8e6 Technologies Enterprise Filter Authentication R3000 User manual

® R3000 | Internet Filter
USER
GUIDE
for Authentication
R3000IR Model: R3000
Release 2.2.10 • Manual Version 1.01

ii 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE

8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE iii
R3000 INTERNET FILTER
AUTHENTICATION USER GUIDE
© 2009 8e6 Technologies
All rights reserved.
828 W. Taft Ave., Orange, CA 92865, USA
Version 1.01, published May 2009
To be used with R3000IR User Guide version 1.01 for software
release 2.2.10
Printed in the United States of America
This document may not, in whole or in part, be copied, photo-
copied, reproduced, translated, or reduced to any electronic
medium or machine readable form without prior written con-
sent from 8e6 Technologies.
Every effort has been made to ensure the accuracy of this
document. However, 8e6 Technologies makes no warranties
with respect to this documentation and disclaims any implied
warranties of merchantability and fitness for a particular pur-
pose. 8e6 Technologies shall not be liable for any error or for
incidental or consequential damages in connection with the
furnishing, performance, or use of this manual or the exam-
ples herein. Due to future enhancements and modifications of
this product, the information described in this documentation
is subject to change without notice.
The latest version of this document can be obtained from
http://www.marshal8e6.com/Support/R3000/documenta-
tion.asp
Trademarks
Other product names mentioned in this manual may be trade-
marks or registered trademarks of their respective companies
and are the sole property of their respective manufacturers.
Part# IR-R3.2.2_AUG_v1.01-0905

iv 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE

8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE V
C HAPTER 1: I NTRODUCTION .............................................. 1
About this User Guide ................................................................1
How to Use this User Guide ....................................................... 2
Conventions ...................................................................................... 2
Terminology ...................................................................................... 3
Filtering Elements .......................................................................8
Group Types ..................................................................................... 8
Global Group .............................................................................. 8
IP Groups . .................................................................................. 9
NT Domain Groups ................................................................... 10
LDAP Domain Groups . ............................................................. 11
Filtering Profile Types ..................................................................... 12
Static Filtering Profiles . ............................................................. 14
Master IP Group Filtering Profile......................................... 14
IP Sub-Group Filtering Profile ............................................. 14
Individual IP Member Filtering Profile ................................. 14
Active Filtering Profiles . ............................................................ 15
Global Filtering Profile......................................................... 15
NT/LDAP Group Filtering Profile ......................................... 15
NT/LDAP Member Filtering Profile...................................... 15
LDAP Container Filtering Profile ......................................... 16
Override Account Profile ..................................................... 16
Time Profile ......................................................................... 16
Lock Profile ......................................................................... 16
Filtering Profile Components ........................................................... 17
Library Categories . ................................................................... 18
8e6 Supplied Categories..................................................... 18
Custom Categories ............................................................. 18
Service Ports . ........................................................................... 19
Rules ........................................................................................ 19
Minimum Filtering Level ............................................................ 19
Filter Settings ............................................................................ 20
Filtering Rules ................................................................................. 21
Authentication Solutions .......................................................... 24
R3000 Authentication Protocols ...................................................... 24
R3000 Authentication Tiers and Options ........................................ 24
R3000 authentication tiers ........................................................ 24

CONTENTS
vi 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
R3000 authentication options . .................................................. 25
Authentication Solution Compatibility .............................................. 26
Authentication System Deployment Options ................................... 27
Ports for Authentication System Access ......................................... 28
Configuring the R3000 for Authentication ....................................... 29
Configuration procedures ......................................................... 29
System section.................................................................... 29
Group section...................................................................... 32
C HAPTER 2: N ETWORK S ETUP ........................................ 33
Environment Requirements ..................................................... 33
Workstation Requirements .............................................................. 33
Administrator ............................................................................ 33
End User ................................................................................... 34
Network Requirements .................................................................... 34
Set up the Network for Authentication ....................................35
Specify the operation mode ............................................................ 36
Specify the subnet mask, IP address(es) ........................................ 38
Invisible mode ........................................................................... 38
Router or firewall mode . ........................................................... 39
Enable authentication, specify criteria ............................................. 40
Net use based authentication ................................................... 42
Web-based authentication . ....................................................... 43
Enter network settings for authentication ........................................ 46
Create an SSL certificate ................................................................ 48
Create, Download a Self-Signed Certificate ............................. 49
Create, Upload a Third Party Certificate ................................... 50
Create a Third Party Certificate........................................... 50
Upload a Third Party Certificate ......................................... 52
Download a Third Party Certificate .................................... 53
View log results ............................................................................... 54
Specify block page settings ............................................................. 57
Block Page Authentication ........................................................ 58
Block page ......................................................................... 59
User/Machine frame ..................................................... 60
Standard Links.............................................................. 60
Optional Links............................................................... 61
Options page ...................................................................... 62
Option 1 ........................................................................ 63

