About Directory Connector

Directory Connector provides many tools to assist Users.

Settings

This section reviews the different settings and configuration options available for Directory Connector.

Status

This displays the current status and some statistics.

User Notification API

The "User Notification API" is a webapp running on the NGFW that various external scripts can call to notify NG Firewall that a specific user is logged into a specific IP. The userapi webapp is used to update and maintain the associated usernames in the Hosts so that User Matcher in Rules matches correctly. When a username is associated with the Username in Rules matches as expected.

• Enable/Disable: If the User Notification API is enabled; if it is disabled, the User Notification is completely disabled.
• Secret Key: Only API calls specifying the correct secret key will be allowed if specified. All other requests are ignored. If not specified, it is not required to use the API; however, the clientIP argument is ignored to avoid API abuse.

The webapp lives at http://SERVERIP/userapi/registration on the server and can be called with the following arguments:

For example, If the NGFW internal IP is 192.168.1.1 without a secretKey, to associate user foobar on machine foobarpc to 192.168.1.100 you would call visit this URL: http://192.168.1.1/userapi/registration?action=login&clientIP=192.168.1.100&username=foobar&hostname=foobarpc&secretKey=foobarsecret.

To unset that username mapping when the client logs out simply visit this URL: http://192.168.1.1/userapi/registration?action=logout&clientIP=192.168.1.100&secretKey=foobarsecret.

Visiting these URLs manually each time a user logs in or out of a machine is not realistic. Typically, this process is automated in one of two ways described below or uses a custom script.

User Notification Login Script

The User Notification Login Script or UNLS which is a small script that runs at login on each machine to notify the NGFW when a user logs in. This script can be pushed out to all the machines in a domain via a group policy object. This is useful in cases where you want to set the username in the Hosts without having users manually log into the Captive Portal.

Once installed, the script starts each time a user logs on to the network and immediately notifies NG Firewall of the username and IP address. Once this process is finished, any activity for that IP address will be automatically mapped to the username. This script runs on login and periodically in the background to keep the Directory Connector Username Map updated with any current information on your network users.

To download the User Notification Login Script, click the Download User Notification Login Script button and download the script. The script will be configured for your environment but may require further customization. Review the script and make changes as needed.

Now that you have the UNLS on your Domain Controller, you need to decide if you want it run for UNLS for the Entire Domain or UNLS for Specific Users.

UNLS for the Entire Domain

You can verify it works by looking in the Event Log for login/logout events.

UNLS for Specific Users

If you only want to use the UNLS for a few users, you can use these instructions:

1. Click the Download User Notification Login Script and save the user_notification.vbs file to \\localhost\\NETLOGON.
2. Using a text editor, create a local.bat file that has the following lines:

   @ echo off
   \\ADServerIPAddress\netlogon\user_notification.vbs

3. Save the local.bat file to \\localhost\\NETLOGON.
4. From the domain, go to the Users folder, right-click the user, and go to Properties.
5. On the Profile tab, type the filename of the UNLS (probably user_notification.vbs) in the Logon script field.
6. Launch the Group Policy Management Console, then launch the Group Policy Object Editor ( Start > Run : gpedit.msc).
7. Copy the user_notification.vbs file that you downloaded in the first step to this location.

Active Directory Server Login Monitor Agent

The other way to call the User Notification API is by running an agent/monitor on the Active Directory Server. The agent monitors the server's login events and updates the NG Firewall when a user logs to a computer. This has several advantages over the UNLS.

First download and install the agent on the Active Directory server. and configure it so that it updates the NG Firewall server when it sees user login events.

Configure the NGFW Settings in Login Monitor so it updates your NG Firewall event when login events occur.

• Secret Key: The Secret Key if there is a Secret Key configured on the NGFW User Notification API. User Notification must be enabled on the NGFW. If no Secret Key is configured, leave it blank.
• Prefix: The protocol to use to communicate with the NG Firewall.
• Port: The port to use to communicate with the NG Firewall. The default is port 80 for HTTP and 443 for HTTPS.
• IP Addresses: The IP addresses to reach your NG Firewall. These should be the LAN addresses of your NG Firewall. By default, HTTP and HTTPS are closed on the NG Firewall's WAN side. If the Login Monitor Agent cannot reach the NG Firewall, an error icon is shown next to the NG Firewall IP address entry.

  
  

The Exempt IP Addresses tab lists IP addresses the Login Monitor should ignore for login events. IP addresses are accepted in the following format:

• Single IP address (192.168.2.2)
• Wildcard IP address (192.168.3.*)
• CIDR (192.168.4.0/24)
• Range (192.168.5.5-192.168.5.102)

The Exempt Users tab lists AD users that Login shows ignore for login events.

Active Directory

The test tools can verify your settings and view an incomplete user list. After configuring Active Directory, you can configure Captive Portal to authenticate users.

