ZyXEL Communications ZYWALL OTPV2

ZyWALL OTPv2

Support Notes

Revision 1.10

December, 2010

Written by CSO

ZyXEL –ZyWALL OTPv2 Support Notes

Table of Contents

1. Introduction....................................................................................................................................................... 3

2. Server Installation............................................................................................................................................. 7

2.1 Pre-requisites.......................................................................................................................................... 7

2.2 Installation on Windows Server 2003 Enterprise Service Pack 1 ...................................................... 7

2.3 Installation on Windows Server 2008 R2........................................................................................... 23

3. OTP Authentication to an OTP-protected Network via SSL VPN over ZyWALL USG................................. 42

3.1 ZyWALL USG Configuration ................................................................................................................. 43

3.2 SafeWord Server Configuration ........................................................................................................... 46

3.3 Verify OTP via Login from the Remote PC .......................................................................................... 50

4. OTP Authentication to an OTP-protected Network via IPSec VPN Client over the ZyWALL USG ............ 51

4.1 ZyWALL USG Configuration ................................................................................................................. 52

4.2 SafeWord Server Configurations ......................................................................................................... 55

4.3 ZyWALL IPSec VPN Client Configuration ............................................................................................ 59

4.4 Verify OTP via Login from the VPN Client........................................................................................... 61

5. OTP Troubleshooting...................................................................................................................................... 63

ZyXEL –ZyWALL OTPv2 Support Notes

1. Introduction

One-Time Password (OTP) Authentication

One-Time Password (OTP) is an optimum security technology that enables a server to authenticate you

based on a password that is unique every time you try to access a protected network.

Two-Factor Authentication

Two-factor authentication is an optimum security methodology, because it requires something you have

(your ZyWALL OTP Token) and something you know (your secure password or PIN). A two-factor system

is far more secure than using just a password, since many skilled hackers can quite easily access

password-only protected computers and networks. The illustration shows the concept of Two-Factor

authentication.

User PIN and Token code

User PIN is what you know and Token code is what you have.

ZyXEL –ZyWALL OTPv2 Support Notes

ZyWALL OTP Products Components

ZyWALL OTP, which includes the ZyWALL OTP Token and SafeWord 2008, provides secure verification of

identity to remote Virtual Private Network (VPN) and Local Area Network (LAN) users.

SafeWord 2008 installation includes:

-SafeWord Core Server

Database server

Administration server

Authentication engine

-Management console (integrated in Windows Server AD)

-RADIUS Agents (IAS clients)

SafeWord Core Server

The SafeWord Core Server consists of 3 main components:

-Database server (MySQL) –installed by default. The SafeWord database serves as the repository for

token records independent of the management mode. It stores the Token serial numbers and Token

seed used to generate OTP. The database server listens on port 5010 by default and only the

Administration service and Authentication engines can query it directly.

ZyXEL –ZyWALL OTPv2 Support Notes

-Administration server –runs administration services and performs tasks initiated by administrators

or users. Updates the SafeWord database and synchronizes SafeWord database data in configurations

with MMC console and User Center. Also performs replication of changes between peers. It is listening

on port 5040 by default.

-Authentication engine (AAA) –runs the authentication engine that verifies that the passcode supplied

with an access request is correct for the token assigned to a specific user. It listens on port 5031 by

default.

Management Console (AD)

The Management console integrated in Microsoft AD is the interface used to directly update the database

via the SafeWord Administration Service.

You can use this to import Tokens (add Token serial numbers to SafeWord database) or backup and

restore Token data.

It also lets you view and manage all imported Tokens.

ZyXEL –ZyWALL OTPv2 Support Notes

RADIUS Agent

The OTP RADIUS agent contains a configuration file specifying where the SafeWord server holds the user

repository and the Authentication service. It verifies that the passcode supplied with an access request is

correct for the token assigned to a specific user.

An agent can be installed only if it is supporting (base) software components exist. Otherwise the agent

will not appear for selection in the installation components window. For example, the RADIUS server

agent can only be installed when the IAS has already been set up.

ZyXEL –ZyWALL OTPv2 Support Notes

2. Server Installation

2.1 Pre-requisites

Before starting to install the SafeWord server, user needs to verify:

-Hardware requirements of the system

CPU –Pentium IV or AMD @ 1.8 GHz (min), 2 GHz (recommended)

RAM –1 GB (min), 4 GB (recommended)

Disk space –3 to 5 GB (min)

-Software requirements of the system

Server OS –32 or 64-bit Windows Server 2003/2008 or Windows Server 2008 R2

Have a working Active Directory environment

Have IAS server installed for RADIUS authentication

2.2 Installation on Windows Server 2003 Enterprise Service Pack 1

Step1. Prepare the Active Directory

-Click on Start > Manage Your Server to open the installation wizard. Click “Add or remove a role”to

configure it.

