We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda SSL VPN

How can I use VASCO Digipass Token with my Barracuda SSL VPN?

  • Type: Knowledgebase
  • Date changed: 8 years ago

Solution #00005388

 

Scope:

Applies to Barracuda SSL VPN.

 

Answer:

The Barracuda SSL VPN can be configured to authenticate to a VASCO server using the RADIUS feature of the product. Note that VASCO do not currently include a RADIUS server with their product; therefore you will need to use an external RADIUS server (i.e. FreeRADIUS) to provide the RADIUS component of this solution.

 

The following are the steps to set up the Barracuda SSL VPN to use Digipass Tokens for authentication:

  1. Configure an Authentication Scheme that uses RADIUS authentication as one of the authentication stages.
  2. Configure the RADIUS server in VACMAN Middleware.
  3. Add the Barracuda SSL VPN server to VACMAN as a RADIUS client.
  4. Create Users in VACMAN Middleware.
  5. Import Digipass Tokens into VACMAN Middleware.
  6. Assign Digipass Tokens to users.
  7. Test the authentication process.

 

Configuring an Authentication Scheme that uses RADIUS

To begin setting up Digipass Tokens for authentication, you must first configure an authentication scheme that uses RADIUS.

  1. Browse to Manage System > Advanced > Configuration and configure the RADIUS settings:
    • RADIUS Server –The IP address of the RSA Authentication Manager RADIUS server.
    • Authentication Port – The port over which the RADIUS server is listening for authentication requests.
    • Accounting Port – The port over which the RADIUS server is listening to for accounting requests.
    • Shared Secret –The password that must be set on both the Barracuda SSL VPN appliance and the Authentication Manager.
    • Authentication Method – This should be set to PAP (Password Authentication Protocol) unless otherwise instructed.
    • Time out – Seconds to wait for a response from the server before timing out upon authentication.
    • Authentication Retries – Number of times to re-attempt a timed-out authentication request.
  2. Browse to Manage System > Access Control > Authentication Schemes and configure a new authentication scheme that includes the RADIUS authentication. Create a new scheme.
  3. Assign authentication methods to the scheme. Add Password and also add RADIUS, to create a scheme with Password authentication as the primary method and RADIUS as the secondary method. Click Next.
  4. Choose the Policies to assign this authentication scheme to. For example, use the ‘Everyone’ policy to assign to all users. Review your settings and click Finish to create the new policy.

 

Configure the RADIUS server in VACMAN Middleware

You must now set up VACMAN to use RADIUS as well.

  1. In VACMAN Middleware, log on to your VACMAN server, expand the server tree and rightclick on the RADIUS server’s node. Select New RADIUS Server to create the new server.
  2. Enter the relevant properties for the RADIUS server on your network and click OK.
  3. The VACMAN Server service may need to restart, and you may need to log back onto the server again. Once this is complete, the new RADIUS server details will be listed under the RADIUS Server node.

 

Add the Barracuda SSL VPN as a RADIUS client

The Barracuda SSL VPN must be registered with the VACMAN server as a RADIUS client.

  1. In order for your appliance to talk to the VACMAN server via RADIUS, it will need to be configured as a RADIUS client.
  2. Click ‘Create’ and the new RADIUS client will be created.

 

Create Users in VACMAN Middleware

You will need to create some users in the VACMAN Middleware server in order to authenticate

them using the Digipass devices.

  1. Right-click on the ‘Users’ node and select ‘New User’.
  2. The new user dialog appears. Enter the relevant details and click ‘Create’.
  3. The new user is created and appears in the user list.

 

Importing Digipass Tokens to VACMAN

In order to authenticate your users using Digipass tokens, you will firstly need to import them into VACMAN Middleware.

  1. Right-click on the Digipass node and select ‘Import Digipass’
  2. An import dialog will appear. You will now need to import the Digipass import file (a *.dpx file) for the relevant keys. Enter the 32 character hexadecimal number into the ‘Key’ field.
  3. Click ‘Import All Applications’ to import all records. You can alternatively pick just the relevant applications you wish to import by selecting ‘Import Selected Applications’. Click ‘Close’ when done.
  4. The import proceeds and you will see the imported tokens in the Digipass item list.

 

Assigning Digipass Tokens to Users

The last step of the Digipass configuration is to assign the Digipass tokens to the relevant users within VACMAN Middleware.

  1. In the Digipass list in the server tree, right-click on the appropriate Digipass token and select Assign.
  2. Enter the username in the User ID field and click Find to search for the user.
  3. Select the desired username and click OK to assign the Digipass token to this user.

 

Testing the Authentication Process

Once the RADIUS authentication is configured, verify the authentication process using your Digipass key fob.

  1. Enter your username when prompted.
  2. The second stage prompts you for password – this is the password to the user database you have currently configured, i.e. Active Directory.
  3. If the password was accepted, a second password prompt will be shown. This prompt asks for the OTP displayed on the key fob. If you configured the key fob with a PIN, e.g. 4567, you will need to enter this followed by the token code displayed on the device. For example, if the device displays 157252 and your PIN number is 4567; you should enter 4567157252 in this field.
  4. When successfully authenticated, you will be presented with the Favorites page.

 

Link to this page:

https://campus.barracuda.com/solution/50160000000IMyiAAG