Authentication. Sophos XG Firewall
Advertisement
Advertisement
Sophos XG Firewall | Configure | 160
Figure 124: Host Details
3. Specify the Service Provider’s Details.
Service Provider
Select the service provider with whom you have registered your hostname. In case you are configuring Sophos as a service provider, login name and password are not required.
Login Name
Specify your DDNS account’s username.
In case you are configuring DynAccess as a service provider, provide the host name in the following format: <accountname>.dynaccess.com.
Provide your login name as <accountname>.
Password
Specify your DDNS account’s password.
Figure 125: Service Provider Details
4. Click Save.
Note: You can configure multiple hosts having the same interface and service provider for Dynamic
DNS.
Authentication
The Authentication menu provides basic authentication settings for the device.
This menu covers the following topics:
•
on page 161: Manage external servers for authentication
•
or the Captive Portal.
•
on page 178:Set up policies and assign them to a number of users
•
on page 182: Manage user accounts for access to the device
Sophos XG Firewall | Configure | 161
•
: Configure the one-time password (OTP) service.
•
: Customize Captive Portal through which users can log in
•
on page 195: Manage users accessing the device without user account
•
on page 201: Manage user accounts for clientless access
•
: Configure general parameters to provide secured Internet access for guest users
•
on page 209: Download clients from different platforms to interact with the device
Servers
The Authentication Server menu allows the management of databases and backend servers for external user authentication services.
External user authentication enables you to validate user accounts against existing user databases or directory services on other servers of your network.
Authentication services currently supported are:
• Novell’s eDirectory
• Microsoft’s Active Directory
• RADIUS
• TACACS+
• LDAP
This page displays a list of all existing authentication servers. For each server the list shows:
Name
Displays the name of the authentication server.
IP
Displays the IP address of the authentication server.
Port
Displays the port of the authentication server.
Type
Displays the type of the authentication server.
Domain/Admin
Displays the domain or admin of the authentication server.
Add External Server
This page describes the authentication servers to be added. It covers the following topics:
Active Directory
Active Directory (AD) is Microsoft’s implementation of a directory service and is a central component of Windows
2000/2003 servers. It stores information about a broad range of resources residing on a network, including users, groups, computers, printers, applications, services, and any type of user-defined objects. As such it provides the means of centrally organize, manage, and control access to these resources. The Active Directory authentication method allows you to register Sophos XG Firewall at a Windows domain, thus creating an object for Sophos
XG Firewall on the primary domain controller (DC). Sophos XG Firewall is then able to query user and group information from the domain.
Note: Sophos XG Firewall supports Active Directory 2003 and newer.
on page 164
LDAP
LDAP, an abbreviation for Lightweight Directory Access Protocol, is a networking protocol for querying and modifying directory services based on the X.500 standard. Sophos XG Firewall uses the LDAP protocol to
Sophos XG Firewall | Configure | 162 authenticate users for several of its services, allowing or denying access based on attributes or group memberships configured on the LDAP server.
RADIUS
RADIUS, the acronym of Remote Authentication Dial In User Service, is a widespread protocol for allowing network devices such as routers to authenticate users against a central database. In addition to user information,
RADIUS can store technical information used by network devices, such as supported protocols, IP addresses, routing information, and so on. This information constitutes a user profile, which is stored in a file or database on the RADIUS server. The RADIUS protocol is very flexible, and servers are available for most operating systems.
The RADIUS implementation on Sophos XG Firewall allows you to configure access rights on the basis of proxies and users. Before you can use RADIUS authentication, you must have a running RADIUS server on the network.
Whereas passwords are encrypted using the RADIUS secret, the username is transmitted in plain text.
TACACS+
TACACS+, the acronym of Terminal Access Controller Access Control System, is a proprietary protocol by Cisco
Systems, Inc. and provides detailed accounting information and administrative control over authentication and authorization processes. Whereas RADIUS combines authentication and authorization in a user profile, TACACS
+ separates these operations. Another difference is that TACACS+ utilizes the TCP protocol (port 49) while
RADIUSClosed uses the UDPClosed protocol.
on page 168
eDirectory
Novell eDirectory is an X.500 compatible directory service for centrally managing access to resources on multiple servers and computers within a given network. eDirectory is a hierarchical, object-oriented database that represents all the assets in an organization in a logical tree. Those assets can include people, servers, workstations, applications, printers, services, groups, and so on.
Add LDAP Server
This page describes how to add a LDAP server.
1. Go to Configure > Authentication > Servers and click Add.
2. As Server Type, select LDAP Server.
3. Specify the LDAP server details:
Server Name
Specify a descriptive name for the LDAP server.
Server IP/Domain
Specify an IP address or domain for the LDAP server.
Port
Specify the port of the LDAP server.
Default: 389
Version
Select the version of the LDAP server.
Default: 3
Anonymous Login
Enable to send anonymous requests to the LDAP server.
Sophos XG Firewall | Configure | 163
Disable to bind user with the server.
Username (not available if Anonymous Login is selected)
Enter user name. The username must be specified as a full distinguished name (DN) in LDAP notation, using commas as delimiters (e.g., uid=root,cn=user).
Password (not available if Anonymous Login is selected)
Specify a password for the user.
Connection Security
Select the connection security for the LDAP server:
• Simple: User credentials will be send unencrypted, as plaintext. This connection security is selected by default.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The
Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Validate Server Certificate (not available for Simple connection security)
Enable to validate the certificate on the external server.
Client Certificate (not available for Simple connection security)
Select a client certificate from the list to establish a secured connection. If you do not want a client certificate, select None.
Default: ApplianceCertificate
Note: You can manage client certificates under Protect > Web Server >
Certificates.
Base DN
Enter the Base DN for the LDAP server. The Base DN is the starting point relative to the root of the
LDAP tree where the users are included who are to be authenticated. Note that the Base DN must be specified by the Fully Distinguished Name (FDN) in LDAP notation, using commas as delimiters
(e.g., O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
Authentication Attribute
Specify an authentication attribute for searching the LDAP directory. The user authentication attribute contains the actual login name each user is prompted for, for example by remote access services.
Display Name Attribute
Specify the name for the LDAP server which is displayed as LDAP username.
Email Address Attribute
Specify the alias for the configured email address which is displayed to the user.
Group Name Attribute
Specify the alias for the configured group name which is displayed to the user.
Expiry Date Attribute
Specify the user expiry date displayed to the user. The attribute specifies how long a user account is valid.
Sophos XG Firewall | Configure | 164
Figure 126: Add LDAP Server
4. Click Test Connection to check the connectivity between LDAP and Sophos XG Firewall. It also validates the
LDAP server user credentials.
5. Click Save.
Add Active Directory Server
This page describes how to add an Active Directory server.
Active Directory allows the device to map the users and groups from ADS for the purpose of authentication on a
Windows platform.
1. Go to Configure > Authentication > Servers and click Add.
2. As Server Type, select Active Directory.
Note: If a user is required to authenticate using AD, the device needs to communicate with the AD server for authentication.
3. Specify the Active Directory server details.
Server Name
Enter a unique name for the Active Directory server.
Server IP
Specify an IP address for the Active Directory server.
Port
Sophos XG Firewall | Configure | 165
Specify the port of the Active Directory server.
Default: port 389.
NetBIOS Domain
Specify a NetBIOS domain for the Active Directory server.
ADS Username
Specify a username for the admin user of the Active Directory server.
Password
Specify a password for the admin user of the Active Directory server.
Connection Security
Select the type of security to be implemented on the established connection.
It provides a method to login to the external server by sending the username and password in encrypted format instead of plaintext.
• Simple: User credentials will be send unencrypted as plaintext.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The
Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Note: We strongly recommend using the encryption method to protect the user credentials.
Validate Server Certificate (not available for Simple connection security)
Enable to validate the certificate on the external server.
Display Name Attribute
Specify the name for the AD server which is displayed as AD username.
Email Address Attribute
Specify the alias for the configured email address which is displayed to the user.
Domain Name
Specify the domain name for which the query is to be added.
Search Queries
Click Add to enter the search query. Use the Move Up and Move Downbuttons to rearrange the search queries in the list. Use Remove to remove the selected item.
Note: If you do not know the search DN, refer to
Sophos XG Firewall | Configure | 166
Figure 127: Add Active Directory Server
4. Click Test Connection to check the connectivity between the Active Directory server and Sophos XG Firewall. It also validates the Active Directory server user credentials.
