About Directory Connector

Directory Connector provides many tools to assist with Users.

Settings

This section reviews the different settings and configuration options available for Directory Connector.

Status

This displays the current status and some statistics.

User Notification API

The "User Notification API" is a webapp running on the NGFW that various external scripts can call to notify NG Firewall that a specific user is logged into a specific IP. The userapi webapp is used to update and maintain the associated usernames in the Hosts so that User Matcher in Rules match correctly. When a username is associated with the Username in Rules matches as expected.

• Enable/Disable If enabled the User Notification API is enabled. If disabled, the User Notification is completely disabled.
• Secret Key: If specified, only API calls specifying the correct secret key will be allowed. All other requests are ignored. If not specified, it is not required to use the API however the clientIP argument is ignored to avoid API abuse.

For example, If the NGFW internal IP is 192.168.1.1 without a secretKey, to associate user foobar on machine foobarpc to 192.168.1.100 you would call visit this URL: http://192.168.1.1/userapi/registration?action=login&clientIP=192.168.1.100&username=foobar&hostname=foobarpc&secretKey=foobarsecret.

To unset that username mapping when the client logs out simply visit this URL: http://192.168.1.1/userapi/registration?action=logout&clientIP=192.168.1.100&secretKey=foobarsecret.

Obviously visiting these URLs manually each time a user logs in or out of a machine is not realistic. Typically this process is automated in one of two ways described below or using a custom script.

User Notification Login Script

The User Notification Login Script or UNLS which is a small script that runs at login on each machine to notify the NGFW when a user logs in. This script can be pushed out to all the machines in a domain via a group policy object. This is useful in cases where you want to set the username in the Hosts without having users manually log into the Captive Portal.

Once installed, the script starts each time a user logs on to the network and immediately notifies NG Firewall of the username and IP address. Once this process is finished, any activity for that IP address will be automatically mapped to the username. This scripts runs on login and periodically in the background to keep the Directory Connector Username Map updated with any current information on your network users.

To download the User Notification Login Script, click on the Download User Notification Login Script button and download the script. The script will be configured for your environment but may require further customization. Review the script and make changes as needed.

Now that you have the UNLS on your Domain Controller, you need to decide if you want it run for UNLS for the Entire Domain or UNLS for Specific Users.

UNLS for the Entire Domain

You can verify it is working by looking in the Event Log for login/logout events.

UNLS for Specific Users

If you only want to use the UNLS for a few users, you can use these instructions:

1. Click on the Download User Notification Login Script and save the user_notification.vbs file to \\localhost\\NETLOGON.
2. Using a text editor, create a local.bat file that has the following lines:

@ echo off
\\ADServerIPAddress\netlogon\user_notification.vbs

1. Save the local.bat file to \\localhost\\NETLOGON.
2. From the domain, go to the Users folder, right-click the user and go to Properties.
3. On the Profile tab, type the filename of the UNLS (probably user_notification.vbs) in the Logon script field.
4. Launch the Group Policy Management Console, then launch the Group Policy Object Editor ( Start > Run : gpedit.msc).
5. Copy the user_notification.vbs file that you downloaded in the first step to this location.

Active Directory Server Login Monitor Agent

First download and install the agent on the Active Directory server. and configure it so that it updates the NG Firewall server when it sees user login events.

Installation Guide

Download

Configure the NGFW Settings in Login Monitor so it updates your NG Firewall event when login events occur.

• Secret Key: The Secret Key if there is a Secret Key configured on the NGFW User Notification API. User Notification must be enabled on the NGFW. If no Secret Key is configured leave it blank.
• Prefix: The protocol to use to communicate with the NG Firewall.
• Port: The port to use to communicate with the NG Firewall. The default is port 80 for HTTP and 443 for HTTPS.
• IP Addresses: The IP addresses to reach your NG Firewall. Generally this should be the LAN addresses of your NG Firewall. By default HTTP and HTTPS is closed on the WAN side of NG Firewall. If the Login Monitor Agent cannot reach the NG Firewall, an error icon is shown next to the NG Firewall IP address entry.

