Example: Configuring Web Authentication
This example shows how to enable Web authentication and set up a policy that allows access to a user when traffic encounters a policy that has Web authentication enabled.
Requirements
Before you begin:
- Define firewall users. See Firewall User Authentication Overview.
- Add the Web authentication HTTP flag under the interface's address hierarchy to enable Web authentication.
Overview
To enable Web authentication, you must specify the IP address of the device hosting the HTTP session. These settings are used if the firewall user accessing a protected resource wants to be authenticated by directly accessing the webserver or Web authentication. The following instructions show how to set up a policy that allows access to the FWClient1 user when traffic encounters a policy that has Web authentication enabled (Policy-W). (See Figure 33.) In this example, FWClient1 has already authenticated through the Web authentication login page.
The FWClient1 firewall user does the following to get authenticated:
- Points the browser to the Web authentication IP (20.20.20.1) to get authenticated first
- Starts traffic to access resources specified by the policy-W policy
Figure 33: Web Authentication Example
When you configure the device as described in these instructions and the user successfully authenticates, the screen illustrated in Figure 34 appears.
Figure 34: Web Authentication Success Banner
Configuration
CLI Quick Configuration
To quickly configure Web authentication as illustrated in Figure 33, copy the following commands and paste them into the CLI:
[edit]
set interfaces ge-0/0/1 unit 0 family inet address
20.20.20.1/24 web-authentication http
set interfaces ge-0/0/1 unit 0 family inet address
20.20.20.2/24
set interfaces fe-5/0/0 unit 0 family inet address
30.30.30.1/24
set interfaces fe-5/0/0 unit 0 family inet address
30.30.30.2/24
set access profile WEBAUTH client FWClient1
firewall-user password “$9$kq5Ftu1cSe”
set access firewall-authentication web-authentication
default-profile WEBAUTH
set access firewall-authentication web-authentication
banner success "WEB AUTH LOGIN SUCCESS"
set security zones security-zone UT-ZONE host-inbound-traffic
system-services all
set security zones security-zone UT-ZONE interfaces
ge-0/0/1.0 host-inbound-traffic protocols all
set security zones security-zone T-ZONE host-inbound-traffic
system-services all
set security zones security-zone T-ZONE interfaces
ge-5/0/0.0 host-inbound-traffic protocols all
set security policies from-zone UT-ZONE to-zone
T-ZONE policy P1 match source-address any
set security policies from-zone UT-ZONE to-zone
T-ZONE policy P1 match destination-address any
set security policies from-zone UT-ZONE to-zone
T-ZONE policy P1 match application any
set security policies from-zone UT-ZONE to-zone
T-ZONE policy P1 then permit firewall-authentication web-authentication
client-match FWclient1
set system services web-management http interface
ge-0/0/0.0
Step-by-Step Procedure
The following example requires you to navigate levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.
To configure pass-through authentication:
- Configure two interfaces and assign IP addresses
to them.
Note: For this example, it is optional to assign two addresses to the interfaces.
[edit]
user@host# set interfaces ge-0/0/1 unit 0 family inet address 20.20.20.1/24 web-authentication http
user@host# set interfaces ge-0/0/1 unit 0 family inet address 20.20.20.2/24
user@host# set interfaces fe-5/0/0 unit 0 family inet address 30.30.30.1/24
user@host# set interfaces fe-5/0/0 unit 0 family inet address 30.30.30.2/24
- Create the WEBAUTH access profile for the FWClient1
user, specify the user’s password, and define a success banner.
[edit access]
user@host# set profile WEBAUTH client FWClient1 firewall-user password “$9$kq5Ftu1cSe”
user@host# set firewall-authentication web-authentication default-profile WEBAUTH
user@host# set firewall-authentication web-authentication banner success "WEB AUTH LOGIN SUCCESS"
- Configure security zones.
Note: For this example, it is optional to configure a second interface for a security zone.
[edit security zones]
user@host# set security-zone UT-ZONE host-inbound-traffic system-services all
user@host# set security-zone UT-ZONE interfaces ge-0/0/1.0 host-inbound-traffic protocols all
user@host# set security-zone T-ZONE host-inbound-traffic system-services all
user@host# set security-zone T-ZONE interfaces ge-5/0/0.0 host-inbound-traffic protocols all
- Assign security policy P1 to the security zones.