5. Click Save.
NetBIOS Name, FQDN and Search DN
This page describes how a Search DN is built.
The settings have to be performed on an AD (Windows) server.
1. Go to Start > All Programs > Administrative Tools > Active Directory Users and Computers.
2. Right-click the required domain and go to the Properties tab.
Search DN is based on the FQDN. For example, if the FQDN is “google.com”, then the Search DN will be
DC=google, DC=com.
Figure 128: Search Query
Import AD User Group
This page describes how to import Active Directory groups from the Windows platform into the device.
Sophos XG Firewall | Configure | 167
1.
Go to Configure > Authentication > Servers and click against the AD server from which AD groups are to be imported.
The Import Group Wizard Help appears.
2. Specify a Base DN. Appliance fetches AD groups or OU groups from the specified Base DN.
3. Select the AD groups or OU groups to be imported in the appliance. Hold downCtrl to select multiple groups. The appliance already available in the device will not be imported.
4. Select various policies (surfing quota, traffic shaping, web filter, application filter, network traffic and SSL VPN) and user authentication timeout group members. Selected policies are attached to all imported groups. If you want to specify different policies for different groups, do not enable the policy. For example if you want to specify different Internet policies to filter policies to different groups, do not enable Attach to all the Groups.
5. If you do not want to apply common policies which are valid for all groups, specify policies to be applied to each group individually.
If groups are imported successfully, a “successful” message will be displayed; else the appropriate error message will be displayed. This message remains even if you close the wizard.
6. Click Close to end the wizard.
If a user is member of multiple AD groups, then the policies are applied to the first group the user is member of.
Therefore, the device browses through the group ordered list from top to bottom to determine the user’s group membership. The first group that matches is considered the group of the user and that group policies are applied to the user.
Using the wizard, you can reorder the groups to change the membership preference.
Add RADIUS Server
This page describes how to add a RADIUS server.
1. Go to Configure > Authentication > Servers and click Add.
2. As Server Type, select RADIUS Server.
3. Specify the RADIUS server details:
Server Name
Specify a descriptive name for the RADIUS server.
Server IP
Specify an IP address for the RADIUS server.
Authentication Port
Specify the authentication port of the RADIUS server.
By default, this is port 1812.
Enable Accounting
Enable accounting on the RADIUS server.
Sophos XG Firewall sends the following information to the RADIUS server as soon as the user logs in:
• Accounting start request
• User login time
Sophos XG Firewall sends the following information to the RADIUS server the moment the user logs out:
• Accounting stop request
• User logout time
Note: Supported client types: Windows client, HTTP client, Linux client, Android, iOS, iOS HTTP client, Android HTTP client, API client.
Sophos XG Firewall | Configure | 168
Note: The accounting stop message is not sent to the RADIUS server when Sophos
XG Firewall shuts down or reboots.
Accounting Port (available only if Enable Accounting is active)
Specify a RADIUS port number through which Sophos XG Firewall can communicate with the
RADIUS server.
Shared Secret
Specify the shared secret which is a text string that serves as a password between a RADIUS client and a RADIUS server.
Group Name Attribute
Specify the alias for the configured group name which is displayed to the user.
Figure 129: Add RADIUS Server
4. Click Test Connection to check the connectivity between the RADIUS server and Sophos XG Firewall. It also validates the RADIUS server user credentials.
5. Click Save.
Add TACACS+ Server
This page describes how to add a TACACS+ server.
1. Go to Configure > Authentication > Serversand click Add.
2. As Server Type, select TACACS+ Server.
3. Specify the TACACS+ server details:
Server Name
Specify a descriptive name for the TACACS+ server.
Server IPv4
Specify an IP address for the TACACS+ server.
Port
Specify the port of the TACACS+ server.
By default, this is port 49.
Shared Secret
Specify the shared secret which is a text string that serves as a password between a TACACS+ client and a TACACS+ server.
Sophos XG Firewall | Configure | 169
Figure 130: Add TACACS+ Server
4. Click Test Connection to check the connectivity between the TACACS+ server and Sophos XG Firewall. It also validates the TACACS+ server user credentials.
5. Click Save.
Add eDirectory Server
This page describes how to add an eDirectory server.
1. Go to Configure > Authentication > Serversand click Add.
2. As Server Type, select eDirectory.
3. Specify the eDirectory server details:
Server Name
Specify a descriptive name for the eDirectory server.
Server IP/Domain
Specify an IP address or domain for the eDirectory server.
Port
Specify the port of the eDirectory server.
By default, this is port 389.
Username
Specify a username for the eDirectory server.
Password
Specify a password for the eDirecory server.
Connection Security
Select the connection security for the eDirectory server:
• Simple: User credentials will be send unencrypted as plaintext.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The
Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Base DN
Specify the Base DN for the eDirectory server. The Base DN is the starting point relative to the root of the eDirectory tree where the users are included who are to be authenticated. Note that the Base
DN must be specified by the full distinguished name (DN) in LDAP notation, using commas as delimiters (e.g., O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
Sophos XG Firewall | Configure | 170
Figure 131: Add eDirectory Server
4. Click Test Connection to check the connectivity between the eDirectory server and Sophos XG Firewall. It also validates the eDirectory server user credentials.
5. Click Save.
Services
This page allows you to configure authentication for firewall, VPN and admin traffic.
You can also configure global settings, NTLM settings, web client settings, Captive Portal parameters and Radius client settings for Single Sign-On server.
Note: You can also view and manage the authentication status on the Monitor & Analyze > Diagnostics >
Services page.
Once you have deployed the device, the default access policy is automatically applied which will allow complete network traffic to pass through the device. This will allow you to monitor user activity in your network based on the default policy.
As device monitors and logs user activity based on the IP address, all the reports are also generated based on the IP address. To monitor and log user activities based on usernames or logon names, you have to configure the device for integrating user information and authentication process. Integration will identify access requests based on usernames and generate reports based on usernames.
When the user attempts to access, the device requests a user name and password and authenticates the user’s credentials before giving access. User level authentication can be performed using the local user database on the device, external ADS server, LDAP, RADIUS or TACACS+ server.
To set up the user database
1. Integrate ADS, LDAP, RADIUS or TACACS+ if external authentication is required.
2. Configure for local authentication.
3. Register user
The device provides policy-based filtering that allows defining individual filtering plans for various users of your organization. You can assign individual policies to users, or a single policy to a number of users (group).
The device detects users as they log on to a Windows domain in your network via client machines. Users are allowed or denied access based on username and password. In order to authenticate a user, you must select at least one database against which the device should authenticate users.
To filter the Internet requests based on policies assigned, the device must be able to identify a user making a request.
You can configure Administrator, Firewall, VPN, and SSL VPN authentication through one or more servers.
This section covers the following topics:
Sophos XG Firewall | Configure | 171
Firewall Authentication Methods
Authentication Server List
Select an authentication server.
Authentication Server List displays all the configured servers while Selected Authentication
Server List displays servers that will be used for authentication when the user tries to login.
In case of multiple servers, the authentication request is forwarded as per the order configured in the
Selected Authentication Server list.
Default Group
Select the default group for firewall authentication.
Figure 132: Firewall Authentication Methods
VPN (IPsec/L2TP/PPTP) Authentication Methods
Set Authentication Methods Same As Firewall
Enable to use the same authentication method as configured for the firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for VPN traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication
Server list displays servers that will be used for authentication when user tries to login.
Override the authentication method for VPN traffic by selecting or deselecting any authentication server.
In case of multiple servers, the authentication request will be forwarded as per the order configured in the Selected Authentication Server list.
If RADIUS server authenticates users then PPTP and L2TP connections established using
MSCHAPv2 or CHAP protocol can be authenticated through RADIUS.
Sophos XG Firewall | Configure | 172
Figure 133: VPN (IPsec/L2TP/PPTP) Authentication Methods
Administrator Authentication Methods
You can configure and manage authentication settings for all administrator users except for the super administrator.
Set Authentication Methods Same As Firewall
Select to use the same authentication method as configured for firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for administrator traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication
Server list displays servers that will be used for authentication when user tries to login.
Override the authentication method for administrator traffic by selecting or deselecting any authentication server.
In case of multiple servers, the authentication request will be forwarded as per the order configured in the Selected Authentication Server list.
