How to Configure the Access Control Service

On a Barracuda Firewall Control Center, this parameter allows referencing to global trustzone objects. An empty value indicates that the local trustzone configuration (for example, only this Access Control Service should use the configured trustzone) should be used. For more information, see Configuring Access Control Service Trustzones.

Start System Health-Validator

Healthy (min.)

This value restricts validity time of authentication. If the client does not re-evaluate its health state within that period, all assigned network access rights will be dropped.

Probation/Limited Access (min.)

This value defines the probation interval of a health validation. If a client does not satisfy the health requirements in an initial health validation step, the client will be set into probation. It will get the special network access right probation, additionally to the rights as it was healthy. If the client doesn’t become healthy within the probation time it will be set to health state “unhealthy” automatically after the probation time was elapsed.

User Authentication Required

If this option is set to no, the client will not re-evaluate its health state when a user logs on. For example, no current user health evaluation will take place.

Authentication Scheme

Fallback Authentication Scheme

This option is only available if Authentication Scheme was set to MSCHAP. In this case, this scheme is used for authentication if the MS-CHAP authentication fails. The client will display a pop-up requesting username and password.

If set to yes, a local machine authentication requires a certificate for a successful local machine authentication.

Search String for Box Certificates

Either a X.509 issuer string or a X.509 subject string (e.g. C=AT, O=Barracuda, OU=*,CN=*). Pattern matching is allowed.

This section provides configuration settings for certificate revocation. Certificate revocation can be done by using either CRL (LDAP) or OCSP. Click Set/Edit to configure the settings.

This defines where the remediation server can be reached. Select This, if the remediation server is running on the same system as the Access Control Server. In this case, Start Remediation Server must be set to yes.
Select Other in case it is running on a different system, and specify the remediation server IP addresses in the fields below.

IP address(es) of the remediation servers accessible by clients within the secure network.

IP address(es) of the remediation servers accessible by clients within the restricted network.

The IP address(es) for the Access Control Service remediation service module for VPN clients.

Using a Barracuda Firewall Control Center, multiple Access Control Services can reference to the same trustzone. Already validated clients can be propagated to all Access Control Services sharing the same trustzone configuration. This also affects gateway firewall authentication. This parameter is only available on a CC.

Start Remediation Service

Setting this to yes will allow unencrypted downloads from the remediation server. This will increase download velocity, however, it will also decrease the security because Personal Firewall rule sets are transmitted unencrypted over the network.

Add all foreign health passport verification keys here of which health passports should be trusted for this border trustzone. The health state of clients with a signed and trusted health passport is revalidated for this trustzone, however, their authentication credentials are accepted from the signed cookie.

Number of used worker threads for health validation and remediation. The default value is 5.
This should meet the requirements in most cases. Increasing this value leads to a more reactive server, but also increases the load on the system.

Maximum number of access cache entries to keep.

By enabling this, the access cache entries of this Access Control Service are synced to the Barracuda Firewall Control Center. Thus, a consolidated health status of multiple Access Control Services will be available. Additionally, the appropriate Barracuda Network Access Client service must be introduced on the CC.