Hi All,
I have a lot of Nokia firewalls running from IPSO 3.7.1 to IPSO 4.1. Currently,
I have about 60 Firewall Administrators and they log into the Nokia appliances
via ssh or voyager with the "admin" account.
I would like to use TACACS authentication for the Nokia IP appliances so that
each firewall administrators will use his/her own account on the TACACS+ server.
I followed Nokia resolution 1410275 but according to this resolution, I have to
manually create 60 different accounts on the Nokia for my Firewalls
Administrators. Furthermore, the resolution does not say anything about AAA
Accounting. This is not scalable in my environment.
For those who are working in the Managed Security Service provider environment,
how do you handle the authentication piece on the Nokia appliances and
make it scalable?
Thanks.
cisco4ng
Published:
February 27, 2006
Updated:
May 11, 2006
Solution:
1. Open Voyager -> Config -> Under Security and Access Configuration
select AAA.
2. Create a New Auth. Profile to use for Voyager access. In the example
below,
TACPLUS_httpd_authprofile
Type: TACPLUS
Control: nokia-server-auth-sufficient
3. Click Apply.
4. Select Servers beside TACPLUS_httpd_authprofile
5. Enter the Priority, Host Address, Port #, Secret for the TACACS+ Server
then click Apply.
Select UP to go back to AAA Configuration page.
6. Create a New Auth. Profile to use for SSH access. In the example below:
UACPLUS_sshd_authprofile
Type: TACPLUS
Control: nokia-server-auth-sufficient
7. Click Apply.
8. Select Servers beside TACPLUS_sshd_authprofile
9. Enter the Priority, Host Address, Port #, Secret for the TACACS+ Server
then click Apply.
10. Select UP to go back to AAA Configuration page.
11. Create a New Service Profile for SSH access. In the example below:
Service Profile: TACPLUS_prof_sshd
Auth. Profile: TACPLUS_sshd_authprofile
Acct. Profile: base_sshd_acctprofile
Session Profile: base_sshd_sessprofile
12. Click Apply.
13. Create a New Service Profile for SSH access. In the example below:
Service Profile: TACPLUS_prof_sshd
Auth. Profile: base_sshd_authprofile
Acct. Profile: --- Leave Blank ---
Session Profile: --- Leave Blank ---
NOTE: This service profile adds the base_sshd_authprofile Auth. Profile
to use the backup authentication method of using Nokia IPSO user passwords.
14. Click Apply.
15. Create a New Service Profile for Voyager Access. In the example below:
Service Profile: TACPLUS_prof_httpd
Auth. Profile: TACPLUS_httpd_authprofile
Acct. Profile: base_httpd_acctprofile
Session Profile: base_httpd_sessprofile
16. Click Apply.
17. Create a New Service Profile for Voyager access. In the example below:
Service Profile: TACPLUS_prof_httpd
Auth. Profile: base_httpd_authprofile
Acct. Profile: --- Leave Blank ---
Session Profile: --- Leave Blank ---
NOTE: This service profile adds the base_httpd_authprofile Auth.
Profile to use the backup authentication method of using Nokia IPSO user
passwords.
18. Click Apply.
19. Change the Service Module Configuration for httpd and sshd services.
Service: httpd Profile: TACPLUS_prof_httpd
Service: sshd Profile: TACPLUS_prof_sshd
NOTE: Default is base_prof_httpd and base_prof_sshd respectively.
20. Click Apply. Click Save.
21. You will need to create the administrative user accounts locally in
order to authenticate them from TACACS+ (AAA). If an account does not exist
locally, it will not authenticate as an external user either.
When creating the new User account in Voyager -> Config -> Users; you may
leave the password fields NULL to force authentication from TACACS+ (AAA). In
this configuration, the password will be accepted from TACACS+ (AAA) or
locally. (Required for backup authentication purposes). Null passwords are not
able to authenticate with Voyager or SSH, thus forcing the use of TACACS+ (AAA)
for authentication. admin will have a local password and can be used for
backup purposes. (Both the local password or AAA password will be accepted for
user admin).
---------------------------------
Food fight? Enjoy some healthy debate
in the Yahoo! Answers Food & Drink Q&A.
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