CONTENTS
8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE vii
Option 2 ........................................................................ 64
Option 3 ........................................................................ 65
Common Customization ........................................................... 66
Enable, disable features ..................................................... 67
Authentication Form Customization .......................................... 69
Preview sample Authentication Request Form .................. 71
Block Page Customization ........................................................ 73
Preview sample block page ............................................... 75
Set up Group Administrator Accounts ...................................77
Add Sub Admins to manage groups, users ..................................... 77
Add a group administrator account ........................................... 78
Update the group administrator’s password ............................. 78
Delete a group administrator account ....................................... 79
C HAPTER 3: NT A UTHENTICATION S ETUP ........................ 80
NT Domain Setup ......................................................................80
Add an NT domain .......................................................................... 80
Refresh the NT branch .................................................................... 81
View or modify NT domain details ................................................... 82
Domain Settings ....................................................................... 82
Default Rule . ............................................................................. 84
Delete an NT domain ...................................................................... 85
Set up NT Domain Groups, Members ......................................86
Add NT groups, members to the tree .............................................. 86
Specify a group’s filtering profile priority ......................................... 88
Manually add a user’s name to the tree .......................................... 90
Manually add a group’s name to the tree ........................................ 91
Upload a file of filtering profiles to the tree ...................................... 92
C HAPTER 4: LDAP A UTHENTICATION S ETUP ................... 95
Create an LDAP Domain ...........................................................95
Add the LDAP domain ..................................................................... 95
Refresh the LDAP branch ............................................................... 96
View, modify, enter LDAP domain details ....................................... 97
LDAP Server Type .................................................................... 98
Group Objects .......................................................................... 99
User Objects . .......................................................................... 101

CONTENTS
viii 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
Address Info ........................................................................... 102
Account Info ............................................................................ 105
SSL Settings ........................................................................... 107
Alias List ................................................................................. 109
Default Rule . ........................................................................... 111
LDAP Backup Server Configuration ................................. 113
Configure a backup server.......................................... 113
Modify a backup server’s configuration ...................... 118
Delete a backup server’s configuration....................... 118
Delete a domain ............................................................................ 119
Set up LDAP Domain Groups, Members ............................... 120
Add LDAP groups, users to the tree ............................................. 120
Perform a basic search ........................................................... 121
Options for search results ....................................................... 122
Apply a filtering rule to a profile .............................................. 122
Delete a rule ........................................................................... 123
Specify a group’s filtering profile priority ....................................... 124
Manually add a user’s name to the tree ........................................ 125
Manually add a group’s name to the tree ...................................... 126
Upload a file of filtering profiles to the tree .................................... 127
C HAPTER 5: A SSIGN /S ET UP G ROUPS , M EMBERS .......... 130
Assign Sub Admin to NT/LDAP Entity .................................. 130
Create and Maintain Filtering Profiles ...................................133
Add a group member to the tree list .............................................. 134
Add or maintain an entity’s profile ................................................. 135
Category Profile ...................................................................... 136
Redirect URL . ......................................................................... 139
Filter Options . ......................................................................... 140
Add an Exception URL to the profile ............................................. 141
URL entries ............................................................................. 142
Block URL frame . ................................................................... 143
ByPass URL frame ................................................................. 143
Apply settings ......................................................................... 143
Create a Time Profile for the entity ............................................... 144
Add a Time Profile .................................................................. 144
Remove an entity’s profile from the tree ....................................... 149

