ggpht.com googleapis.com google-analytics.com cache.google.com 172.217.0.0/16 216.58.192.0/19 74.125.0.0/16
Kindle	54.224.0.0/12 72.21.192.0/19 176.32.96.0 - 176.32.103.255 207.171.160.0/19

13. Expand Captive Portal, and on the right, in the Redirect URLtext field, type the URL to which to send users after they access the portal.
    

14. Click Save.

Configure the WatchGuard Firebox for SecureW2 Access to Active Directory

SecureW2 connects to Active Directory at the public IP address 52.41.166.6. This connection uses port 636 for secure access. Active Directory and Certificate Services are required on Windows Server 2016.

1. Log in to your WatchGuard Firebox.
2. From Fireware Web UI, select Firewall > SNAT > Add.
3. Type a Name and Description for the SNAT.
4. Under SNAT Members, click Add.
5. From the External/Optional IP Address drop-down list, select Any-External, External, or an IP address that is public facing.
6. Set the Internal IP Address to the private address of the Active Directory server.
7. Click OK and Save.

8. Select Firewall > Firewall Policies > Add Policy.
9. Select Custom. Click Add.

10. Type a Name, Description, and add TCP port 636.

11. Click Save.
12. You are redirected to the Select a policy type page with your new custom policy selected in the drop-down list. Click Add Policy to continue with the policy creation.
13. In the From field, remove Any-Trusted. Click Add.
14. From the Member type drop-down list, select Host IPv4.
15. Type the SecureW2 public IP address of 52.41.166.6. Click OK.
16. In the To field, remove Any-External. Click Add.
17. From the Member type drop-down list, select Static NAT.
18. Select the SNAT you created in an earlier step. Click OK.

19. Confirm the configuration. Click Save.

Configure the WatchGuard Firebox with the Access Point VLANs

1. Log in to your WatchGuard Firebox.
2. From Fireware Web UI, select Network > Interfaces.
3. Select the interface, click Edit.
4. Type an Interface Name (Alias) and Interface Description.
5. From the Interface Type drop-down list, select VLAN.

6. Click Save.
7. Select Network > VLAN.
8. Click Add.
9. Type a Name, Description, VLAN ID of 10, Security Zone, and an IP Address for the interface.

10. Select the desired VLAN interface and from the Select Traffic drop-down list, select Untagged Traffic.

This configuration employs a direct connection to the firewall for the access point. Untagged VLAN management for the access point can also be deployed on a switch.

11. Click Save.
12. Select Network > VLAN.
13. Click Add.
14. Use VLAN ID 20 and type the configuration for the On-Boarding VLAN.
15. Set the VLAN tagging to Tagged Traffic.

16. Click Save.
17. Repeat the procedure for tagged traffic on a EAP-TLS VLAN.
18. The final VLAN configuration should appear as shown here:

Configure the WatchGuard Firebox Policies for Access Point VLANs

1. Log in to your WatchGuard Firebox.
2. From Fireware Web UI, select Firewall > Firewall Policies.
3. Click Add Policy.
4. Select Packet Filter and from the drop-down, select the Any.

5. Click Add Policy.
6. In the From field, remove the Any-Trusted alias.
7. In the From field, click Add.

8. Select the AP Management VLAN. Click OK.
9. Repeat the steps to add the On-Boarding VLAN.
10. Change the Name of the policy. Click Save.
11. Select Firewall > Firewall Policies. Click Add Policy.
12. Select Proxies. From the drop-down list select HTTPS-Proxy.
13. From the -- Select a Proxy action -- drop-down list, select HTTPS-Client Standard.

14. Click Add Policy.
15. Type a new Name for the HTTPS-Proxy policy.
16. In the From field, remove the Any-Trusted alias.
17. In the From field, click Add.
18. In the Add Member page, from the Member type drop-down list, select Alias.
19. From the list, select the interface alias. Click OK.

20. Select the Proxy Action tab.

21. From the Proxy Action drop-down list, select Clone the current proxy action.
22. In the Content Inspection Summary, click Edit.
23. Select the option for Enable Content Inspection.

24. Click OK.

25. Click Save to save the policy.

Retrieve the HTTPS-Proxy Certificate from the WatchGuard Firebox

For more detailed information about content inspection for the HTTPS Proxy, see HTTPS-Proxy: Content Inspection.

1. Log in to your WatchGuard Firebox.
2. From Fireware Web UI, select System > Certificates.
3. Highlight the Proxy Authority certificate from the list. Click Export.

4. Browse to the location where you want save the certificate. Click Save.

Retrieve the Certificate for Active Directory Communication

1. From Windows 2016 Server, open the Certificate Authority application. Or, right-click Start > Run. Type certsrv.msc in the dialog box. Click OK.
2. Right-click the domain in the Certificate Authority (Local) section and select Properties.

3. Click View Certificate.
4. Select the Details tab.
5. Click Copy to File...

6. The Certificate Export Wizard appears. Click Next.

7. Select DER encoded binary X.509 (.CER). Click Next.

8. Provide a File name, browse to a location, and click Save.
9. Click Next.

10. Click Finish.

Create a Wi-Fi Authentication Group in Active Directory

A Security Group is created in the Active Directory to attach the user to — SecureW2 Authentication Policies, User Role Policies, and Enrollment Policies.