ZyXEL –ZyWALL OTPv2 Support Notes

-Select to install the Domain Controller (Active Directory).

-Fill in the full DNS name for the new domain.

-Click Next to continue the installation process. When the process is done, Active Directory will be

installed and ready.

ZyXEL –ZyWALL OTPv2 Support Notes

Step2. Prepare the IAS Server

-Click Start > Control Panel > Add or Remove Programs > Windows Components Wizard > Networking

Services > Internet Authentication Service to install the component.

-After the installation, you can execute it through Start > Administrative Tools > IAS.

ZyXEL –ZyWALL OTPv2 Support Notes

Step3. Check pre-requisites before Install

Network prerequisites:

-32 or 64-bit Windows Server 2003 with Service Pack 1.

Note: Windows 2008 Core is not supported. Windows 2003/2008 Small Business Server is not supported.

-Active Directory populated with users.

Note: A Domain Controller is required for use with Active Directory.

-Internet access (to receive important product updates not on your installation CD)

Component prerequisites:

-Active Directory Users and Computers Management Console

.Net Framework 2.0 or greater installed

This component is only available when the installation machine is part of a domain

MMC 3.0 or greater installed (for Server 2003, user can download it from http://support.microsoft.com/kb/907265)

Note: Port 5040 must be open between the remote ADUC server and the server running the Admin Service. You may customize

this port.

-IAS/NPS Agent

IAS must be functioning and configured for RADIUS authentication (policies, secret keys, firewall ports, and user

permissions must be set correctly, and users must be able to successfully authenticate to IAS) before installing this

Agent.

Port 1812 must be open in any firewalls between the RADIUS clients and the IAS Server.

Step4. Install SafeWord 2008 server

In this section, we will walk through the system installation process. For the up to date user manuals,

please check SafeNet’s website. The link is: http://www.aladdin.com/safeword/docs/2008.aspx

Below is a flow chart-type snapshot of the installation process and the step-by-step installation. Users

can check for more detailed information in chapter 2 “Installing and Activating SafeWord 2008”of

SafeWord 2008 Administration Guide on the SafeNet website.

Altri manuali per ZYWALL OTPV2 -

Indice

Altri manuali ZyXEL Communications Firewall

ZyXEL Communications

ZyXEL Communications ZyWALL SSL 10 Manuale

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manuale

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL USG-1000 Manuale utente

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 35 Manuale utente

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Guida di riferimento

ZyXEL Communications

ZyXEL Communications ZyXEL Prestige 310 Manuale utente

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manuale

ZyXEL Communications

ZyXEL Communications ZyWall Manuale utente

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manuale utente

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Manuale di istruzioni

ZyXEL Communications

ZyXEL Communications ZyWALL 110 Series Manuale utente

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manuale di istruzioni

ZyXEL Communications

ZyXEL Communications ZyWall Manuale utente

ZyXEL Communications

ZyXEL Communications ZyWall Manuale utente

ZyXEL Communications

ZyXEL Communications ZyWALL 1100 Series Manuale utente

ZyXEL Communications

ZyXEL Communications USG40 Manuale utente

ZyXEL Communications

ZyXEL Communications ENTERPRISE NETWORK CENTER Manuale utente

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 35 Manuale

ZyXEL Communications

ZyXEL Communications ZYWALL 2 WG Manuale utente

ZyXEL Communications

ZyXEL Communications ZyWall Istruzioni operative

ZyXEL Communications

ZyXEL Communications USG Series Manuale utente

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 5 Manuale

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Manuale utente

ZyXEL Communications

ZyXEL Communications ZyWALL 110 Series Manuale utente

Manuali Firewall popolari di altre marche

Cisco

Cisco S190 Manuale utente

Fortinet

Fortinet FortiGate Voice Series Manuale utente

ADTRAN

ADTRAN NetVanta 2300 Manuale utente

SecureLogix

SecureLogix ETM System Manuale utente

NETGEAR

NETGEAR ProSafe FVX538 Manuale utente

Lanner

Lanner FW-8877 Manuale utente

Huawei

Huawei USG6000 Series Manuale di installazione e funzionamento

H3C

H3C SecPath F5000-AI-15 Manuale utente

Nexcom

Nexcom DNA 1150 Manuale utente

Fortinet

Fortinet FortiGate-60 series Manuale utente

Cisco

Cisco 3110 Manuale

Draytek

Draytek Vigor2860 Series Manuale utente

Lanner electronics

Lanner electronics FW-7650 Series Manuale utente

Swisscom

Swisscom Internet Backup Manuale utente

SonicWALL

SonicWALL NSa 5700 Manuale utente

DPtech

DPtech FW1000 SERIES Manuale utente

FEITIAN

FEITIAN MultiPass FIDO Manuale utente

EBLOCKER

EBLOCKER PRO Manuale utente

ZyXEL Communications ZYWALL OTPV2 - Manuale

Manuali Firewall popolari di altre marche