Sophos XG Firewall | Configure | 173
Figure 134: Administrator Authentication Methods
SSL VPN Authentication Methods
Same as VPN
Enable to use the same authentication method as configured for VPN traffic.
Same as Firewall
Enable to use the same authentication method as configured for the firewall traffic
Set Authentication Method for SSL VPN
Enable to configure the authentication server for SSL VPN.
Authentication Server List displays all the configured servers while Selected Authentication
Server list displays servers that will be used for authentication when user tries to login.
Override the authentication method for SSL VPN traffic by selecting or deselecting any authentication server.
In case of multiple servers, the authentication request will be forwarded as per the order configured in the Selected Authentication Server list.
Sophos XG Firewall | Configure | 174
Figure 135: SSL VPN Authentication Methods
Global Settings
Maximum Session Timeout
Specify the timeout duration in minutes.
Maximum Session Timeout is the time in minutes a user is logged into the device. Exceeding the period, the user will be logged out automatically and the user must re-authenticate. This is applicable to administrative sessions only.
Acceptable range: 3 to 1440 minutes
Enable Unlimited to allow the users to remain logged in.
Simultaneous Logins
Specify the maximum number of concurrent logins allowed to the user.
Acceptable range: 1 to 99 concurrent logins
Alternatively, enable Unlimited to allow unlimited concurrent logins to the user.
Note: Login restriction is applicable only to those users who are added after this configuration.
Figure 136: Global Settings
NTLM Settings
Inactivity Time
Specify the inactivity time in minutes.
Sophos XG Firewall | Configure | 175
The user inactivity timeout is the inactive/idle time in minutes after which the user will be logged out and has to re-authenticate.
Acceptable range: 6 to 1440 minutes
Default: 6 minutes
Data Transfer Threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default: 1024 bytes
HTTP challenge redirect on Intranet Zone
Enabled: When a site hosted on the Internet initiates the NTLM web proxy challenge for authentication, the device redirects NTLM authentication challenge to the Intranet zone. The client is transparently authenticated through the device’s local interface IP and credentials are exchanged only in the Intranet zone. User credentials remain protected.
Disabled: The client is transparently authenticated by the browser through the device by sending user credentials over the Internet.
Default: Enabled
Figure 137: NTLM Settings
Web Client Settings (iOS and Android and API)
Inactivity Time
Specify the inactivity time in minutes.
The user inactivity timeout is the inactive/idle time in minutes after which the user will be logged out and has to re-authenticate.
Acceptable range: 6 to 1440 minutes
Default: 6 minutes
Data transfer threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default: 1024 bytes
Figure 138: Web Client Settings
SSO using RADIUS accounting request
Device can authenticate users transparently who have already authenticated on an external RADIUS server.
RADIUS Client IPv4
Specify the IPv4 address of the RADIUS client.
Only requests from the specified IP address will be considered for SSO.
Shared Secret
Provide shared secret for authentication.
Show Shared Secret
Click Show to view the configured shared secret.
Sophos XG Firewall | Configure | 176
Figure 139: SSO using radius accounting request
Web Policy Actions for Unauthenticated Users (Captive Portal)
Prompt unauthenticated users to login
Select Yes to redirect the access request of unauthenticated users either to the Captive Portal or
Custom Message page.
Select No to drop unauthenticated user traffic. Unauthenticated users will not be redirected to the
Captive Portal or the Custom Message page.
Login prompt method
Configure where the unauthenticated user access requests should be redirected to.
Available Options:
• Include link to the Captive Portal in the User Notification message
• Display a custom message
Select Include link to the Captive Portal in the User Notification message, if an unauthenticated user access request is to be forwarded to the Captive Portal page.
Captive Portal uses HTTPS
If enabled, the user gets access to the Captive
Portal page through secure channel.
Default: Enabled
Provide link to full User Portal
Redirect to a URL after login
URL to redirect
Preserve captive portal after login
Use keep alive to maintain user session
If enabled, the User Portal link is available on the Captive Portal page.
Default: Enabled
If enabled, the user gets redirected to the user requested page or custom page.
If request is to be redirected to the custom page, click Custom URL and specify the URL, else click User requested URL.
Select Yes to minimize the Captive Portal popup, once the user is successfully authenticated.
Selecting No lets the Captive Portal to be displayed on system screen after successful authentication.
Disable to logout the user after the configured inactivity time. If disabled, specify User
Sophos XG Firewall | Configure | 177
Inactivity Timeout and Data Transfer
Threshold.
The keep alive request is constantly exchanged between the device and user to check whether the user has logged out or is idle. If the device does not receive a response, the user is logged out automatically.
The more concurrent HTTP Captive Portal users there are, the more keep-alive requests are exchanged. In case of multiple concurrent HTTP
Captive Portal users we recommend to disable this option.
Default: Enabled
• User Inactivity Timeout
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to re-authenticate. Enable and specify timeout duration in minutes.
Acceptable range: 3 to 1440 minutes
Alternatively, select the checkbox Unlimited to keep the user logged in.
Default: Disabled
• Data Transfer Threshold
Specify a threshold value in bytes for the data transfer. If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Select Display a custom message, if unauthenticated user is to be displayed custom message.
Page Header Image
Select Default to display the default image shipped with the device at the top of the custom message page, or select Custom to browse and upload a customized image.
Supported image format: JPG, PNG or GIF
Size: 700 X 80 pixels
Page Footer Image
Select Default to display the default image shipped with the device at the bottom of the custom message page, or select Custom to browse and upload a customized image.
Supported image format: JPG, PNG or GIF
Size: 700 X 80 pixels
Custom Message
Specify a message. You can customize the message to include the client IP address, category, and
URL.
Blink Custom Message
Preview
Enable this option to display a blinking message.
Preview and check how the message will be displayed before saving the configuration.
Sophos XG Firewall | Configure | 178
Figure 140: Captive Portal Settings
Groups
The Groups page displays a list of all the default and custom groups.
A group is a collection of users having common policies that can be managed as a single unit thus providing the possibility to assign various policies to a number of users in one operation/step. Users that belong to a particular group are referred to as group users.
A group can contain default as well as custom policies.
Various policies that can be grouped are:
• Surfing quota policy which specifies the duration of surfing time and the period of subscription
• Access time policy which specifies the time period during which the user will be allowed access
• Network traffic policy which specifies the time allocated to cyclic/non-cyclic network traffic
• Traffic shaping policy which specifies the bandwith allocated for upload and download traffic
• Remote access policy which controls the access of remote clients
• Clientless policy which controls the access of clientless users
Creating a New User Group
This page describes how to configure a user group.
Once the appropriate group is assigned, the user will automatically inherit all the policies added to the group.
1. Go to Configure > Authentication > Groups and click Add.
2. Specify the user group details.
Group Name
Enter a unique name for the group.
Description
Specify a description for the group.
Group Type
Select the group type.
Available Options:
• Normal - The user of this group needs to log on using the client device to access the Internet.
Sophos XG Firewall | Configure | 179
• Clientless - The user of this group does not need to log on using the client device to access the
Internet and is symbolically represented by “group name (C)”. Access control is performed through the IP address.
Figure 141: User Group Details
3. Specify the Policies.
Surfing Quota
Select the surfing quota policy from the list.
Note: For the group type Clientless, the option Unlimited is automatically applied.
Access Time
Select the access time policy from the list.
Note: For the group type Clientless, the option Unlimited is automatically applied.
Network Traffic (not available for the Clientless group)
Select the network taffic policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Traffic Shaping
Select the traffic shaping policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Remote Access
By default, the user will inherit his group’s policy. To override the group policy, select a policy from the list.
You can also create a new policy directly on this page or from VPN > SSL VPN (Remote
Access) > VPN > SSL VPN (Remote Access) page.
If a user shall not be provided SSL VPN access then select No Policy Applied.
Clientless
By default, the user will inherit his group’s policy. To override the group policy, select the policy from the list.
You can also create a new policy directly on this page or from VPN > Clientless Access > VPN >
Clientless Access page.
If a user shall not be provided SSL VPN access then select No Policy Applied.
Quarantine Digest
Configure quarantine digest.
Quarantine digest is an email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the digest on hourly, daily
Sophos XG Firewall | Configure | 180 or weekly basis to the user. Digest also provides a link to the User Portal from where the user can access and take an action on quarantined messages.
