How to Configure Offline Firewall Authentication

Offline firewall authentication works with all Barracuda NG Firewall services. The user is authenticated by the the fwauth daemon. To implement offline firewall authentication, configure your firewall authentication settings and create an App Redirect firewall rule with the destination set to a internal firewall IP to let users access the fwauth service. The user can then use the Barracuda Authentication Client or the browser log in. The fwauth service listens on 127.0.0.1. Depending on the type of authentication required use the following ports:

• TCP 80 – Username/password authentication. (HTTP only) Use for external authentication servers (e.g., MSAD).
• TCP 443 – Username/password (HTTPS). Use for external authentication servers (e.g., MSAD).
• TCP 448 – Username/password (HTTP and HTTPS) with automatic redirection. Use for external authentication servers (e.g., MSAD).
• TCP 444 – X.509 certificate authentication. (HTTP and HTTPS)
• TCP 445 – X.509 certificate plus username/password authentication. (HTTP and HTTPS)

In this article:

Step 1. Configure the Firewall Authentication Settings

Set the HTTPS private key and certificate to activate firewall authentication.

1. Open the Forwarding Settings page (Configuration > Configuration Tree > Box > Virtual Servers > your virtual server > Assigned Services > Firewall).
2. In the left menu, click on Authentication.
3. Click Lock.
4. (optional) Edit the Operational Settings.
5. Upload or create the HTTPS Private Key and Certificate.
6. Select the Authentication Scheme from the list. E.g., MS Active Directory. For more information, see Authentication.
   
7. Click Send Changes and Activate.

Step 2. Create Access Rules for Offline Authentication

To let users go directly to the firewall login page, to log out or log in, set the Destination IP to a internal firewall IP (not the management IP).

1. Open the Forwarding Rules page (Config > Box > Virtual Servers >  your virtual server > Assigned Services > Firewall).
2. Click Lock.
3. Create an App Redirect firewall for HTTP Traffic:
   
   • Source – Select Trusted Networks or enter the internal network for the clients who need to authenticate.
   • Service – Select HTTP.
   • Destination – Enter an Internal IP used by the firewall service. Do not use the management IP.
   • Redirection – Enter 127.0.0.1:. Enter the port of the authentication method supporting HTTP: 80, 444,445,448 - see list on the top of the page. 
   • Authenticated User – Select Any.
     
4. (optional) Create an App Redirect firewall for HTTPS Traffic:
   
   • Source – Select Trusted Networks or enter the internal network for the clients who need to authenticate.
   • Service – Select HTTPS.
   • Destination – Enter an Internal IP used by the firewall service. Do not use the management IP.
   • Redirection – Enter 127.0.0.1:. Enter the port of the authentication method supporting HTTP: 443, 444, 445, 448 - see list on the top of the page.
   • Authenticated User – Select Any.
   
5. Move the redirect rules above the INTERNET-2-LAN rule.
6. Click Send Changes and Activate.

Step 3. Authenticate to the Barracuda NG Firewall

After implementing offline authentication, you can use it to log into the Barracuda NG Firewall.

1. Go to http://
2. On the login screen, enter your user credentials.

After you are successfully authenticated, you receive the following message: