Create LDAP Server elements

The LDAP Server element can be used to configure access to any LDAP server as a user database for the Firewalls and the Management Server.

The settings in the LDAP Server element can optionally include an account that the Management Server and NGFW Engines use to connect to query the directory. The user account must exist in the LDAP Server’s user database. Make sure the account you use has the permissions to manage other user accounts. The NGFW Engines and Management Server can also connect to query the directory without a user name and password if the LDAP server allows anonymous bind requests.

There are also values for some attributes that the Management Server and Firewall engines look for in the directory. We recommend that you do not use special characters or accented letters in the Distinguished Names or user ID attributes. For character limits for these settings, see the documentation of your LDAP server.

  For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Select Configuration, then browse to User Authentication.
  2. Right-click Servers, then select New > LDAP Server.
  3. On the General tab, configure the general settings.
  4. (Optional) On the Advanced tab, add one or more secondary IP addresses for the server.
    These IP addresses are included when the LDAP Server element is used in rules, but SMC components never use the addresses when initiating contact with the server.
  5. (Optional) If you want the LDAP Server to be monitored by the Log Server, configure the monitoring settings on the Monitoring tab.
  6. Click OK.

LDAP Server Properties dialog box

Use this dialog box to define Lightweight Directory Access Protocol (LDAP) Server properties.

Option Definition
General tab
Name The name of the element.
IP Address

Specifies the server IP address.

IPv4 addresses, IPv6 addresses, and fully qualified domain names (FQDNs) are supported. You can enter only one IPv4, IPv6 or FQDN as the IP address.
Resolve Automatically resolves the IP address of the server.
Location Specifies the location for the server if there is a NAT device between the server and other SMC components.
Contact Addresses
  • Default — Used by default whenever a component that belongs to another Location connects to this server.
  • Exceptions — Opens the Exceptions dialog box.
LDAP Protocol

Specifies the LDAP protocol that is used for the LDAP connection.

  • LDAP — The LDAP is used without encryption.
  • LDAPS — The LDAPS protocol is used for encryption.
  • Start TLS — Start TLS is used for encryption.
LDAP Port

(Optional)

The port number if the server communicates on a port other than the default port (TCP port 389). The predefined Firewall Template allows the engines to connect to the default port. If you change to a custom port, you must add a Access rule to allow the traffic.
TLS Profile

(When the LDAP Protocol is LDAPS or Start TLS)

Specifies the settings for cryptography, trusted certificate authorities, and the TLS version used in TLS-protected traffic.

Click Select to select a TLS Profile element.
TLS Server Identity

(When the LDAP Protocol is LDAPS or Start TLS)

Determines how the identity of the LDAP server is verified.
  • Edit — Opens the TLS Server Identity dialog box.
  • Remove — Removes the configured TLS Server Identify.
Base DN The LDAP tree under which the authenticating users’ accounts are stored.

Example (DNS-based tree):

dc=example,dc=com

Example (“O-based” tree used, for example, in Novell eDirectory):

ou=astronauts,o=government,st=Florida,c=US

Anonymous

(Optional)

 When selected, allows NGFW Engines and Management Servers to connect to the LDAP server without a user name and password.

When the option is selected, the Bind User ID and Bind Password options are not available.
Bind User ID The Distinguished Name of the User ID that the NGFW Engines and Management Servers use to connect to the server. This user account must exist in the user database. Make sure the account you use has the privileges to manage other user accounts.

Example (DNS-based tree):

uid=ExampleOrganization,ou=Administrators,dc=example,dc=com

Example (“O-based” tree used, for example, in Novell eDirectory):

uid=ExampleOrganization,ou=Administrators,ou=astronauts,

o=government,st=Florida,c=US

Bind Password The password for the user account that the Firewalls and Management Servers use to connect to the server. By default, passwords and keys are not shown in plain text. To show the password or key, deselect the Hide option.
Category

(Optional)

 Includes the element in predefined categories. Click Select to select a category.
Tools Profile Adds commands to the element right-click menu.Click Select to select an element.
Comment

(Optional)

 A comment for your own reference.
Check Connectivity Tests connectivity to the LDAP Server.
Option Definition
Object Classes tab
User ObjectClass Allows you to add user objectclasses manually.

If your LDAP server has LDAP user object classes that are not defined in the SMC by default, you must add those object classes to the LDAP Object classes in the server properties. This way, the existing classes on the LDAP server can also be used for authentication.

Add Adds the user objectclass name to the list of available classes.
Remove Removes the user objectclass name to the list of available classes.
Group ObjectClass Allows you to add group objectclasses manually.

If your LDAP server has LDAP group object classes that are not defined in the SMC by default, you must add those object classes to the LDAP Object classes in the server properties. This way, the existing classes on the LDAP server can also be used for authentication.