Available Options:
• Enable - The user will receive the quarantine digest at the configured frequency. This setting overrides the group setting.
• Disable - The user will not receive quarantine digest. This setting overrides the group setting.
Note: Quarantine digest is not applicable to Wi-Fi devices.
MAC Binding
Enable to bind the user to a MAC address. By binding a user to a MAC address, you are mapping the user with a group of MAC addresses.
L2TP (not available for the Clientless group)
Enable to grant group members access through an L2TP connection.
PPTP (not available for the Clientless group)
Enable to grant group members access through an PPTP connection.
Login Restriction (not available for the Clientless group)
Select the appropriate option to specify the login restriction for the group.
Available Options:
• Any Node - Select to allow a user to login from any of the nodes in the network.
• Selected Nodes - Select to restrict user login to the specified nodes. Specify an IP address. For an existing group, you can add further nodes, edit a node or remove a node.
• Node Range - Select to allow the user to login from a range of IP address. Specify the IP address range.
For the options Selected Nodes and Node Range, only IPv4 addresses are permitted.
Sophos XG Firewall | Configure | 181
Figure 142: Policies
4. Click Save.
Note: User configuration - MAC binding and policies is given precedence over the group configuration.
Adding Users to the Existing Groups
This page describes how to add a user to an existing group.
1. Go to Configure > Authentication > Groups
2.
Select the group to which you want to add the users by clicking the respective icon in the Manage column.
3. Click Add Member(s).
A pop-up window Add Group Member appears providing a list of all the users who can be added to the group along with some details. To search for a user filter the list based on the name and/or the current group.
4. Select the user you want to add to the group. You can select a single user or multiple users on the same page.
5. Click Add to confirm adding the member to the group.
6. Click Save.
The user is added to the group. You can check this by editing the group and clicking the Show Group Members button.
Viewing List of Group Members
This page describes how to check a user’s membership in a group.
1. Go to Configure > Authentication > Groups.
2.
Select the group for which you want view the group members and click the edit icon in the Manage column.
Sophos XG Firewall | Configure | 182
3. Click Show Group Member(s).
A pop-up Group Members appears providing the list of all the users who are member of the selected group along with their usernames.
4. Click Close to close the Group Members pop-up window.
Users
The Users page displays the list of all users added in the device.
Users are identified by an IP address or a username and are assigned to a user group. All the users in a group inherit the policies defined for that group.
User Types
The device supports the following types of users:
• Normal
• Clientless
• Single Sign-On
• Thin Client user
• WWAN user
A normal user has to log in into the device which requires a client (client.exe) on the user machine, or the user can use a HTTP client component and all the policy-based restrictions are applied.
A clientless user does not require a client component (client.exe) on the user machine.
If Single Sign-On settings are configured, users are automatically logged to the device.
Thin client users do not need to have a client installed on the user machine.
WWAN users can log on via WLAN.
Use the given decision matrix below to choose which type of the user should be created.
Table 2: Decision matrix for adding a user
Feature Normal User
User login required
Type of Group
Normal
Clientless
Yes
Yes
No
Apply login restriction Yes
Apply Surfing Quota policy Yes
Apply Access Time policy Yes
Apply Traffic Shaping policy
Yes
Apply Web Filter Policy
Apply Application Group policy
Yes
Yes
Apply Network Traffic policy
Yes
Clientless User
No
No
Yes
Yes
No
No
Yes
Yes
Yes
No
Single Sign On User
No
Yes
No
Yes
Yes
Yes
Yes
Yes
Yes
Yes
The page displays a list of all the available users along their user IDs, names and usernames, user types, profiles, group memberships, and their activity status.
Sophos XG Firewall | Configure | 183
Note: You can also view and manage live users on the Monitor & Analyze > Current Activities > Monitor
& Analyze > Current Activities > Live Users page.
Registering a New User
This page describes how to create a new user and quickly configure a related policy.
Once a user is registered successfully, the page provides two more options:
•
- Click to reset Internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage for that user.
1. Go to Configure > Authentication > Usersand click Add.
2. Specify the user details.
Username
Enter a unique username for the user.
Name
Enter a name for the user.
Description
Specify a description for the user.
Password
Specify a password and re-enter the same password for confirmation.
The password is case-sensitive.
User Type
Select the type of user from the available options.
Available options:
• User
• Administrator
Profile (available only if Uuser Type selected is Administrator)
Select the administrator profile. The administrator will get access to various Admin Console menus as per the configured profile.
You can create a new profile directly from this page or from the System > Profiles > Device Access page after clicking Add.
Enter a email address of the user.
Use comma to seperate multiple email addresses.
Sophos XG Firewall | Configure | 184
Figure 143: Add User
3. Specify the Policies details.
Group
Select a group in which the user is to be added. User will inherit all the policies assigned to the group.
Surfing Quota
By default, the user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page or from the Protect > Web > Surfing
Quotas page.
Access Time
By default, the user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page or from the System > Profiles > Access
Time page.
Network Traffic
By default, the user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page or from the System > Profiles > Network
Traffic Quota page.
Traffic Shaping
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page or from the System > Profiles > Traffic
Shaping page.
Sophos XG Firewall | Configure | 185
Figure 144: Policies
4. Specify the SSL VPN Policy details.
Remote Access
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page or from the Configure > VPN > SSL VPN
(Remote Access) page.
If the user is not to be provided SSL VPN access then select No Policy Applied.
Clientless
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page or from the Configure > VPN > Clientless
Access page.
If the user is not to be provided clientless access then select No Policy Applied.
L2TP
By default, the user is provided remote access through L2TP. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for L2TP access.
PPTP
By default, the user is provided remote access through PPTP. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for PPTP access.
CISCO
™
VPN Client
By default, the user is provided remote access through CISCO VPN client. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for CISCO VPN access.
Note: To use this feature, CISCO ™
VPN client needs to be configured from the
Configure > VPN > Cisco VPN Client page.
Quarantine Digest
Configure the quarantine digest.
Quarantine digest is an email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the digest to the user at the
Sophos XG Firewall | Configure | 186 configured frequency. Digest also provides a link to the User Portal from where the user can access and take an action on quarantined messages.
Available options:
• Enable - The user will receive the quarantine digest daily. This option overrides the group setting.
• Disable - User will not receive quarantine digests. This option overrides the group setting.
Note: This feature is only available for non-wifi devices.
Simultaneous Logins
Specify the number of concurrent logins that will be allowed for the user or click Unlimited for allowing unlimited concurrent logins.
Acceptable range: 1 to 99
Default: 1
Note: The specified setting will override the global setting specified in the client preferences.
MAC Binding
Enable/disable MAC Binding. By binding the user to a MAC address, you are mapping the user with a group of MAC addresses.
If enabled, specify MAC addresses for example 01:23:45:67:89:AB.
Once you enable MAC binding, the user will only be able to login through pre-specified machines.
Use a comma to seperate multiple MAC addresses. For example 01:23:45:67:89:AB,
01:23:45:67:89:AC.
Login Restrictions
Select the appropriate option to specify the login restriction for the user.
Available options:
• Any Node - User will be able to login from any of the nodes in the network.
• User Group Node(s) - User will be able to login only from the nodes assigned to his group.
• Selected Nodes (only available for IPv4) - User will be able to login from the specified nodes only.
•
Node Range (only available for IPv4) - User will be able to login from any of the IP addresses from the configured range.
Sophos XG Firewall | Configure | 187
Figure 145: SSL VPN Policy
5. Select Administrator Advanced Settings (available only if the user type is Administrator)
Schedule for Device Access
Schedule the device access.
The administrator will be able to access the device only during the time configured in the schedule.
Login Restriction for Device Access
Select the appropriate option to specify the login restriction for the user.
Available options:
• Any Node - Administrator will be able to login from any of the nodes in the network.
• Selected Nodes - Administrator will only be able to login from the specified nodes.
• Node Range - Administrator will be able to login from any of the IP addresses from the configured range.
Reset User Accounting (available only when editing a user)
Click to reset the Internet usage time and network traffic of the user.
View Usage (available only when editing a user)
Click to view the Internet usage and data transfer usage.
Note: User configuration is given precendence over group configuration.
Figure 146: Administrator Advanced Settings
6. Click Save.
Sophos XG Firewall | Configure | 188
Reset User Accounting
This option allows you to reset the Internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking the icon in the Manage column.