[edit security policies]
set from-zone UT-ZONE to-zone T-ZONE policy P1 match source-address any
set from-zone UT-ZONE to-zone T-ZONE policy P1 match destination-address any
set from-zone UT-ZONE to-zone T-ZONE policy P1 match application any
set from-zone UT-ZONE to-zone T-ZONE policy P1 then permit firewall-authentication web-authentication client-match FWclient1
- Activate the HTTP daemon on your device.
[edit]
user@host# set system services web-management http interface ge-0/0/0.0
Results
Confirm your configuration by entering these commands from configuration mode:
- show interfaces
- show access
- show security zones
- show security policies
- show system services
If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.
For brevity, this show output includes only the configuration that is relevant to this example. Any other configuration on the system has been replaced with ellipses (...).
user@host# show interfaces
... } ge-0/0/1.1 { unit 0 { family inet { address 20.20.20.1/24 { web-authentication http; } address 20.20.20.2/24; } } } fe-5/0/0 { unit 0 { family inet { address 30.30.30.1/24; address 30.30.30.2/24; } } } ...
user@host# show access
profile WEBAUTH { client FWClient1 { firewall-user { password "$9$XHhxVYGDkf5F"; ## SECRET-DATA } } } firewall-authentication { web-authentication { default-profile WEBAUTH; banner { success "WEB AUTH LOGIN SUCCESS"; } } }
user@host# show security zones
... } security-zone UT-ZONE { host-inbound-traffic { system-services { all; } } interfaces { ge-0/0/1.0 { host-inbound-traffic { protocols { all; } } } } } security-zone T-ZONE { host-inbound-traffic { system-services { all; } } interfaces { ge-5/0/0.0 { host-inbound-traffic { protocols { all; } } } } }
user@host# show security policies
... from-zone UT-ZONE to-zone T-ZONE { policy P1 { match { source-address any; destination-address any; application any; } then { permit { firewall-authentication { web-authentication { client-match FWclient1; } } } } } }
user@host# show system services
... web-management { http { interface g-0/0/0.0; } }
If you are done configuring the device, enter commit from configuration mode.
Verification
To confirm that the configuration is working properly, perform these tasks:
- Verifying Firewall User Authentication
- Monitoring Users and IP Addresses in the Authentication Table
Verifying Firewall User Authentication
Purpose
Display firewall authentication user history. Verify the number of firewall users who successfully authenticated and firewall users who failed to log in.
Action
Enter the show security firewall-authentication history command from operational mode. For more information, see the JUNOS Software CLI Reference.
user@host> show security firewall-authentication
history
History of firewall authentication data: Authentications: 2 Id Source Ip Date Time Duration Status User 1 99.99.99.1 2007-10-12 21:24:02 0:00:24 Failed troy 2 99.99.99.1 2007-10-12 21:24:48 0:00:22 Success voyager user@host> show security firewall-authentication history identifier 1 Username: troy Source IP: 99.99.99.1 Authentication state: Failed Authentication method: Pass-through using Telnet Access start date: 2007-10-12 Access start time: 21:24:02 Duration of user access: 0:00:24 Policy name: lnx2-telnet-lnx1 Source zone: dl2 Destination zone: dl1 Access profile: wonder Bytes sent by this user: 0 Bytes received by this user: 2660 Client-groups: Sunnyvale Bangalore user@host> show security firewall-authentication users Firewall authentication data: Total users in table: 1 Id Source Ip Src zone Dst zone Profile Age Status User 3 99.99.99.1 dl2 dl1 wonder 1 Failed TechPubs user@host> show security firewall-authentication users identifier 3 Username: TechPubs Source IP: 99.99.99.1 Authentication state: Failed Authentication method: Pass-through using Telnet Age: 1 Access time remaining: 9 Source zone: dl2 Destination zone: dl1 Policy name: lnx2-telnet-lnx1 Access profile: wonder Interface Name: ge-0/0/1.0 Bytes sent by this user: 0 Bytes received by this user: 1521
Monitoring Users and IP Addresses in the Authentication Table
Purpose
Verify a list of users and IP addresses that are currently authenticated by the device in the authentication table.
Action
Enter these show commands from operational mode.
user@host> show security firewall-authentication
users
user@host> show security firewall-authentication
users identifier num
user@host> show security firewall-authentication
users address ipaddress
where:
- users—Shows the list of users and IP addresses currently authenticated by JUNOS Software.
- identifier—Shows more details on a specific row.
- address—Shows more details on a specific IP address.
Related Topics
- JUNOS Software Feature Support Reference for SRX Series and J Series Devices
- Understanding Web Authentication
- Understanding Firewall Authentication Banner Customization
- Security Zones and Interfaces Overview