  
  

The Exempt IP Addresses tab is a list of IP addresses which Login Monitor should ignore for login events. IP addresses are accepted in the following format:

• Single IP address (192.168.2.2)
• Wildcard IP address (192.168.3.*)
• CIDR (192.168.4.0/24)
• Range (192.168.5.5-192.168.5.102)

The Exempt Users tab is a list of AD users which Login show ignore for login events.

Active Directory

You can use the test tools to verify your settings and view an incomplete user list. After Active Directory is configured, you can configure Captive Portal to use it for authenticating users if you wish.

Azure Active Directory

You can use the Active Directory Connector to authenticate users against Azure Active Directory Domain Services. This type of connection requires that you have a Microsoft Azure account using Azure AD Domain Services. Before configuring NG Firewall to authenticate to your instance of Azure Active Directory, follow these steps:

1. Enable Azure Active Directory Domain Services
2. Generate an SSL certificate
3. Enable secure LDAP
4. Permit access to secure LDAP
5. Configure DNS for your AD domain

After you complete setting up Azure Active Directory, you can configure NG Firewall to authenticate via secure LDAP. The configuration of the connection is similar to a local Active Directory Domain except that you must enable the Azure checkbox. Confirm that the port is 636 and that Secure is enabled as Azure Active Directory requires secure LDAP.

RADIUS

The RADIUS Connector allows NG Firewall to communicate with a RADIUS server. This is useful for:

1. Allowing users to login to Captive Portal using their RADIUS login/password. The Captive Portal will verify the authentication information directly with the AD server.

The RADIUS tab contains settings to configure communication with the RADIUS server.

• RADIUS Server IP or Hostname: The IP or hostname of the RADIUS server - we recommend using the IP to prevent DNS issues.
• Port: The port to use when connecting to the RADIUS server. The default is 1812.
• Shared Secret: This must match the shared secret set on the RADIUS server.
• Authentication Method: This must match the authentication method used by the RADIUS server.

You can use the test tool to verify your settings. After RADIUS is configured, you can configure Captive Portal to use it for authenticating users if you wish.

Facebook

The Facebook Connector allows NG Firewall to authenticate against Facebook. This is experimental and is not suggested for deployments.

Reports

The Reports tab provides a view of all reports and events for all sessions handled by Directory Connector.

This applications reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report can be obtained on the Current Data window on the right.

Related Topics

Policy Manager

Captive Portal

About NG Firewall Reports

These reports can be viewed online through the administration interface or the separate reporting interface available to non-administrators reporting-only users.

Customizable report summaries can be sent via email, which includes basic information and a link to view the online reports if the user has access.

Reports can backup your data in multiple formats to Google Drive for long term storage.

Settings

This section reviews the different settings and configuration options available for Reports.

Status

You can click View Reports to open up Reports on this tab in a new browser tab.

All Reports

This is the full list of all currently existing reports. This includes all the default reports and any custom reports that have been added.

To edit a report, click on View and then click on Settings.

To delete a custom report, click on View and then click on Delete.

To create a new custom report, click View on an existing similar report, then click Settings. Then, change the name and click Save as New Report.

To create a report from scratch, go to Reports and click on Create New in the lower left. When creating reports from scratch, each field must be carefully chosen and tuned until the desired data is provided. This process can be time consuming and difficult. It is suggested to work with a similar report to require the desired result. Additionally, you can ask for help via support or the forums and import the report if someone can craft it for you.

If creating a report from scratch, the settings and fields and their purposes are described below.

Report Entry

Data

Email Templates

Additionally, you can copy the settings for an existing report.

The default Daily Reports template includes common text and chart reports for your system. This template is fixed and cannot be changed or modified.