CONTENTS
8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE ix
C HAPTER 6: A UTHENTICATION D EPLOYMENT ................. 150
Test Authentication Settings ................................................. 150
Test Web-based authentication settings ....................................... 152
Step 1: Create an IP Group, “test” .......................................... 152
Step 2: Create a Sub-Group, “workstation” . ........................... 153
Step 3: Set up “test” with a 32-bit net mask ............................ 154
Step 4: Give “workstation” a 32-bit net mask .......................... 155
Step 5: Block everything for the Sub-Group . .......................... 156
Step 6: Use Authentication Request Page for redirect URL ...157
Step 7: Disable filter options ................................................... 158
Step 8: Attempt to access Web content . ................................ 159
Test net use based authentication settings ................................... 161
Activate Authentication on the Network ............................... 162
Activate Web-based authentication for an IP Group ..................... 163
Step 1: Create a new IP Group, “webauth” ............................ 163
Step 2: Set “webauth” to cover users in range . ...................... 164
Step 3: Create an IP Sub-Group . ........................................... 165
Step 4: Block everything for the Sub-Group . .......................... 167
Step 5: Use Authentication Request Page for redirect URL ...168
Step 6: Disable filter options ................................................... 169
Step 7: Set Global Group to filter unknown traffic . ................. 170
Activate Web-based authentication for the Global Group ............. 175
Step 1: Exclude filtering critical equipment ............................. 175
Step 1A: Block Web access, logging via Range to Detect . .... 176
Range to Detect Settings .................................................. 176
Range to Detect Setup Wizard ......................................... 178
Step 1B: Block Web access via IP Sub-Group profile . ........... 184
Step 2: Modify the Global Group Profile . ................................ 187
Activate NT authentication ............................................................ 191
Step 1: Modify the 3-try login script ........................................ 191
Step 2: Modify the Global Group Profile ................................. 192
C HAPTER 7: T ECHNICAL S UPPORT ................................ 194
Hours ........................................................................................ 194
Contact Information ................................................................ 194
Domestic (United States) .............................................................. 194
International .................................................................................. 194

CONTENTS
x8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
E-Mail ............................................................................................ 194
Office Locations and Phone Numbers .......................................... 195
8e6 Corporate Headquarters (USA) ....................................... 195
8e6 Taiwan ............................................................................. 195
Support Procedures ................................................................ 196
A PPENDIX A: A UTHENTICATION O PERATIONS ................ 197
Authentication Tier Selections ..............................................197
Tier 1: Net use based authentication ............................................ 197
Tier 2, Tier 3: Web-based authentication ...................................... 198
Tier 1: Single Sign-On Authentication .................................. 199
Net use based authentication process .......................................... 199
Re-authentication process . ..................................................... 201
Tier 1 authentication methods ....................................................... 201
SMB protocol .......................................................................... 201
SMB Signing ..................................................................... 201
LDAP protocol ........................................................................ 202
Name resolution methods ............................................................. 203
Configuring the authentication server ........................................... 204
Login scripts ........................................................................... 204
Enter net use syntax in the login script ............................. 204
View login script on the server console .................................. 205
Block page authentication login scripts ............................. 205
LDAP server setup rules ............................................................... 206
Tier 2: Time-based, Web Authentication ............................... 207
Tier 2 implementation in an environment ...................................... 208
Tier 2 Script . ........................................................................... 209
Tier 1 and Tier 2 Script . .......................................................... 210
Tier 3: Session-based, Web Authentication ......................... 212
8e6 Authenticator .................................................................... 213
Environment requirements ............................................................ 214
Windows minimum system requirements ............................... 214
Recommended system requirements ............................... 214
Macintosh minimum system requirements ............................. 215
Workstation requirements ............................................................. 215

CONTENTS
8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE xi
Work flow in environments ............................................................ 216
Macintosh environment . ......................................................... 217
8e6 Authenticator configuration priority . ................................. 218
Windows............................................................................ 218
Macintosh ......................................................................... 219
8e6 Authenticator configuration syntax . ................................. 220
Sample command line parameters ................................... 220
Sample configuration file ............................................ 220
Sample R3000 configuration update packet ‘PCFG’ .. 221
Table of parameters . .............................................................. 222
Novell eDirectory Agent ......................................................... 225
Environment requirements ............................................................ 225
Novell eDirectory servers ........................................................ 225
Client workstations . ................................................................ 226
Novell clients .......................................................................... 226
Novell eDirectory setup ................................................................. 226
R3000 setup and event logs ......................................................... 227
Active Directory Agent ........................................................... 228
Product feature overview .............................................................. 228
Windows server requirements . ............................................... 229
Work flow in a Windows environment ..................................... 229
Set up AD Agent ........................................................................... 230
Step 1: AD Agent settings on the R3000 ................................ 230
Step 2: Configure the domain, service account ...................... 232
Step 3: AD Agent installation on Windows server .................. 233
Step 3A: Download DCAgent.msi ..................................... 233
Step 3B: Run AD Agent installation setup......................... 233
Step 3C: Run AD Agent configuration wizard ................... 236
Use the Active Directory Agent console ........................................ 241
Activity tab .............................................................................. 241
Sessions tab . .......................................................................... 244
Session table spreadsheet................................................ 246
Session Properties window .............................................. 247
Workstation Interactive Probe window .............................. 248
Active Directory Agent Configuration window ......................... 250
Service page .................................................................... 252
Appliance page ................................................................. 253
Agent hosts page ............................................................. 254
Add a satellite ............................................................. 255

