How to Configure NGF Local Authentication

Configure NGF local authentication to locally administer users and groups on the Barracuda CloudGen Firewall. With NGF local authentication, you can refer to local users and groups when creating firewall rules, VPN tunnels, and services.

Configure the Firewall Authentication Settings

Set the HTTPS private key and certificate to activate firewall authentication.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > Firewall > Forwarding Settings.
2. In the left menu, click Authentication.
3. Click Lock.
4. (optional) Edit the Operational Settings.
5. Upload or create the HTTPS Private Key and Certificate.
6. Select the Authentication Scheme from the list, e.g., NGF Local. For more information, see Authentication.
7. Click Send Changes and Activate.

Configure NGF Local Authentication 

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Authentication Service.
2. In the left navigation pane, select NGF Local Authentication.
3. Click Lock.
4. Enable NGF Local Scheme as authentication scheme.
5. In the Users table, add an entry for each user that you are administrating with the local authentication scheme. For each entry, you can configure the following settings:
   • Username – Authentication name of the user.
   • Password – Initial user password.
   • Mail address – Email address for the user.
6. If group information is queried from a different authentication scheme, select the scheme from the User Info Helper Scheme list. For example, select LDAP if group information must be queried from an LDAP directory.

7. Click Send Changes and Activate.

Changing User Passwords

When using NGF local authentication, you can also provide users the option of managing and changing their passwords. This is done by creating an access rule to redirect HTTP/S requests (port 80/443) to the local web server of the system.

Create an App Redirect firewall rule with the following settings:

• Action – App Redirect
• Source – Trusted LAN (LAN network users)
• Service – HTTP+S
• Destination – Choose a custom IP address to be entered by the user to access the web interface. For example: 1.1.1.1
• Redirection – IP address of the local web server, together with the HTTP/S port. For example: 127.0.0.1:80

After you create and activate this firewall rule, users can enter http://1.1.1.1/cgi-bin/ngflocalpasswd into a web browser to change their password.