2. Click Reset User Accounting and OK to confirm.
Note: You cannot reset user accounting for the live user.
View Usage
This page describes how to view the Internet usage and data transfer usage of users.
1. Go to Configure > Authentication > Users.
2.
Edit the user account of the user whose data usage you want to view by clicking the icon in the Manage column.
3. Click View Usage.
A pop-up window displays policy information such as time allotted, renewal of the surfing quota cycle, the data transfer cycle and the spent Internet usage time. In addition it provides facts on the network traffic.
4. Select the month for which you want to display the usage information.
5. Click OK to return to the parent page.
Importing User Information
The Import Users page allows you to add new users by importing user details from the file.
Instead of creating users again in the device, if you already have users detail in a csv file, you can upload the csv file.
1. Go to Configure > Authentication > Users and click Import to import the csv file.
2. Browse to include the complete path for migrating user’s information file.
3. Please consider the csv file format requirements:
• Header (first) row should contain field names. Format of header row:
• Compulsory field: username
• Optional fields: password, name, group, email address
• Fields can be configured in any order.
• Subsequent rows should contain values corresponding to each field in the header row.
• Number of fields in each row should be same as in the header row.
• An error will be displayed if data is not provided for any field specified in the header.
• Blank rows will be ignored.
• If no password field is included in the header row then it will be set the same as the username.
• If no group name is included in the header row, the administrator will not be able to configure a group at the time of migration.
4. Click Upload to import the file.
Exporting Users
This menu allows you to export user information.
1. Go to Configure > Authentication > Users and click Export to export the user details in a csv file.
A pop-up window appears displaying the name of the csv file you are going to export.
2. Select to open or save the file.
3. Click OK.
The csv file is generated with the following headers: Name, Username, Enc_password, Email Address, and Group.
Note: Backend users, that means users who are authenticated against a backend authentication service like
Active Directory, will not be exported.
Sophos XG Firewall | Configure | 189
Purging Active Directory Users
This page allows you to purge AD Users.
1. Go to Configure > Authentication > Users and click Purge AD Users to synchronize the device’s Active
Directory users with an external Active Directory server.
Note: The purge operation will not interrupt user login/logout and accounting events. If HA is configured, user details are deleted from both, the primary device and the auxiliary device.
2. Click OK to confirm the message.
Change Status
1. Go to Configure > Authentication > Users.
2. Select a user whose status is to be changed and click Change Status to change the status of that user.
If the current status is Enabled, the status of the user will change to Disabled when you click this button and viceversa.
One-Time Password
On this page, you can configure the one-time password (OTP) service, and you can monitor or edit the tokens of the one-time-password users.
One-time passwords are a method to improve security for password-based authentication. The user-specific password, which is sometimes too weak, will be amended with a one-time password that is valid for only one login. Thus, even if an attacker gets hold of it, he will not be able to log in with it.
One-time passwords generally change consistently, in regular intervals, being calculated automatically by a specific algorithm. Soon after a new password is calculated, the old password expires automatically. To calculate one-time passwords, the user needs to have either a mobile device with an appropriate software, or a special hardware or security token. Hardware tokens are ready to use from the start. On the mobile device, the end user needs to install
Sophos Authenticator or a similar software and deploy the configuration, which is available in the User Portal as a QR code, on the start page or on the OTP Token page (see User Portal page). Having done that, the device calculates onetime passwords in token-specific intervals. It is important that date and time are correct on the mobile device as the time stamp is used for one-time password generation.
Note: To authenticate on the facilities where the one-time password ist required, the user has to enter his user-specific device password, directly followed by the one-time password.
The administrator can also generate one-time passwords, also known as passcodes, manually. In this case, you have to ensure that these not time-limited one-time passwords are safely transmitted to the end user. This process, however, should only be considered as a temporary solution, for example when a user temporarily has no access to his or her password calculating device.
The page displays all existing one-time passwords. You can add , update or delete an OTP. For each OTP, the list shows:
Username
Displays the user name of the OTP owner.
Status
Displays the status of the OTP.
Secret
Displays the 32-hex secret of the OTP.
Related information
Create OTP Token Automatically for Two-Factor Authentication
Add OTP Token
This page enables you to add and edit one-time password tokens.
Sophos XG Firewall | Configure | 190
1. Go to Configure > Authentication > One-Time Password and click the Add button.
2. Specify the following details for adding an OTP token:
Secret
This is the shared secret of the user’s hardware token or soft token. A hardware token has an unchangeable secret, given by the hardware producer. The soft token is created randomly by Sophos
XG Firewall, when Auto-create OTP tokens for users is enabled. The secret should have a hexadecimal format and consist of at least 32 characters.
User (optional)
Select the user to whom the token should be assigned.
Description (optional)
Add a description or other information. This text will be displayed for the administrator with the QR code. If you define different tokens for one person, e.g., a hardware token and a soft token for the mobile phone, it is useful to enter some explanation here as the user will be displayed all QR codes side by side.
Use custom token timestep
If you need another timestep for a token than the default token timestep defined in the OTP Settings section, enable this toggle switch and enter the value. The timestep defined here has to correspond with the timestep of the user’s password generation device, otherwise authentication fails.
Timestep
Enter the value for the additional timestep.
Acceptable range: 10 - 300 seconds.
Additional Codes (Available only when editing OTP token)
You can add one-time passwords manually for a token. Click the Plus icon to generate the one-time passwords (10 at maximum). These one-time passwords are not time-limited. A one-time password will be deleted automatically when the user logged in with it.
Figure 147: Add OTP Token
3. Click Save.
The OTP token for the specific user has been created and appears in the one-time password list on the One-time
Password page.
Configure One-time Password
This page allows you to enable and configure the one-time password service.
1. Go to Configure > Authentication > One-Time Password and click the Settings button.
Sophos XG Firewall | Configure | 191
2. Activate the one-time password service by clicking on the ON/OFF slider.
3. Specify the OTP service status.
OTP for all users
If enabled, all users have to use one-time passwords. If only specific users should use one-time passwords, disable this option and select or add users or groups from the list.
Auto-Create OTP Tokens for users
If enabled, a QR code for configuring the mobile device software will be presented to the authorized users the next time they log in to the User Portal. For this to work, make sure that the users have access to the User Portal. When a user logs in to the User Portal, the respective token will appear in the OTP Tokens list. Enabling this feature is recommended when you are using soft tokens on mobile devices. If your users only use hardware tokens you should instead disable this option and add the tokens before enabling the OTP feature.
Enable OTP for facilities
Here, you select the Sophos XG Firewall facilities that should be accessed with one-time passwords by the selected users. When you select the Auto-create OTP tokens for users option, the User
Portal needs to be enabled for security reasons: As the User Portal gives access to the OTP tokens, it should have no weaker protection itself.
Note: When selecting WebAdmin you have to ensure that the selected users have access to the one-time password tokens. Otherwise you may log them out permanently.
4. Specify the timestep settings.
Default token timestep in seconds
To synchronize one-time password generation on the mobile device and on the Sophos XG Firewall, the timestep has to be identical on both sides. Some hardware tokens use 60 seconds. Other software
OTP tokens use a timestep of 30 seconds which is the default value here. If the timestep does not match, authentication fails.
Acceptable Range: 10 - 300 seconds
Default: 30 seconds
Maximum passcode offset steps
With help of this option you can set the maximum passcode offset steps. This means if you for example set 3 steps you restrict the clock of a token to drift no more than 3 timesteps between two logins.
Acceptable range: 0 - 10 steps
Default: 1 step
Maximum initial passcode offset steps
With help of this option you can set the maximum initial passcode offset steps. This means if you for example set 10 steps you restrict the clock of a token to drift no more than 10 timesteps between two logins. This option is only applied when the user employs the token for the very first time.
Acceptable range: 0 - 600 steps
Default range: 10 steps
Sophos XG Firewall | Configure | 192
Figure 148: Configure OTP
5. Click Apply.
Captive Portal
The Captive Portal allows customization of the Captive Portal login page.
The device provides flexibility to customize the Captive Portal login page. This page can include your organization name and logo.
The device also supports a customized page in languages other than English.
External users, who need to use authentication services, are required to log in over the Captive Portal once before they get access to the User Portal. External users can access the Captive Portal by browsing to https://<Sophos
Device IP Address>:8090. After login, external users have access to the User Portal and are listed on the Configure >
Authentication > Users page. External users can access the User Portal by browsing to https://<Sophos Device IP
Address> or clicking Click here for User My Account on the Captive Portal page.