Email Templates must be associated with Report Users.

Reports Users

Reports users are users that are not administrators, but can still view reports.

• Email Address is the email address (and username) of the report user. Admin is a special case that determines if administrators will receive emails and alerts.
• Email Alerts determines if this reports user will receive email alerts.
• Email Reports determines if this reports user will received email report summaries.
• Email Templates determines which email report summaries this user will receive if Email Reports is enabled.
• Online Access if enabled, a URL to online reports is included in emailed report summaries for this user.
• Change Password changes the password for this reports user.

Name Map

You can use the Name Map to manually configure the hostname for hosts. NG Firewall often can automatically determine the hostname for the IP automatically via DHCP or other methods. You can view the current names for currently active hosts in the Hosts.

However, when NG Firewall is unable to automatically determine a hostname for an IP the Name Map provides a way to manually name them.

Accessing Reports

If a user is set up to receive email report summaries, they only need to view or download the HTML attachment to see an overview report. If they need more information or would like to drill down to specific users or machines, they can use the link in the email, which will open Reports on the NG Firewall if it is accessible from their location.

Note that to view Reports from outside the network you'll need to check Allow HTTPS on WANs at Config > Network > Advanced > Filter Rules . If you have changed the External HTTPS Port, you'll need to use the proper HTTPS port when connecting from the outside.

Report Viewer

Reports provide a graphical view of the network traffic and actions of your NG Firewall. Various reports are available within applications and base system components. The reports can be manipulated to drill down, customize, and export data in many ways using the Report Viewer.

Conditions

The Conditions panel appears at the top panel and can be used to filter data displayed in reports. For example, to view a "specific" host's report, you can add a condition for Client = "192.168.1.100" and then all reports available will only show data where the client is 192.168.1.100. Multiple conditions can be added to drill down and inspect data. Conditions can also be added quickly by clicking on slices in pie charts.

Condition Operators

The second field in the condition is the logical operator that will be used in evaluating the condition value defined in the last field. In most use cases the default "=" operator is what you want to use. However, there are several other operators available that make the reports and alerts a whole lot more powerful.

Conditions Example - Policy by Policy ID

Conditions Example - Web Filter Categories

Related Topics

Custom Reports

About Policy Manager

Often, you will configure all of NG Firewall apps to service the whole network; however, often, it is necessary to handle traffic for some users or network devices differently. For example, you may want Web Filter to be different for students vs teachers, and you may want no Web Filtering at all for your servers. You may want to run Captive Portal only on the WiFi network or for unidentified devices. You may want to block certain applications with Application Control, but only at certain times of days.

Note that we will be using the example of a school a lot in this section as it is quite apt in showing how Policy Manager can help you with different user classes. This can be applied to any organization; just look for groups you can fit users into - Administrative Assistants, Marketing, or HR, you're free to choose. It can also apply to different sets of servers (i.e., a DMZ policy for handling public servers, an Internal policy for handling internal user machines, and a Wireless policy for handling wireless users), and it can also apply to different times of day (i.e., a Lunchtime and After Hours policy and a Work Hours policy). For simplicity the examples below will mostly use the school groups.

Getting Started with Policy Manager

Policies provide a way to handle different settings for different sessions. Using our example, an NG Firewall protecting a school might have three policies - Students, Teachers, and Administrators. These policies provide completely separate configurations for traffic processing; for example, you could allow teachers to access Facebook but not students.

NG Firewall will always have at least one policy, the Default Policy. You can rename but you cannot remove this policy. As mentioned before, you create Rules to send traffic to policies where it is processed by the applications. Policies are created from within Policy Manager, however you will use NG Firewall's web GUI to switch to and configure each policy. At the top of the web GUI, you will see Default Policy with an arrow next to it - clicking this arrow allows you to change the policy you're looking at, and access the Sessions Viewer and Hosts Viewer, and open the Policy Manager Settings directly.