1. From Windows Server 2016, open Server Manager.
2. Select Tools > Active Directory Users and Computers.
3. Right-click the domain and select New > Group.
4. In the Group nametext box, type the name of the security group associated with users.
5. In the Group name (pre-Windows 2000)text box, type the same name if it is not already pre-populated.
6. In the Group scopesection, select Global .
7. In the Group type section, select Security.

8. Click OK.
9. Double-click the name of the new security group created.
10. Select the Members tab.
11. Click Add.
12. Type the full name of each user. Select Check Names to verify and click OK to submit.

13. Click OK.

Configure SecureW2 for Active Directory Queries

Communication to Active Directory is encrypted with the certificate retrieved from the server on port 636 through the restrictive policy created on the WatchGuard Firebox.

1. From the SecureW2 Management Portal, select Identity Management > Identity Providers.
2. Click Add Identity Provider.
3. Type a Name and Description.
4. From the Type drop-down list, select LDAP.
5. Click Save.

6. In the Subject Name Attribute text box:
   • sAMAccountName is used if you deploy a simple user name login.
   • userPrincipalName is used for the format [email protected].
7. In the Group Map Attribute text box, type memberOf. 

6. Select the Connections tab.
7. Click Add Connection.
8. Type the connection information for your Active Directory connection.
9. In the Name text box, type the name of the IDP connection.
10. In the Descriptiontext box, describe the IDP connection.
11. In the Hostname text box type the hostname that resilves to a public IP Address. This must match the configured name of the server and the issuer listed in the certificate.
12. In the Port text box, set to port number to 389, if the connection is unsecured. If the connection is secured with the certificate, set the port number to 636. Select the use TLS/SSL check box to change the value to 636.
13. To add a Certificate, click Choose File and upload the self-signed certificate you obtained for use in LDAP communication over SSL.  
14. Select Anonymous/Admin to specify whether the connection type is anonymous or Administrator. For the anonymous connection, no information is retrieved from Active Directory while testing the connection.
15. Or select Admin DN. This parameter is enabled only if you have selected the connection type as admin. Use the distinguished name format. For example: CN=Administrator, CN=users, DC=example, DC=com.
16. In the Admin Password text box, type the password of the administrator. This is enabled only if you have select the Admin connection type.
17. To retrieve and select a Subject Base DN from the Active Directory, click Naming Context.
18. To retrieve and select a Group Base DN from the Active Directory, click Naming Context.
19. Set the Server Timeout in seconds for the Active Directory query to timeout.

20. To confirm the Active Directory settings, click Test Connection.

21. Click OK. Click Update to return to the Identity Provider settings.

Configure the SecureW2 Network Profile for the HTTPS Proxy Decryption Certificate

1. From the SecureW2 JoinNow MultiOS Management Portal, select Device Onboarding > Network Profiles.
2. Click Edit for the new profile. The existing certificate is for encryption of wireless client traffic through EAP-TLS.

3. Click Add/Remove Certificate.

4. Click Choose File and browse to the location of the HTTPS Proxy Certificate.
5. Select the certificate file. Click Open.
6. Clear any check marks present in the Install column.
7. Click Upload. Click OK to confirm.
8. Click Cancel. Re-open the Add/Remove Certificate page.
9. Leave the Install check mark selected on the EAP-TLS certificate and find the uploaded HTTPS Proxy Certificate.
10. Select the check mark for Installfor the private HTTPS Proxy Certificate.
11. Click Update. The Certificates section should now contain both the ESP-TLS Certificate and the HTTPS Proxy Certificate.
12. Return to the Device Onboarding > Network Profiles page.
13. In the configured Network Profile, click Publish/Re-publish.

14. Repeat the Publish/Re-publish action for the new Network Profile Group.

Configure the SecureW2 Authentication Policy

The SecureW2 Authentication Policy defines the protocols that the JoinNow MultiOS uses to communicate with the devices and assigns the Identity Provider.

1. From the SecureW2 JoinNow MultiOS Management Portal, select Policy Management > Authentication.
2. Click Edit on the auto-created Authentication Policy.
3. Select the Settings tab.
4. From the Identity Provider drop-down list, select the Identity Provider you created.
5. Click Update.

Configure the SecureW2 User Role Policy

1. From the SecureW2 JoinNow MultiOS Management Portal select Policy Management > User Roles.
2. Click Edit on the Default Role Policy.
3. Select the Conditions tab.
4. From the Identity Provider drop-down list, select the configured provider.

5. Click Update.

Configure the SecureW2 Enrollment Policy

1. From the SecureW2 JoinNow MultiOS Management Portal, select Policy Management > Enrollment.
2. Select Edit on the Default Enrollment Policy.
3. On the Conditions tab, from the User Role and Device Role drop-down list, select the default policies.

4. Click Update.

Test a Wireless Client

1. Connect to the On-Boarding Wi-Fi SSID.
2. The client will be redirected to the JoinNow configured view URL.

3. Click JoinNow.
4. From the download dialog box, click Run.

5. Type the Username and Password. Click Next.

The user is automatically redirected to the EAP-TLS wireless connection.