1. Go to Configure > Authentication > Captive Portal.
2. Specify the General Settings.
Logo
Decide which logo to use.
• Custom - Select to upload the custom logo and specify an image file name to be uploaded. Click
Browse to browse and select the complete path.
• Default - Select to use the default logo
The image size should not exceed 125x70 pixels.
Sophos XG Firewall | Configure | 193
Logo URL
Provide an URL to be redirected to on clicking the logo.
Default:
/www.sophos.com
Page Title
Change the page title if required.
Default: Network Authentication
Login Page Header
Provide the text to be displayed on the Captive Portal login page.
Login Page Footer
Provide a message to be displayed in the footer of the Captive Portal login page.
Username Caption
Provide a label for the textbox to be displayed on the Captive Portal login page.
Default: Username
Password Caption
Provide a label for the textbox to be displayed on the Captive Portal login page.
Default: Password
Login Button Caption
Provide a label for the button to be displayed on the Captive Portal login page.
Default: Login
Logout Button Caption
Provide a label for the button to be displayed on the Captive Portal login page.
Default: Logout
User Portal Link Caption
Provide a text to be displayed for the User Portal login page link. By clicking the link, the user will be directed to the User Portal login page.
Default: Click here for User Portal
Sophos XG Firewall | Configure | 194
Figure 149: General Settings
3. Specify the Color Scheme settings.
Customize the color scheme of the Captive portal if required. Specify the color code or click the square box to pick the color.
Figure 150: Color Scheme
4. Specify the Custom HTML Template settings.
Use Custom HTML Template
Select to fully customize Captive Portal using custom HTML code.
HTML Text
Provide HTML code to render the Captive Portal according to your requirement. Dynamic contents like banners from external web servers, a customizable Message of the day box and so on can be integrated in the HTML code.
By default, sample HTML will be displayed.
Note: It is compulsory to have one HTML div element with ID __loginbox (e.g.
<div id=’__loginbox’>The system will render necessary input elements in this div.
Sophos XG Firewall | Configure | 195
Figure 151: Custom HTML Template
5. Select from the following possibilities:
Apply
Click to save your settings.
Preview
Click to view the custom settings before saving the changes.
Reset To Default
Click to revert to the default settings.
Guest Users
The Guest Users page displays a list of all the guest users added.
Users without a pre-existing user account who want to access the Internet using a hotspot, via a network available at the airport, hotels, hostels, etc., are called “guest users”. These users, that are otherwise considered unauthenticated and/or are denied access, are allowed to make a request to connect to the Internet for a limited time by authenticating themselves. Being authenticated, these users are authorized to access the Internet as guest user. At such public places,
Internet access is secured by configuring access policies to restrict any malicious use of the network.
Sophos XG Firewall allows the administrator to pre-configure individual or multiple guest users using the Admin
Console. The credentials of guest users configured via the Admin Console can be printed and handed over to the guest user. Alternately, guest users can register themselves using the guest user portal. The credentials and Internet access details of guest users registered via the guest user portal can either be sent via SMS or can be printed.
In case of successful authentication the guest user is granted access according to the applicable group, or else is redirected to the Captive Portal page.
You can filter the list based on the name or username of the user, cell phone number of the user, and validity of the user account, . The page also provides options to add a single or multiple users, distributing credentials for the
Internet access, update user parameters, view or reset the data transfer usage.
Resend Credential – Click the Resend Credential icon in the Manage column against a user registered via the
Guest User Portal to whom the access detail’s SMS are to be resent.
Registering a Single Guest User
This page describes how to register a new single guest user.
This page allows you to manually enter and configure guest user details. Before adding a guest user, you have to configure the general settings on the Configure > Authentication > Guest User Settings page.
1. Go to Configure > Authentication > Guest Usersand click Add Single.
2. Specify guest user details.
Username
Displays auto-generated username.
Sophos XG Firewall | Configure | 196
Password
Displays auto-generated password.
Name
Specify the name of the guest user.
Specify the email address of the guest user.
User Validity (Duration in Days)
Specify the validity for the specified guest user in days.
Minimum number of days: 1 day
Maximum number of days: 999 days
Validity Start
Select the type from when a user’s validity should be counted.
Available Options:
• Immediately - Validity is counted from the time the guest user is created.
• After First Login - Validity is counted from the time the guest user logs into the network for the first time.
Figure 152: Add Guest User
3. Click Add to register the guest user or Add and Print to register the user and print the login credentials.
Reset User Accounting
This option allows you to reset the Internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking the icon in the Manage column.
2. Click Reset User Accounting and OK to confirm.
Note: You cannot reset user accounting for the live user.
View Usage
This page describes how to view the Internet usage and data transfer usage of users.
1. Go to Configure > Authentication > Users.
2.
Edit the user account of the user whose data usage you want to view by clicking the icon in the Manage column.
3. Click View Usage.
A pop-up window displays policy information such as time allotted, renewal of the surfing quota cycle, the data transfer cycle and the spent Internet usage time. In addition it provides facts on the network traffic.
Sophos XG Firewall | Configure | 197
4. Select the month for which you want to display the usage information.
5. Click OK to return to the parent page.
Register Multiple Guest Users
This page describes how to create multiple guest users.
1. Go to Configure > Authentication > Guest Users and click Add Multiple.
2. Specify the guest user details.
Number of Users
Specify the number of guest users to be created.
User Validity (Duration in Days)
Specify the validity of multiple guest users in days.
Minimum number of day: 1 day
Maximum number of days: 999 days
Validity Start
Select the type from when the users’ validity should be counted.
Available Options:Immediately - Validity is counted from the time the guest users are created.After
First Login - Validity is counted from the time one of the guest users just created logs into the network for the first time.
Figure 153: Add Guest User
3. Click Add to register the users or Add and Print to register the users and print the login credentials.
The guest users have been created and appear on the Guest Users page.
Note: The users only appear with the name “guest-XXX”. To allocate names to these entries, you have to edit each user.
Update Guest User Configuration
This page describes how to change the policies configured for the guest user.
1. Go to Configure > AuthenticationGuest Users.
2.
Select the guest user for which you want to change the policies by clicking the icon in the Manage column.
3. Update the guest user details.
Username
Displays the username of the guest user.
Name
Change the name of the guest user if required.
Descripton
Specify a description of the guest user.
Password
Displays the password in encrypted format.
Sophos XG Firewall | Configure | 198
You can change the password by clicking on Change Password.
If you change it, enter the new password in the Password field and re-enter it in the Confirm
Password field.
Cell Phone Number
Displays the cell phone number.
Note: The cell phone number cannot be edited.
Change the the email address of the guest user if required.
Internet Usage Time
Displays total Internet usage time information in HH:MM format.
Figure 154: Edit Guest User
4. Specify the Policies.
Group
Displays the group to which the user belongs. User will inherit all the policies assigned to the group.
Note: The guest user group cannot be edited.
Surfing Quota
Select the surfing quota policy from the list.
You can also create a new policy directly from this page by selecting Create new and attach it to the user.
Access Time
Select the access time policy from the list.
You can also create a new policy directly from this page by selecting Create new and attach it to the user.
Network Traffic
Select the network traffic policy from the list.
You can also create a new policy directly from this page by selecting Create new and attach it to the user.
Traffic Shaping
Select the traffic shaping policy from the list.
You can also create a new policy directly from this page by selecting Create new and attach it to the user.
Sophos XG Firewall | Configure | 199
Note: User configuration is given precedence over group configuration i.e. user MAC binding and policies configuration is given priority over group configuration.
Figure 155: Policy
5. Specify the SSL VPN Policy details.
Remote Access
Select a policy for remote access from the list or create a new one. To create a new policy, select
Create new.
You can create a new policy directly from this page or from the Configure > VPN > SSL VPN
(Remote Access) page.
Clientless
Select a policy for clientless access from the list or create a new one. To create a new policy, select
Create new.
You can create a new policy directly from this page or from the Configure > VPN > Clientless
Access page.
If a user is not to be provided SSL VPN access then select No Policy Applied.
L2TP
Enable if you are mapping the user to get access through L2TP connection.
Provide the IP address to be leased to the guest user for L2TP access.
PPTP
Enable if you want to allow the user to get access through a PPTP connection.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the guest user for PPTP access.