Parent Policies

When you first create a new policy, it will not contain any applications. You can add in any applications you want and configure them to your liking, or you can use the Parent Policy system. When creating a new policy using Policy Manager, you have the option to select a Parent Policy. If you use this option your new policy will be pre-populated with all applications and settings from the Parent Policy you selected, however it will look a bit different.

When you view the new child policy, the application faceplates will be greyed out, and you will be unable to click Settings. This is because the settings for these applications are being inherited from the parent policy, which is useful because it saves you from having to reconfigure applications you want operating the same way in multiple policies, such as the virus scanners. To change the settings or view the Event Logs, you'll need to open the application on the parent policy and use the drop-down to select the policy to view traffic.

If you want to modify the settings of an application in a child policy, you'll need to install the application you want to modify in the child policy - I know, it's already there, but you can't click Settings to modify the configuration. On the Apps tab on the left side of the web GUI, just click Install again. After a few seconds, the app will re-appear, and you will be able to click settings. Once this has happened, the new child application overrides the application inherited from the parent. The settings of the parent policy for this application have no effect for the application you have added to the child policy. If you're following along, your child policy will contain all applications that your parent policy does. However, only one will have the Settings button enabled.

To recap, using our school example, we would send students to the Default Policy, then create a new Teacher Policy which uses the Default Policy as its Parent Policy. If you go to the Teacher Policy, all the apps will be greyed out, and you will not be able to modify any settings because they are copied from the Default Policy. By adding in a new copy of Web Filter, you can modify the settings so the teachers can access websites the students cannot; however, settings for all other applications will still be copied from the Default Policy.

Settings

This section reviews the different settings and configuration options available for Policy Manager.

Status

This displays the current status and some statistics.

Policies

From this tab you can create new policies; however,note you'll first need to create and save a policy before you can create a rule to apply traffic to that policy.

Rules

If you've been reading up until this point, you may have guessed that this new policy will do nothing until you send traffic to it. To accomplish this, you'll need to create a rule - click Add in the Rules tab.

When each new session is processed, the rules are evaluated in order. If all of a sessions attributes match all of the criteria of a rule, it is considered a match. The policy for the first matching rule will be used to process the session. If no rules match, the Default Policy willprocess the session.

These rules operate as described in the Rules documentation.

Like many areas of NG Firewall, the rules work from the top down. Let's go back to our school example and say we have three policies: Default (for students), Teacher, and Administrative Staff. To get traffic to these policies, we would need to create two policies: one for the Teacher policy and one for the Administrative Staff policy - any traffic that did not match those two policies would be sent to the Default Policy. You can also explicitly add a rule sending traffic to the Default Policy, although it's not required.

If the policy rule for the Teacher policy is incorrect, it may end up matching all network traffic and sending it to the Teacher policy. Because it matches, the rule under it (for the Administrative Policy) will never be evaluated. On the flip side, if a rule is too narrow, it may not match the traffic you're trying to match at all, dumping it on the Default Policy. Because of this, we recommend starting out policy rules as very general (e.g., match a few IPs or an entire subnet) and then tightening them down from there - let's look at some common example policies:

File:Policy rules.png Quick look at the rules table

So this is the Rules tab of the Policy Manager settings. On this page you will be able to see all of the rules that will be evaluated when determining which policy to direct a specific user or IP address. Pay attention to the 'Target Policy' column. Any users defined in the corresponding rule will be directed to that policy. Click on the page icon under the 'edit' column to define the rule.

File:Policy rules2.png Click Edit and define the rule.

Once you've clicked the edit button, this is where you'll end up. This is where you will define which users will be assigned to which policy. You can specify a user using any one or combination of the identifiers in the drop down box. Any users that match the specified identifiers will be directed to the policy specified in the Target Policy field.

Reports

The Reports tab provides a view of all reports and events for all traffic handled by Policy Manager.

This applications reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report can be obtained on the Current Data window on the right.