CONTENTS
xii 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
Remove a satellite ...................................................... 255
Configure a satellite .................................................... 256
Check the status of a satellite..................................... 258
Options page .................................................................... 260
Notifications page ............................................................. 262
A PPENDIX B: O BTAIN , E XPORT AN SSL C ERTIFICATE .... 264
Export an Active Directory SSL Certificate ..........................264
Verify certificate authority has been installed ................................ 264
Locate Certificates folder .............................................................. 265
Export the master certificate for the domain ................................. 268
Export a Novell SSL Certficate ..............................................272
Obtain a Sun ONE SSL Certificate .........................................274
A PPENDIX C: LDAP S ERVER C USTOMIZATIONS ............. 275
OpenLDAP Server Scenario ...................................................275
Not all users returned in User/Group Browser .............................. 275
A PPENDIX D: U SER /G ROUP F ILE F ORMAT AND R ULES ... 276
Username Formats .................................................................. 277
Rule Criteria ............................................................................. 277
File Format: Rules and Examples .......................................... 280
NT User List Format and Rules ..................................................... 281
NT Group List Format and Rules .................................................. 282
NT Quota Format and Rules ......................................................... 283
LDAP User List Format and Rules ................................................ 284
LDAP Group List Format and Rules .............................................. 285
LDAP Quota Format and Rules .................................................... 286
A PPENDIX E: O VERRIDE P OP - UP B LOCKERS ................. 287
Yahoo! Toolbar Pop-up Blocker ............................................ 288
If pop-up blocking is enabled ........................................................ 288

CONTENTS
8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE xiii
Add override account to the white list ........................................... 288
Google Toolbar Pop-up Blocker ............................................ 290
If pop-up blocking is enabled ........................................................ 290
Add override account to the white list ........................................... 290
AdwareSafe Pop-up Blocker .................................................. 291
If pop-up blocking is enabled ........................................................ 291
Temporarily disable pop-up blocking ............................................ 291
Mozilla Firefox Pop-up Blocker .............................................. 292
Add override account to the white list ........................................... 292
Windows XP SP2 Pop-up Blocker .........................................293
Set up pop-up blocking ................................................................. 293
Use the Internet Options dialog box ....................................... 293
Use the IE toolbar . .................................................................. 294
Temporarily disable pop-up blocking ............................................ 294
Add override account to the white list ........................................... 295
Use the IE toolbar ................................................................... 295
Use the Information Bar .......................................................... 296
Set up the Information Bar ................................................ 296
Access your override account ........................................... 296
A PPENDIX F: G LOSSARY ............................................... 298
Definitions ................................................................................ 298
I NDEX ........................................................................... 305

CONTENTS
xiv 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE

CHAPTER 1: INTRODUCTION ABOUT THIS USER GUIDE
8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE 1
CHAPTER 1: INTRODUCTION
The R3000 Authentication User Guide contains information
about setting up authentication on the network.
About this User Guide
This user guide addresses the network administrator desig-
nated to configure and manage the R3000 server on the
network.
Chapter 1 provides information on how to use this user
guide, and also includes an overview of filtering compo-
nents and authentication solutions.
Chapters 2, 3, and 4 describe the R3000 Administrator
console entries that must be made in order to prepare the
network for using authentication for NT and/or LDAP
domains.
NOTE: Refer to the R3000IR Quick Start Guide for information on
installing the R3000 on the network. This document also provides
information on how to access the R3000 console to perform the
initial installation setup defined in Chapter 2: Network Setup.
After all settings have been made, authentication is ready to
be used on the network. Chapter 5 explains how to assign
groups and members for management by Sub Admin group
administrators, and how group administrators create and
maintain filtering profiles for entities in their assignment.
Chapter 6 outlines the step you need to take to test and to
activate your settings before deploying authentication on
the network.
Chapter 7 provides support information. Appendices at the
end of this user guide feature instructions on authentication
operations; information on how to obtain or export an SSL
certificate and upload it to the R3000; notes on customiza-
tions to make on specified LDAP servers; filtering profile file