Azure Active Directory

After setting up Azure Active Directory, you can configure NG Firewall to authenticate via secure LDAP. The connection configuration is similar to a local Active Directory Domain, except you must enable the Azure checkbox. Confirm that the port is 636 and that Secure is enabled, as Azure Active Directory requires secure LDAP.

RADIUS

The RADIUS Connector allows NG Firewall to communicate with a RADIUS server. This is useful for:

1. Allowing users to login to Captive Portal using their RADIUS login/password. The Captive Portal will verify the authentication information directly with the AD server.

You can use the test tool to verify your settings. After RADIUS is configured, you can configure Captive Portal to use it for authenticating users.

Facebook

The Facebook Connector allows the NG Firewall to authenticate against Facebook. This is experimental and is not suggested for deployments.

Related Topics

Policy Manager

Captive Portal

About NG Firewall Reports

These reports can be viewed online through the administration interface or the separate reporting interface available to non-administrators reporting-only users.

Customizable report summaries can be sent via email. They include basic information and a link to view the online reports if the user has access.

Reports can backup your data in multiple formats to Google Drive for long term storage.

Settings

This section discusses the different settings and configuration options available for Reports.

Status

You can click View Reports to open up Reports on this tab in a new browser tab.

All Reports

This is the full list of all currently existing reports, including all the default reports and any custom reports that have been added.

To edit a report, click View and then click Settings.

To delete a custom report, click View and then click Delete.

To create a new custom report, click View on a similar existing report, then click Settings. Then, change the name and click Save as New Report.

To create a report from scratch, go to Reports and click Create New in the lower left. When creating reports from scratch, each field must be carefully chosen and tuned until the desired data is provided. This process can be time-consuming and difficult. Working with a similar report is suggested to require the desired result. Additionally, you can ask for help via support or the forums and import the report if someone can craft it for you.

If creating a report from scratch, the settings and fields and their purposes are described below.

Report Entry

A report has many settings describing how to craft a SQL query and display the data. Here are the fields:

Data

• Data Retention: This value controls how long report data is kept on disk. Note that increasing the number increases the amount of disk space needed for data storage.
  Note:NG Firewall version 16.3 and above stops reporting data when free space falls below 5 GB.
• Delete All Reports Data: This option is useful if you are running low on disk space and wish to free space by wiping the reports database.
• Google Drive Backup: If your system is connected to your Google account, you can configure Reports backups to Google Drive.
  • Upload Data to Google Drive. If enabled, and the Google Connector in Directory Connector is enabled, your daily data will be uploaded to Google Drive each night for safe storage.
  • Upload CSVs to Google Drive. If enabled, and the Google Connector in Directory Connector is enabled, your daily CSV files will be uploaded to Google Drive each night for safe storage.
  • Google Drive Directory configures which subdirectory data will be uploaded to Google Drive.
• Import/Restore Data Backup Files: Imports data from a previous backup into the database.
  Note:This directly imports the SQL contents. If you have upgraded and the database schema has significantly changed since the time of the back, the import will not work correctly.

  
  

Email Templates

Additionally, you can copy the settings for an existing report.

The default Daily Reports template includes common text and chart reports for your system. This template is fixed and cannot be changed or modified.

Email Templates must be associated with Report Users.

Reports Users

Name Map

You can use the Name Map to configure the hostname for hosts manually. The NG Firewall can often determine the IP hostname automatically via DHCP or other methods. You can view the names of active hosts in the Hosts.

However, when the NG Firewall cannot automatically determine a hostname for an IP, the Name Map provides a way to name them manually.

Accessing Reports

If users are set up to receive email report summaries, they only need to view or download the HTML attachment to see an overview report. If they need more information or would like to drill down to specific users or machines, they can select the link in the email, which will open Reports on the NG Firewall if it is accessible from their location.

Note that to view Reports from outside the network, you'll need to check Allow HTTPS on WANs at Config > Network > Advanced > Filter Rules . If you have changed the External HTTPS Port, you'll need to use the proper HTTPS port when connecting from the outside.

Report Viewer

Reports provide a graphical view of your NG firewall's network traffic and actions. Various reports are available within applications and base system components. The Report Viewer allows you to manipulate the reports to drill down, customize, and export data in many ways.

Conditions

The Conditions panel appears at the top panel and can filter data displayed in reports. For example, to view a "specific" host's report, you can add a condition for Client = 192.168.1.100, all reports available will only show data where the client is 192.168.1.100. Multiple conditions can be added to drill down and inspect data. Conditions can also be added quickly by clicking on slices in pie charts.

The Add Condition drop-down contains many commonly used conditions, or the full list of all tables and columns can be browsed by clicking on the More button to add conditions for any database column.

Condition Operators

The second field in the condition is the logical operator that will be used in evaluating the condition value defined in the last field. In most use cases, the default "=" operator is what you want to use. However, several other operators are available that make the reports and alerts a lot more powerful.

