This topic describes how to integrate RSA Authentication Manager (AM) with Stormshield SSL VPN by using RADIUS.

Configure AM

Perform these steps to configure AM using RADIUS.

Procedure

1. Sign in to the RSA Security Console.

2. Go to RADIUS > RADIUS Servers, and make a note of the IP address of the RADIUS server.

   

3. Click RADIUS > RADIUS Clients > Add New.

4. On the Add RADIUS Client page, configure the client:

   1. Client Name: Enter a descriptive name for the RADIUS client.

   2. IPv4 Address: Enter the public IP address of the Stormshield server.

   3. Make / Model: Select Standard RADIUS.

   4. Shared Secret: Enter a secure shared secret for communication between the RADIUS client and server.

5. Click Save & Create Associated RSA Agent.

6. On the Add New Authentication Agent page, click Save, and then click Yes, Save Agent.

Configure Stormshield SSL VPN

Perform these steps to configure Stormshield SSL VPN using RADIUS.

Procedure

1. Sign in to the Stormshield Network Security administrator console.

2. Click the Configuration tab, and then go to Users > Authentication.

   

3. On the Available Methods tab, click Enable a method, and then select Radius.

   

4. In the RADIUS settings, click the plus sign next to Server.

   

5. Create the RADIUS server object:

   1. Object name: Enter a descriptive name for the RADIUS server.

   2. IPv4 address: Enter the AM RADIUS server IP address.

6. In the RADIUS settings, configure access to the server:

   1. In Server, select the AM RADIUS server object that you created.

   2. In Port, keep radius.

   3. In Pre-shared Key, enter the shared secret that you configured in RSA Authentication Manager.

   

7. Create the first authentication policy:

   1. Go to Users > Authentication > Authentication Policy.

   2. Click New rule, and then select Standard rule.

   

   3. On the User tab, select the user group that must authenticate through RADIUS.

   4. On the Source tab, click Add an interface. In the interface list, select [Ethernet] out.

   

   5. On the Authentication methods tab, select Default method, and then click Remove.

   6. Click Enable a method, and then select RADIUS.

   7. Click OK.

   

8. Create the second authentication policy by repeating the preceding procedure. On the Source tab, select [SSL VPN] SSL VPN. Keep the remaining settings the same as the first policy.

9. Enable and apply the policies:

   1. In the Status column, double-click Disabled for each policy so that the status changes to Enabled.

   2. Click Apply.

   

Increase the RADIUS Timeout

The default RADIUS timeout in Stormshield is 3 seconds. Increase the primary and backup server timeouts to 30 seconds so that users have enough time to complete authentication.

1. Open a Stormshield CLI session as an administrator. Use SSH or open System > CLI Console on the firewall.

2. Enter the following command to set the primary and backup RADIUS server timeouts to 30,000 milliseconds and disable retries:

   CONFIG AUTH RADIUS timeout=30000 retry=0 btimeout=30000 bretry=0

3. Enter the following command to apply the authentication settings:

   CONFIG AUTH ACTIVATE

The configuration is complete.