CISCO
™
VPN Client
By default, the user is provided remote access through the CISCO VPN client. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for CISCO VPN access.
Note: To use this feature, CISCO ™
VPN client needs to be configured from the
Configure > VPN > Cisco VPN Client page.
Quarantine Digest
Configure the quarantine digest.
Quarantine digest is an email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the quarantine digest to the user every day. The digest provides a link to the user’s My Account from where the user can access his quarantined messages and take the required action.
Sophos XG Firewall | Configure | 200
Available Options:
• Enable - User receives the quarantine digest daily. This option overrides the group setting.
• Disable - User does not receive quarantine digests. This option overrides the group setting.
Note: Quarantine digest is not applicable to Wi-Fi devices.
Simultaneous Logins
Specify the number of concurrent logins that will be allowed to the user or click Unlimited for allowing unlimited concurrent logins.
The specified setting overrides the global setting specified in the client preferences.
MAC Binding
Enable/disable MAC Binding. By binding the user to a MAC address, you are mapping the user with a group of MAC addresses.
For Selected Nodes and Node Range only IPv4 addresses can be provided.
MAC address List
Specify MAC addresses, for example 01:23:45:67:89:AB.
Once you enable MAC binding, the user can login through pre-specified machines only.
To configure multiple MAC addresses use commas. For example 01:23:45:67:89:AB,
01:23:45:67:89:AC.
Login Restriction
Select the appropriate option to specify the login restriction for the user.
Available Options:
• Any Node - User can login from any of the nodes in the network.
• User Group Node(s) - User can login only from the nodes assigned to the group.
• Selected Nodes - User can login from the specified nodes only.
• Node Range - User can login from any of the IP addresses from the configured range.
Figure 156: SSL VPN Policy
Sophos XG Firewall | Configure | 201
Note: Before saving, you have two more options on this page
•
- Click to restart the accounting of the guest user’s Internet usage.
Note: You cannot reset the user accounting of live users.
•
- Click to view the Internet usage information of a particular guest user.
6. Click Save .
The guest user settings have been updated.
Clientless Users
The Clientless Users page displays a list of all the clientless users.
Clientless users are the users who can bypass the client login to access the Internet and are managed by the device itself. As clientless users can bypass the device login, create clientless users when your network has few Non-
Windows machines, VOIP boxes, or servers.
Add a Single Clientless User
This page describes how to add a single clientless user.
1. Go to System > Authentication > Clientless Usersand click Add.
2. Specify the clientless users details.
Username
Specify a username which uniquely identifies the user and will be used for login.
IP Address
Specify an IP address(IPv4/IPv6) for the clientless user.
Group
Select a group to which the user is to be added. The user will inherit all the polices assigned to the group.
Change the policies applied to the user by editing the user details (once the user has been created).
Name
Enter a unique name for the user.
Specify an email address.
Quarantine Digest
Configure quarantine digest. Quarantine digest is an email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the quarantine digest to the user every day. The digest provides a link to the User Portal from where the user can access quarantined messages and take the required action.
Available Options:
• Enable - User will receive the quarantine digest daily. This option overrides the group setting.
• Disable - User will not receive quarantine digests. This option overrides the group setting.
• Apply Group Settings - User will receive quarantine digests as configured for the group the user belongs to.
Note: Quarantine digest is not available for Wi-Fi devices.
Description
Specify a user description.
Sophos XG Firewall | Configure | 202
Figure 157: Add Clientless User
By clicking the icon you can add further users.
By clicking the icon you can remove users.
3. Click Save.
Reset User Accounting
This option allows you to reset the Internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking the icon in the Manage column.
2. Click Reset User Accounting and OK to confirm.
Note: You cannot reset user accounting for the live user.
View Usage
This page describes how to view the Internet usage and data transfer usage of users.
1. Go to Configure > Authentication > Users.
2.
Edit the user account of the user whose data usage you want to view by clicking the icon in the Manage column.
3. Click View Usage.
A pop-up window displays policy information such as time allotted, renewal of the surfing quota cycle, the data transfer cycle and the spent Internet usage time. In addition it provides facts on the network traffic.
4. Select the month for which you want to display the usage information.
5. Click OK to return to the parent page.
Add Multiple Clientless Users
This page describes how to add multiple clientless users.
1. Go to Configure > Authentication > Clientless Usersand click Add Range.
2. Specify the following:
From IP
Specify a Start-IP address for the range.
To IP
Specify an End-IP address for the range.
Group
You can change the policies applied to the user by editing the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
Sophos XG Firewall | Configure | 203
Figure 158: Clientless User
3. Click Save.
The users have been created and appear on the Clientless Users page.
Note: The users only appear with their IP addresses. To allocate names to these addresses, you have to edit each user.
Changing Policies of the Clientless User
This page describes how to change the policies configured for a clientless user.
Changing the policies applied to a user can be performed by updating the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
1. Go to Configure > Authentication > Clientless Users.
2.
Select the user for which you want to change the policies by clicking the icon in the Manage column.
3. Update the Policies.
Traffic Shaping
Change the Traffic Shaping policy applied to the user.
The policy applied here will take the precedence over the group policy.
You can also create a new traffic shaping policy on this page or on the System > Profiles > Traffic
Shaping page.
Quarantine Digest
Configure quarantine digest.
Quarantine digest is an email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the quarantine digest every day to the user. The digest provides a link to the User Portal from where the user can access his quarantined messages and take the required action.
Available Options:
• Enable - User will receive the quarantine digest daily. This option overrides the group setting.
• Disable - User will not receive quarantine digests. This option overrides the group setting.
Note: Quarantine digest is not available for Wi-Fi devices.
Figure 159: Policies
Note: Before saving, you have two more options on this page.
•
- Click to reset the Internet usage time and data transfer of the user.
Sophos XG Firewall | Configure | 204
Note: You cannot reset the user accounting of live users.
•
- Click to view the Internet usage and data transfer usage.
4. Click Save.
Guest User Settings
This page allows you to configure general settings, registration settings and SMS gateway for guest users.
Users without a pre-existing user account wanting to access the Internet using a hotspot, or via a network available at the airport, hotels, hostels, etc. are called “guest users”. These users, that are otherwise considered unauthenticated and/or denied access, are allowed to make request to connect to the Internet for a limited period by authenticating themselves. On being authenticated, these users are authorized to access Internet as guest users. At such locations,
Internet access is secured by configuring access policies to restrict any malicious use of the network.
Sophos XG Firewall allows administrator to pre-configure single or multiple guest users using the Admin Console.
The credentials of guest users configured via the Admin Console can be printed and handed over to the guest user.
Alternately, guest users can register themselves using the guest user portal. The credentials and Internet access details of guest users registered via the guest user portal can either be sent via SMS or can be printed.
In case of successful authentication the guest user is granted access according to the applicable group, or else is redirected to the Captive Portal page.
The page allows configuring general parameters to provide secured Internet access for guest users.
1. Go to Configure > Authentication > Guest User Settings.
2. Specify the Guest User General Settings.
Username Prefix
Enter a prefix to be used for auto-generation of a username for guest users.
Default: guest
Group
Select a group of policies to assign to guest users or create a new one.
Note: You can create a new group of policies directly from this page or from the
Configure > Authentication > Groups page.
Password Length
Specify the length of the auto-generated password for Guest Users.
Acceptable range: 3 to 60 characters
Default: 8 characters
The password length is a basic security parameter, the value of which affects the strength of password against brute force attack.
Password Complexity
Select a type of password from the available options to be used for complexity of an auto-generated password:
Available options:
• Numeric Password – Password will include only numeric characters.
• Alphabetic Password – Password will include only alphabetic characters.
• Alphanumeric Password – Password will include numeric as well as alphabetic characters.
• Alphanumeric with Special Character Password - Password will include numeric, alphabets and special characters.
The password strength is a function of its length, complexity, and unpredictability. Combining password length with password complexity makes a password difficult to guess.
Sophos XG Firewall | Configure | 205
Disclaimer
Provide the disclaimer message to be printed below every user’s login credentials.
Disclaimer once configured can be edited but cannot be removed.
Auto Purge on Expiry
Check to enable automatic purging of user details on expiry of user validity.
Note: Details of a user who is bound to rules (like firewall, IM, etc.) will not be purged automatically.