Conditions Example - Policy by Policy ID

Conditions Example - Web Filter Categories

Related Topics

Custom Reports

About Policy Manager

Often, you will configure all of the NG Firewall apps to service the whole network; however, often, it is necessary to handle traffic for some users or network devices differently. For example, you may want Web Filter to be different for students vs teachers, and you may want no Web Filtering at all for your servers. You should run Captive Portal only on the WiFi network or for unidentified devices. You should block certain applications with Application Control, but only at certain times of the day.

Getting Started with Policy Manager

Policies provide a way to handle different settings for different sessions. Using our example, an NG Firewall protecting a school might have three policies - Students, Teachers, and Administrators. These policies provide separate configurations for traffic processing; for example, you could allow teachers to access Facebook but not students.

NG Firewall will always have at least one policy, the Default Policy. You can rename it, but you cannot remove this policy. As mentioned, you create Rules to send traffic to policies where the applications process it. Policies are created from within the Policy Manager. However, you will use NG Firewall's web GUI to switch to and configure each policy. At the top of the web GUI, you will see Default Policy with an arrow next to it - clicking this arrow allows you to change the policy you're looking at, and access the Sessions and Hosts, and open the Policy Manager Settings directly.

Parent Policies

When you first create a new policy, it contains no applications. You can add any applications you want and configure them to your liking or use the Parent Policy system. When creating a new policy using Policy Manager, you can select a Parent Policy. If you use this option, your new policy will be pre-populated with all applications and settings from your selected Parent Policy. However, it will look a bit different.

When you view the new child policy, the application faceplates will be greyed out, and you cannot click Settings. This is because the settings for these applications are inherited from the parent policy, which is useful. After all, it saves you from reconfiguring applications you want to operate the same way in multiple policies, such as the virus scanners. To change the settings or view the Events, you'll need to open the application on the parent policy and select the drop-down to select the policy to view traffic.

Suppose you want to modify the settings of an application in a child policy. In that case, you'll need to install the application you want to modify in the child policy - I know it's already there, but you can't click Settings to modify the configuration. On the Apps tab on the left side of the web GUI, click Install again. After a few seconds, the app will re-appear, and you can click Settings. Once this has happened, the new child application overrides the application inherited from the parent. The settings of the parent policy for this application do not affect the application you have added to the child policy. If you're following along, your child policy will contain all applications that your parent policy does. However, only one will have the Settings button enabled.

To recap, using our school example, we would send students to the default policy and then create a new teacher policy that uses the default policy as its parent policy. If you go to the Teacher Policy, all the apps will be greyed out, and you cannot modify any settings because they are copied from the Default Policy. By adding a new copy of Web Filter, you can modify the settings so the teachers can access websites the students cannot; however, settings for all other applications will still be copied from the Default Policy.

Settings

This section discusses the different settings and configuration options available for Policy Manager.

Status

This displays the current status and some statistics.

Policies

From this tab, you can create new policies; however, note that you'll first need to create and save a policy before creating a rule to apply traffic to that policy.

Rules

If you've been reading until now, you may have guessed that this new policy will only do something once you send traffic to it. To accomplish this, you'll need to create a rule - click Add in the Rules tab.

When each new session is processed, the rules are evaluated in order. If all of a session's attributes match the criteria of a rule, it is considered a match. The policy for the first matching rule will be used to process the session. If no rules match, the Default Policy will process the session.

These rules operate as described in the Rules documentation.

Like many areas of the NG Firewall, the rules work from the top down. Let's return to our school example and say we have three policies: Default (for students), Teacher, and Administrative Staff. To get traffic to these policies, we would need to create two policies: one for the Teacher policy and one for the Administrative Staff policy - any traffic that did not match those two policies would be sent to the Default Policy. You can also explicitly add a rule sending traffic to the Default Policy, although it's not required.

If the policy rule for the Teacher policy needs to be corrected, it may end up matching all network traffic and sending it to the Teacher policy. Because it matches, the rule under it (for the Administrative Policy) will never be evaluated. On the flip side, if a rule is too narrow, it may not match the traffic you're trying to match, dumping it on the Default Policy. Because of this, we recommend starting policy rules as very general (e.g., match a few IPs or an entire subnet) and then tightening them down from there - let's look at some common example policies:

So, this is the Rules tab of the Policy Manager settings. On this page, you will see all the rules that will be evaluated when determining which policy to use to direct a specific user or IP address. Pay attention to the 'Target Policy' column. Any users defined in the corresponding rule will be directed to that policy. To define the rule, click the page icon under the Edit column.

Click Edit and define the rule.

Once you've clicked the Edit button, this is where you'll end up. This is where you will define which users will be assigned to which policy. You can specify a user using any combination of the identifiers in the drop-down box. Users who match the specified identifiers will be directed to the policy specified in the Target Policy field.