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
28E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
components and setup; tips on how to override pop-up
windows with pop-up blocker software installed; a glossary
on authentication terms, and an index.
How to Use this User Guide
Conventions
The following icons are used throughout this user guide:
NOTE: The “note” icon is followed by italicized text providing
additional information about the current subject.
TIP: The “tip” icon is followed by italicized text giving you hints on
how to execute a task more efficiently.
WARNING: The “warning” icon is followed by italicized text
cautioning you about making entries in the application, executing
certain processes or procedures, or the outcome of specified
actions.

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE 3
Terminology
The following terms are used throughout this user guide.
Sample images (not to scale) are included for each item.
• alert box - a message box
that opens in response to
an entry you made in a
dialog box, window, or
screen. This box often
contains a button (usually
labeled “OK”) for you to click in order to confirm or
execute a command.
• button - an object in a dialog box,
window, or screen that can be clicked
with your mouse to execute a command.
• checkbox - a small square in a dialog
box, window, or screen used for indi-
cating whether or not you wish to select an option. This
object allows you to toggle between two choices. By
clicking in this box, a check mark or an “X” is placed, indi-
cating that you selected the option. When this box is not
checked, the option is not selected.
• dialog box - a box that
opens in response to a
command made in a
window or screen, and
requires your input. You
must choose an option by
clicking a button (such as “Yes” or “No”, or “Next” or
“Cancel”) to execute your command. As dictated by this
box, you also might need to make one or more entries or
selections prior to clicking a button.
• field - an area in a dialog box,
window, or screen that either
accommodates your data

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
48E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
entry, or displays pertinent information. A text box is a
type of field.
• frame - a boxed-in area in a dialog
box, window, or screen that
includes a group of objects such as
fields, text boxes, list boxes,
buttons, radio buttons, check-
boxes, and/or tables. Objects within a frame belong to a
specific function or group. A frame often is labeled to indi-
cate its function or purpose.
• grid - an area in
a frame that
displays rows
and columns of
data, as a result of various processes. This data can be
reorganized in the R3000 console, by changing the order
of the columns.
• list box - an area in a dialog box,
window, or screen that accommo-
dates and/or displays entries of
items that can be added or removed.
• navigation panel - the panel that
displays at the left of a screen. This
panel can contain links that can be
clicked to open windows or dialog boxes
at the right of the screen. One or more
tree lists also can display in this panel.
When an item in the tree list is double-
clicked, the tree list opens to reveal
items that can be selected.

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE 5
• pop-up box or pop-up
window - a box or window
that opens after you click a
button in a dialog box,
window, or screen. This box
or window may display infor-
mation, or may require you to make one or more entries.
Unlike a dialog box, you do not need to choose between
options.
• pull-down menu - a field in a
dialog box, window, or screen
that contains a down-arrow to the right. When you click
the arrow, a menu of items displays from which you make
a selection.
• radio button - a small, circular object
in a dialog box, window, or screen
used for selecting an option. This object allows you to
toggle between two choices. By clicking a radio button, a
dot is placed in the circle, indicating that you selected the
option. When the circle is empty, the option is not
selected.
• screen - a main
object of an appli-
cation that displays
across your
monitor. A screen
can contain panels,
windows, frames,
fields, tables, text
boxes, list boxes,
icons, buttons, and
radio buttons.

CHAPTER 1: INTRODUCTION HOW TO USE THIS USER GUIDE
68E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
• sub-topic - a subset
of a main topic that
displays as a menu
item for the topic. The
menu of subtopics
opens when a perti-
nent topic link in the left panel—the navigation panel—of
a screen is clicked. If a sub-topic is selected, the window
for that sub-topic displays in the right panel of the screen,
or a pop-up window or an alert box opens, as appro-
priate.
• text box - an area in a dialog box, window, or screen that
accommodates your data entry. A text box is a type of
field. (See “field”.)
• topic - a topic
displays as a
link in the left
panel—the
navigation
panel—of a
screen. By
clicking the link
for a topic, the
window for that
topic displays in
the right panel
of the screen, or a menu of sub-topics opens.