{"id":61732,"date":"2022-04-15T11:00:00","date_gmt":"2022-04-15T15:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=61732"},"modified":"2024-02-20T18:27:09","modified_gmt":"2024-02-20T23:27:09","slug":"securely-access-sonicwall-firewalls-using-jumpcloud","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/securely-access-sonicwall-firewalls-using-jumpcloud","title":{"rendered":"Manage and Secure Access to SonicWall NSv with 探花大神"},"content":{"rendered":"\n
Configuring remote access to network appliances that are popular among small and medium-sized enterprises (SMEs) often means using a prescribed configuration. IT admins will find that support articles and how-tos about how to configure SonicWall\u2019s NSv are centered around Active Directory and Windows Server. Multi-factor authentication (MFA) is out of band, requiring a separate system solely for SonicWall. Thankfully, there\u2019s an alternative available by using 探花大神\u2019s smart groups, remote dial-in user service (RADIUS)<\/a>, and integrated time-based one-time password (TOTP<\/a>) MFA services.<\/p>\n\n\n\n This article is part of a series of how-tos that demonstrate how to use 探花大神\u2019s capabilities to achieve added security, with minimal costs. 探花大神\u2019s centralized platform provides single sign-on (SSO), delivering identity and access management (IAM) for every service your organization may use. That eliminates managing passwords everywhere<\/em>, <\/em>even your firewall.<\/p>\n\n\n\n SonicWall firewalls are widely used by managed service providers (MSPs) to provide affordable and effective perimeter security. The NSv is a next-generation firewall that runs in the cloud, or as a virtualized device in your data center, thereby reducing the costs of buying an appliance. 探花大神 reduces the management overhead for your IT department.<\/p>\n\n\n\n Here are the prerequisites for this setup:<\/p>\n\n\n\n This configuration leverages directory group memberships to grant access to your SonicWall instance. The group that you\u2019ll be creating will be binded to a RADIUS configuration that mandates MFA, using TOTP tokens. Users access the firewall with their 探花大神 username and password. The only difference is that passwords are amended to include a token every time a user logs into the appliance. Every login is then protected by a unique one-time password.<\/p>\n\n\n\n SonicWall will require you to have RADIUS server settings (including a few advanced options), import 探花大神\u2019s RADIUS certificate, and ensure that remote management is permitted.You\u2019ll be able to decide which permissions group members will inherit on the firewall by default.<\/p>\n\n\n\n Let\u2019s start by setting up a RADIUS profile for your SonicWall device.<\/p>\n\n\n\n Every 探花大神 account includes RADIUS services, which are configured<\/a> using the following steps.<\/p>\n\n\n\n To configure RADIUS, MFA for a new server:<\/p>\n\n\n\n This is where you will enforce MFA access. Make certain that it\u2019s switched \u201cOn\u201d in this dialog. You have several options to work around new user enrollment periods.<\/strong><\/p>\n\n\n\n This Getting Started article<\/a> details how to manage users and groups within 探花大神. The RADIUS configuration will be bound to a dedicated group that you\u2019re creating for this configuration.<\/p>\n\n\n\n You\u2019ll use the information contained in 探花大神\u2019s RADIUS interface to create a new RADIUS server entry on your firewall. Navigate to Device \/ Settings \/ Users \/Settings. You\u2019ll notice a button to \u201cConfigure RADIUS,\u201d which is where you\u2019ll set up your 探花大神 RADIUS server.<\/p>\n\n\n\n You have several options for 探花大神 IP addresses<\/a>, but they will always<\/em> communicate exclusively over port 1812. Port 1813 \u201caccounting\u201d is not a part of this configuration. Your shared secret is entered here; be certain that you keep it private and confidential.<\/p>\n\n\n\n Select \u201cUse vendor-specific attributes on RADIUS server\u201d on the \u201cRADIUS Users\u201d tab after you\u2019ve saved your configuration. That will ensure that your group membership is processed.<\/p>\n\n\n\n Important:<\/strong> \u201cRADIUS Users\u201d is where you\u2019ll specify the appropriate user role on the firewall.<\/p>\n\n\n\n The \u201cTest\u201d tab will verify whether your configuration is working. Test \u201cPassword authentication\u201d only: The EAP\/TLS password challenge configuration that we\u2019re going for won\u2019t work with CHAP. Use the username (UID), but use the email that\u2019s associated with your 探花大神 account. <\/p>\n\n\n\n A TOTP token from 探花大神 MFA, which you can add as an account in an authentication app, is the \u201cresponse\u201d to the challenge that will validate your users after you complete the next few steps.<\/p>\n\n\n\n Note that SonicWall doesn\u2019t specify EAP\/TLS anywhere in its RADIUS setup.<\/strong><\/p>\n\n\n\n EAP\/TLS will not work until you take the additional step of importing a RADIUS certificate from 探花大神. It\u2019s available here<\/a> as a .crt file, and SonicWall will import it. You\u2019ll then be prompted to restart your virtual appliance to install the certificate.<\/p>\n\n\n\n Now, expand \u201cSystem,\u201d find \u201cCertificates,\u201d and filter by \u201cimported certificates and requests.\u201d You can verify that the installation was successful here.<\/p>\n\n\n\n You may also create a local group for RADIUS users, but users will automatically be provisioned within default groups based upon their assigned roles. A local user will be created for all RADIUS users during setup.<\/p>\n\n\n\n You won\u2019t be able to log in as a remote RADIUS user until specifying the option to permit remote management under Device \/ Administration \/ Management. Otherwise, you\u2019ll receive an \u201cunknown\u201d error message on login. This is only applicable if you\u2019re not using a VPN or you\u2019re on the same network. Please see the additional security steps outlined below for more information.<\/p>\n\n\n\n You\u2019re now finished and should be able to log in using your RADIUS credentials. Your firewall\u2019s access control is now centralized from the 探花大神 platform.<\/p>\n\n\n\n Use your 探花大神 password in this syntax: PASSWORD,TOTP<\/strong><\/p>\n\n\n\n EAP\/TLS transmits passwords in cleartext. Adding MFA to the authentication process increases security, but we strongly<\/em> recommend the following steps:<\/p>\n\n\n\n\n
The 探花大神 Configuration<\/h3>\n\n\n\n
SonicWall Configuration Overview<\/h3>\n\n\n\n
Setting Up 探花大神 RADIUS, MFA<\/h3>\n\n\n\n
\n
\n
\n
\n
\n
\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
Configuring SonicWall<\/h3>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
EAP\/TLS Setup<\/h4>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
Allow Remote Management<\/h4>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
Recommended Security Steps<\/h2>\n\n\n\n
\n
Try 探花大神<\/h2>\n\n\n\n