Add Adds the group objectclass name to the list of available classes.
Remove Removes the group objectclass name to the list of available classes.
Option Definition
Attributes tab
Schema
  • Standard — Select if you are using the external LDAP directory server’s standard schema files.
  • Updated — Select if you have extended the schema file to include SMC-specific attributes.
UserId Specifies the name of the attribute that is used as the UserID. This attribute can be used to identify users by their UserID in certificate authentication.
Group Member The name that the server uses for the Group Member Attribute. By default, the attribute is set to member for standard schema, and sgMember for updated schema.
Authentication

(Updated Schema only)

The Authentication Attribute for storing the authentication method information. By default, the attribute is set to sgauth.
Display Name Specifies the name that the server uses for the Display Name attribute.
E-mail Specifies the name of the attribute that is used for storing user email addresses. This attribute can be used to identify users by their email address in certificate authentication.
User Principal Name (UPN) Specifies the name of the attribute for storing the user principal name. This attribute can be used to identify users by their user principal name in certificate authentication.
Mobile Specifies the name of the attribute for storing user mobile phone numbers.
Framed IP This option is included for backward compatibility with legacy NGFW software versions.
Password Method Password The name of the password attribute for the Password Authentication Method.
Mobile Text Method Password The name of the password attribute for the Mobile Text Authentication Method.
Mobile ID Challenge Method PIN The name of the PIN attribute for the Mobile ID Challenge Authentication Method.
Mobile ID Synchronized Method PIN The name of the PIN attribute for the Mobile ID Synchronized Authentication Method.
Option Definition
Client Certificate tab
User Search for Client Certificate Authentication Specifies the name of the value in the distinguished name that is checked to verify the client identity.

The following values are supported:

  • CN — The client identity is checked against the UserId attribute specified for the server. The value of the UserId field on the Attributes tab must match the attribute that contains the user's common name.
  • email — The client identity is checked against the E-mail attribute specified for the server. The value of the E-mail field on the Attributes tab must match the attribute that contains the user's email address.
  • UID — The client identity is checked against the UserId attribute specified for the server. The value of the UserId field on the Attributes tab match the attribute that contains the user's UID.
Option Definition
Authentication tab
Authentication Methods Specifies the supported authentication methods for the LDAP Server.

Click Add to select authentication methods.

Note: The User password authentication method requires you to update the schema with SMC-specific attributes. Alternatively, you can use the LDAP Authentication authentication method to authenticate users using user names and passwords stored in the external LDAP database without updating the schema.
Remove Removes the selected authentication method.
Option Definition
Advanced tab
Secondary IP Addresses

Allows you to specify any additional device IP addresses. You can enter the additional IP addresses here instead of creating additional elements for the other IP addresses. The secondary IP addresses are valid in policies and in routing and antispoofing. You can add several IPv4 and IPv6addresses (one at a time).

  • Add — Adds a row to the table.
  • Remove — Removes the selected IP address from the list.
Timeout The time (in seconds) that SMC Components wait for the server to reply.
Max Entries The maximum number of LDAP entries that are returned in an LDAP response.
No Limit Deselect to specify the maximum number of LDAP entries returned.
Page Size

(Optional)

The maximum number of LDAP entries that are returned on each page of the LDAP response.
No Pages Deselect to specify the maximum number of LDAP entries returned on each page.
Option Definition
Monitoring tab
Log Server The Log Server that monitors the status of the element.
Status Monitoring When selected, activates status monitoring for the device. You must also select the Probing Profile that contains the definitions for the monitoring. When you select Status Monitoring, the element is added to the tree in the Home view.
Probing Profile Shows the name of the selected Probing Profile. Click Select to select a Probing Profile element.
Log Reception Activates syslog reception from this device. You must select the Logging Profile that contains the definitions for converting the syslog entries to SMC log entries. You must also select the Time Zone in which the device is located. By default, the local time zone of the computer you are using is selected.
Logging Profile Shows the name of the selected Logging Profile. Click Select to select a Logging Profile element.
Time Zone Selects the time zone for the logs.
Encoding Selects the character set for log files.
SNMP Trap Reception Enables the reception of SNMP traps from the third-party device.
NetFlow Reception Enables the reception of NetFlow data from the third-party device. The supported versions are NetFlow v5, NetFlow v9, and IPFIX (NetFlow v10).
Option Definition
NAT tab
Firewall Shows the selected firewall.
NAT Type Shows the NAT translation type: Static or Dynamic.
Private IP Address Shows the Private IP Address.
Public IP Address Shows the defined Public IP Address.
Port Filter Shows the selected Port Filters.
Comment An optional comment for your own reference.
Add NAT Definition Opens the NAT Definition Properties dialog box.
Edit NAT Definition Opens the NAT Definition Properties dialog box for the selected definition.
Remove NAT Definition Removes the selected NAT definition from the list.

TLS Server Identity dialog box

Use this dialog box to define the identity of a TLS server for TLS-protected audit or log data forwarding to an external syslog server, or the identity of an external LDAP or Active Directory server.

Option Definition
TLS Server Identity Field

Select the server identity type field to be used.

  • DNS Name — Use the DNS name of the server.
  • IP Address — Use the IP address of the server.
  • Common Name — Use the common name (CN) of the server.
  • Distinguished Name — Use the distinguished name (DN) of the server.
  • SHA-1 — Use SHA (Secure Hash Algorithm) hash function 1.
  • SHA-256 — Use SHA (Secure Hash Algorithm) hash function 256.
  • SHA-512 — Use SHA (Secure Hash Algorithm) hash function 512.
  • MD5 — Use MD5 Message-Digest Algorithm.
  • Email — Use the email address associated with the server.
  • User Principal Name — Use the user principal name (UPN) of the server.
Fetch From Certificate Opens the Import Certificate dialog box for fetching the value of the server identity field from a certificate.
Note: You can fetch the value of the server identity field from a certificate only if the server identity field is Distinguished Name, SHA-1, SHA-256, SHA-512, or MD5.
Server Identity Value Specifies the value for the selected field type.