Firebox SSL VPN Gateway Administration Guide - WatchGuard ...

More documents

Recommendations

Info

Administering the Firebox SSLIf that command results in the following error message, the fileis not in PEM format.certFile: unable to load certificate file4840:error:0906D064:PEM routines:PEM_read_bio:bad base64 decode:pem_lib.c:781:To convert the certificate from PKCS7 to PEMformat1 Run the command:openssl pkcs7 -in ./certFile -print_certsThe output will look like this:subject=......-----BEGIN CERTIFICATE-----... Server Certificate ...-----END CERTIFICATE-----subject=......-----BEGIN CERTIFICATE-----... Intermediate Cert ...-----END CERTIFICATE-----2 Combine the server certificate data and the intermediatecertificate data (if it exists) from the output with the privatekey as specified in “Combining the Private Key with theSigned Certificate” on page 36 and “Generating TrustedCertificates for Multiple Levels” on page 37.Combining the Private Key with the SignedCertificateYou must combine the signed certificate with the private keybefore you can upload it to the Firebox SSL.36 Firebox SSL VPN Gateway Administration Guide
Unencrypting the Private KeyTo combine the Private Key with the SignedCertificate:1 Use a text editor to combine the unencrypted private keywith the signed certificate in the PEM file format.The file contents should look similar to the following:-----BEGIN RSA PRIVATE KEY----------END RSA Private KEY----------BEGIN CERTIFICATE----------END CERTIFICATE-----2 Save and name the PEM file. For example,AccessGateway.pem.Generating Trusted Certificates for Multiple LevelsNOTEAny certificate that has more than one level must include allintermediate certificates, or the system may becomeunusable.You must determine whether your certificate has more than onelevel and, if it does, handle the intermediate certificates properly.To generate trusted certificates for multiple levels:1 Open Internet Explorer, and access a page through theFirebox SSL. For example, enter a URL similar to thefollowing:https://ipAddress:httpPort//www.mypage.comwhere:- ipAddress is the IP address of your Firebox SSL- httpPort is the Firebox SSL HTTP port number2 Double-click the Lock symbol in the bottom right corner ofthe browser.Firebox SSL VPN Gateway Administration Guide 37
Page 1 and 2: WatchGuard ® Firebox SSL VPNGatewa
Page 5 and 6: Using the Telnet 3270 Emulator Clie
Page 7 and 8: CHAPTER 1Firebox SSL OverviewThe Wa
Page 9 and 10: OverviewAs shown in the following i
Page 11 and 12: OverviewEase of use anddeploymentEa
Page 13 and 14: OverviewNOTEThe portal page is cust
Page 15 and 16: Firebox SSL Operationthe packets an
Page 17 and 18: Firebox SSL OperationTarget servers
Page 19 and 20: Kiosk Operationthe second tunnel’
Page 21 and 22: Kiosk OperationSSH, Telnet 3270 emu
Page 23 and 24: CHAPTER 2Administering theFirebox S
Page 25 and 26: Using the Firebox SSL Remote Admin
Page 27 and 28: Using the Administration Toolpreced
Page 29 and 30: Using the Serial ConsoleUsing the S
Page 31 and 32: Supporting Secure Access UsersWhen
Page 33 and 34: Supporting Secure Access Users•
Page 35 and 36: Generating a Secure Certificate for
Page 41: Unencrypting the Private KeyTo unen
Page 45 and 46: Blocking External Access to the Adm
Page 47 and 48: Viewing and Changing the System Dat
Page 49 and 50: Saving and Restoring the Configurat
Page 51 and 52: Managing VPN ConnectionsTo save the
Page 53 and 54: Managing VPN Connectionstion to the
Page 55 and 56: Restarting the Firebox SSLThe user
Page 57 and 58: CHAPTER 3Working with a VPNConnecti
Page 59 and 60: Using the Access PortalIf you conne
Page 61 and 62: Using the Access PortalNOTEThe Linu
Page 63 and 64: Connecting from a Private ComputerN
Page 65 and 66: Connecting from a Private ComputerI
Page 67 and 68: Connecting from a Public Computer (
Page 77 and 78: CHAPTER 4Configuring FireboxSSL Net
Page 79 and 80: Configuring Network InterfacesFor m
Page 81 and 82: Configuring RoutesBy default, the F
Page 83 and 84: Configuring Routes5 Click Submit.Dy
Page 85 and 86: Configuring RoutesFigure 4: Buildin
Page 87 and 88: CHAPTER 5Configuring FireboxSSL Ope
Page 89 and 90: Configuring Authentication, Authori
Page 91 and 92: Using a Local User List for Authent
Page 93 and 94:
Using a Local User List for Authent
Page 95 and 96:
Using RADIUS Servers for Authentica
Page 97 and 98:
Using LDAP Servers for Authenticati
Page 99 and 100:
Using LDAP Servers for Authenticati
Page 101 and 102:
Using RSA SecurID for Authenticatio
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Adding Local UsersTo create a user
Page 109 and 110:
Controlling Network AccessBy defaul
Page 111 and 112:
Controlling Network Access10.10.0.0
Page 113 and 114:
Controlling Network AccessDenying A
Page 115 and 116:
Customizing VPN Portal PagesThe oth
Page 117 and 118:
Customizing VPN Portal Pagesappropr
Page 119 and 120:
Customizing VPN Portal PagesAn imag
Page 121 and 122:
Customizing VPN Portal Pages2 Clear
Page 123 and 124:
Configuring Host Check Rules2 Speci
Page 125 and 126:
Configuring Network Shares for Kios
Page 127 and 128:
Adding and Configuring User GroupsN
Page 129 and 130:
Adding and Configuring User Groups3
Page 131 and 132:
Adding and Configuring User Groupst
Page 133 and 134:
Adding and Configuring User GroupsT
Page 135 and 136:
Adding and Configuring User GroupsV
Page 137 and 138:
Adding and Configuring User GroupsE
Page 139 and 140:
Adding and Configuring User Groupsp
Page 141 and 142:
Enabling Split DNSTo enable split t
Page 143 and 144:
Configuring Internal Failover2 Ente
Page 145 and 146:
Forcing VPN User Re-login2 Under Fo
Page 147 and 148:
Configuring Secure Access for Singl
Page 149 and 150:
APPENDIX ALogging, Monitoring,and T
Page 151 and 152:
Viewing and Downloading System Mess
Page 153 and 154:
Enabling and Viewing SNMP Logs2 Ent
Page 155 and 156:
Viewing System StatisticsViewing Sy
Page 157 and 158:
Monitoring Firebox SSL OperationsFi
Page 159 and 160:
Recovering from a Crash of the Fire
Page 161 and 162:
TroubleshootingThe Firebox SSL does
Page 163 and 164:
APPENDIX BLegal and CopyrightInform
Page 165 and 166:
it clear that any patent must be li
Page 167 and 168:
works. But when you distribute the
Page 169 and 170:
6. Each time you redistribute the P
Page 171 and 172:
11. BECAUSE THE PROGRAM IS LICENSED
Page 173 and 174:
This is free software, and you are
Page 175 and 176:
IndexAaccess control, see ACL and u
Page 177 and 178:
EEthereal Network Analyzer 151Ether
Page 179 and 180:
networks accessible to Gateway 103d
Page 181 and 182:
TTelnet 3270 Emulator client 67enab
show all

Firebox SSL VPN Gateway Administration Guide - WatchGuard ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?