Figure 160: Guest User General Settings
3. Specify the Guest User Registration Settings.
Enable Guest Users Registration
Enable to allow secured Internet access to guest users.
SMS Gateway
Select the gateway using which SMS should be sent.
Alternately you may add the SMS gateway from this page itself by clicking Create new.
Guest Username
Select Use Cell Number as Username as method of generating a username.
If the Guest Username option is not selected, by default, the new user name will be generated with the value specified in Username Prefix.
User Validity (Duration in Days)
Specify the validity of guest users in days.
Default Country Code
Enable to configure a default country code.
The selected country is displayed as default option in the Cell Phone Number selection at the guest user registration page.
CAPTCHA Verification
Sophos XG Firewall | Configure | 206
Select to enable or disable CAPTCHA (Completely Automated Public Turing Test To Tell
Computers and Humans Apart) code verification on the guest user registration page to ensure the request is received for human being.
By enabling CAPTCHA verification, the user will be displayed a picture with characters that user must insert in a provided textbox below the picture. The administrator can therefore protect the device against attacks generated by automated programs.
Default: Enabled
Figure 161: Guest User Registration Settings
4. Click Apply.
5. Specify the SMS Gateway.
An SMS gateway allows sending and receiving short message service (SMS) to/from a home network for guest user registration. The device supports HTTP and HTTPS protocol based SMS service.
Configure SMS Gateway
This page allows you to configure an SMS Gateway for guest user registration.
1. Go to Configure > Authentication > Guest User Settingsand click Add under the SMS Gateway section.
2. Enter SMS gateway details.
Name
Enter the name of the SMS gateway.
URL
Specify the URL of the SMS gateway for sending an SMS request.
HTTP Method
Select the method for sending an SMS request to the SMS gateways from the options available:
Available Options:Get: Requests data from a specified resource.Post: Submits data to be processed to a specified resource.
Cell Number Format
Select to use country code with cell number.
Number Prefix
Specify the prefix value to be used with the cell number.
Number Prefix can include alpha-numeric and ASCII special characters.
It can be up to 4 characters long.
Sophos XG Firewall | Configure | 207
Request Parameters
Specify the following request parameters to configure the SMS gateway.
Name
Value
Name is a descriptor used to describe the meaning of the value. E.g. username, password, mobile
Indicates the value of a variable that are defined for the Name.
Response Format
Response describes the delivery status of the message such as success, failed, limit exceeded. Status message can be in various formats. Few of them are described below:
Response Format
{0} | {1} | {2}
Response Received
success | mbno | msgid/transactionid
Response Format
<status>500</status><transactionid>{0}</ transactionid><reason>{1}</reason>
Response Received
<status>500</status><transactionid>2323</ transactionid><reason>Limit Exceeded</reason>
When the response format is different for success and failure, it is recommended that the response format string should have a single content holder. E.g. {0}
Response Parameters
Sophos XG Firewall | Configure | 208
Response Parameter is the value presented by the content holder {0,1, 2...n} that will be displayed in the log viewer.
Parameter Index: Parameter Index is the content holder value {0,1, 2...n}.
Name: Name represents the content holder in the log viewer.
Example 1:
Parameter Index
0
1
2
Name
Status
Recipient
SMSID
Example 2:
Parameter Index
0
1
Name
SMSID - 2323
SMS Status Message – Length Exceeded
Figure 162: Add SMS Gateway
3. Click Save.
Testing Connectivity with SMS Gateway
This page allows you to check connectivity with the gateway after you have configured an SMS gateway.
1. Go to Configure > Authentication > Guest User Settings and in section SMS Gateway, edit the configured
SMS gateway and click Test Connection.
Sophos XG Firewall | Configure | 209
2. Enter a cell phone number. You will receive SMS through the gateway configured if you are able to connect to the gateway.
Figure 163: Test Connectivity
3. Click Save.
Client Downloads
The Client Downloads page allows you to to download all the clients or add-ins needed to interact with the device.
The device provides various options for user authentication. All the users are authenticated before they are provided access to network resources. User authentication can be performed using a local database, Active Directory, LDAP,
RADIUS, TACACS, eDirectory, NTLM or combination of these. The device also supports Single Sign On (SSO) for transparent authentication whereby Windows credentials can be used to authenticate and the user has to login only once to access network resources. SSO can be used in Active Directory and Citrix or Terminal Services Environment.
Users can authenticate with the device using the Captive Portal, authentication clients for Windows, Linux,
Macintosh, Android and iOS platforms or Single Sign On (SSO).
Following Clients can be downloaded from this page:
Single Sign-On
Sophos Single Sign-On Client - Enables users to logon to the organization network as well as to the device simultaneously. This requires client installation on the user’s machine.
Sophos Transparent Authentication Suite (STAS) - Enables transparent authentication whereby Windows credentials can be used to authenticate and the user has to login only once to access network resources. This does
NOT require a client installation on the user’s machine.
Sophos Authentication for Thin Client (STAC) - Enables transparent authentication for users in Citrix or Terminal
Services Environment whereby network credentials can be used to authenticate and the user has to login only once to access network resources. This does NOT require a client installation on the user’s machine.
Authentication Clients
Download MSI - Enables admins to install authentication clients via Microsoft Installer to multiple user devices to access network resources and the Internet as per the policies configured in the device.
Download CA for MSI - Download the digital certificate to be installed via MSI to ensure a safe connection with the device.
Download for Windows - Enables users using a Windows operating system to logon to the device to access network resources and the Internet as per the policies configured in the device.
Download for MAC OS X - Enables users using a system with Macintosh OS X onwards to logon to the device to access network resources and the Internet as per the policies configured in the device.
Download for Linux 32 - Enables users using a 32-bit Linux operating system to logon to the device to access network resources and the Internet as per the policies configured in the device.
Download for Linux 64 - Enables users using a 64-bit Linux operating system to logon to the device to access network resources and the Internet as per the policies configured in the device.
Sophos XG Firewall | Configure | 210
Download Certificate for iOS/Android client - Download the digital certificate to be installed in an iOS or Android system to ensure a safe connection with the device. Authentication Clients for iOS/Android can be downloaded from the respective App Store/Play Store.
SPX Add-ins
This feature is available only with a valid Email Protection subscription
This feature is available in Sophos Firewall Models XG105 and above, Cyberoam Models CR25iNG and above, and all Sophos UTM Models.
The SPX Add-in simplifies the encryption of the messages that contain sensitive or confidential information leaving the organization. The Add-in integrates seamlessly with the user’s Microsoft Outlook software, making it easy for users to encrypt messages through the Sophos Firewall (SF) Email Protection.
Follow the steps given below to install the Add-in Outlook:
1. Unzip the files to a temporary folder.
2. For an interactive installation, run setup.exe (users will be prompted for input).
3. For an unattended installation, please note the following prerequisites.
• Windows XP, Windows Vista, Windows 7, Windows 8 (both 32 and 64-bit) versions are supported.
• Microsoft Outlook 2007 SP3, 2010 or 2013 (both 32 and 64-bit) versions are supported.
Now, proceed as follows:
a. Install Microsoft .NET Framework 4 Client Profile.
b. Install Microsoft Visual Studio 2010 Tools for Office Runtime 4.0.
c. Run the installer with the following parameters: msiexec /qr /i SophosOutlookAddInSetupUTM.msi T=1
EC=3 C=1 I=1.
STAS
This page describes how to configure the Sophos Transparent Authentication Suite (STAS).
Sophos Transparent Authentication Suite (STAS) enables transparent authentication whereby Microsoft Windows credentials can be used to authenticate. The user has to log in only once to access the network resources. A client installation on the user’s machine is not required.
The Sophos Transparent Authentication Suite (STAS) program can be found under Configure > Authentication >
Client Downloads. For more information about STAS installation, see
Sophos Transparent Authentication installation guide
.
1. Go to Configure > Authentication > STAS.
2. To enable Sophos Transparent Authentication Suite click the toggle switch.
3. Click Activate STAS.
4. To enable the user inactivity click the toggle switch.
5. Specify the user inactivity.
Inactivity Time
Specify the inactivity time in minutes. The user inactivity timeout is the inactive/idle time in minutes after which the user will be logged out and has to re-authenticate.
Acceptable range: 3 to 1440 minutes
Default: 3 minutes
Data Transfer Threshold
Specify the minimum data to be transferred.
Default: 100 bytes
6. Click Apply.
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
