8e6 Technologies Enterprise Filter Authentication R3000 User manual

® R3000 | Internet Filter
USER
GUIDE
for Authentication
R3000IR Model: R3000
Release 2.2.10 • Manual Version 1.01

ii 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE

8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE iii
R3000 INTERNET FILTER
AUTHENTICATION USER GUIDE
© 2009 8e6 Technologies
All rights reserved.
828 W. Taft Ave., Orange, CA 92865, USA
Version 1.01, published May 2009
To be used with R3000IR User Guide version 1.01 for software
release 2.2.10
Printed in the United States of America
This document may not, in whole or in part, be copied, photo-
copied, reproduced, translated, or reduced to any electronic
medium or machine readable form without prior written con-
sent from 8e6 Technologies.
Every effort has been made to ensure the accuracy of this
document. However, 8e6 Technologies makes no warranties
with respect to this documentation and disclaims any implied
warranties of merchantability and fitness for a particular pur-
pose. 8e6 Technologies shall not be liable for any error or for
incidental or consequential damages in connection with the
furnishing, performance, or use of this manual or the exam-
ples herein. Due to future enhancements and modifications of
this product, the information described in this documentation
is subject to change without notice.
The latest version of this document can be obtained from
http://www.marshal8e6.com/Support/R3000/documenta-
tion.asp
Trademarks
Other product names mentioned in this manual may be trade-
marks or registered trademarks of their respective companies
and are the sole property of their respective manufacturers.
Part# IR-R3.2.2_AUG_v1.01-0905

iv 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE

8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE V
C HAPTER 1: I NTRODUCTION .............................................. 1
About this User Guide ................................................................1
How to Use this User Guide ....................................................... 2
Conventions ...................................................................................... 2
Terminology ...................................................................................... 3
Filtering Elements .......................................................................8
Group Types ..................................................................................... 8
Global Group .............................................................................. 8
IP Groups . .................................................................................. 9
NT Domain Groups ................................................................... 10
LDAP Domain Groups . ............................................................. 11
Filtering Profile Types ..................................................................... 12
Static Filtering Profiles . ............................................................. 14
Master IP Group Filtering Profile......................................... 14
IP Sub-Group Filtering Profile ............................................. 14
Individual IP Member Filtering Profile ................................. 14
Active Filtering Profiles . ............................................................ 15
Global Filtering Profile......................................................... 15
NT/LDAP Group Filtering Profile ......................................... 15
NT/LDAP Member Filtering Profile...................................... 15
LDAP Container Filtering Profile ......................................... 16
Override Account Profile ..................................................... 16
Time Profile ......................................................................... 16
Lock Profile ......................................................................... 16
Filtering Profile Components ........................................................... 17
Library Categories . ................................................................... 18
8e6 Supplied Categories..................................................... 18
Custom Categories ............................................................. 18
Service Ports . ........................................................................... 19
Rules ........................................................................................ 19
Minimum Filtering Level ............................................................ 19
Filter Settings ............................................................................ 20
Filtering Rules ................................................................................. 21
Authentication Solutions .......................................................... 24
R3000 Authentication Protocols ...................................................... 24
R3000 Authentication Tiers and Options ........................................ 24
R3000 authentication tiers ........................................................ 24

CONTENTS
vi 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
R3000 authentication options . .................................................. 25
Authentication Solution Compatibility .............................................. 26
Authentication System Deployment Options ................................... 27
Ports for Authentication System Access ......................................... 28
Configuring the R3000 for Authentication ....................................... 29
Configuration procedures ......................................................... 29
System section.................................................................... 29
Group section...................................................................... 32
C HAPTER 2: N ETWORK S ETUP ........................................ 33
Environment Requirements ..................................................... 33
Workstation Requirements .............................................................. 33
Administrator ............................................................................ 33
End User ................................................................................... 34
Network Requirements .................................................................... 34
Set up the Network for Authentication ....................................35
Specify the operation mode ............................................................ 36
Specify the subnet mask, IP address(es) ........................................ 38
Invisible mode ........................................................................... 38
Router or firewall mode . ........................................................... 39
Enable authentication, specify criteria ............................................. 40
Net use based authentication ................................................... 42
Web-based authentication . ....................................................... 43
Enter network settings for authentication ........................................ 46
Create an SSL certificate ................................................................ 48
Create, Download a Self-Signed Certificate ............................. 49
Create, Upload a Third Party Certificate ................................... 50
Create a Third Party Certificate........................................... 50
Upload a Third Party Certificate ......................................... 52
Download a Third Party Certificate .................................... 53
View log results ............................................................................... 54
Specify block page settings ............................................................. 57
Block Page Authentication ........................................................ 58
Block page ......................................................................... 59
User/Machine frame ..................................................... 60
Standard Links.............................................................. 60
Optional Links............................................................... 61
Options page ...................................................................... 62
Option 1 ........................................................................ 63

CONTENTS
8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE vii
Option 2 ........................................................................ 64
Option 3 ........................................................................ 65
Common Customization ........................................................... 66
Enable, disable features ..................................................... 67
Authentication Form Customization .......................................... 69
Preview sample Authentication Request Form .................. 71
Block Page Customization ........................................................ 73
Preview sample block page ............................................... 75
Set up Group Administrator Accounts ...................................77
Add Sub Admins to manage groups, users ..................................... 77
Add a group administrator account ........................................... 78
Update the group administrator’s password ............................. 78
Delete a group administrator account ....................................... 79
C HAPTER 3: NT A UTHENTICATION S ETUP ........................ 80
NT Domain Setup ......................................................................80
Add an NT domain .......................................................................... 80
Refresh the NT branch .................................................................... 81
View or modify NT domain details ................................................... 82
Domain Settings ....................................................................... 82
Default Rule . ............................................................................. 84
Delete an NT domain ...................................................................... 85
Set up NT Domain Groups, Members ......................................86
Add NT groups, members to the tree .............................................. 86
Specify a group’s filtering profile priority ......................................... 88
Manually add a user’s name to the tree .......................................... 90
Manually add a group’s name to the tree ........................................ 91
Upload a file of filtering profiles to the tree ...................................... 92
C HAPTER 4: LDAP A UTHENTICATION S ETUP ................... 95
Create an LDAP Domain ...........................................................95
Add the LDAP domain ..................................................................... 95
Refresh the LDAP branch ............................................................... 96
View, modify, enter LDAP domain details ....................................... 97
LDAP Server Type .................................................................... 98
Group Objects .......................................................................... 99
User Objects . .......................................................................... 101

CONTENTS
viii 8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
Address Info ........................................................................... 102
Account Info ............................................................................ 105
SSL Settings ........................................................................... 107
Alias List ................................................................................. 109
Default Rule . ........................................................................... 111
LDAP Backup Server Configuration ................................. 113
Configure a backup server.......................................... 113
Modify a backup server’s configuration ...................... 118
Delete a backup server’s configuration....................... 118
Delete a domain ............................................................................ 119
Set up LDAP Domain Groups, Members ............................... 120
Add LDAP groups, users to the tree ............................................. 120
Perform a basic search ........................................................... 121
Options for search results ....................................................... 122
Apply a filtering rule to a profile .............................................. 122
Delete a rule ........................................................................... 123
Specify a group’s filtering profile priority ....................................... 124
Manually add a user’s name to the tree ........................................ 125
Manually add a group’s name to the tree ...................................... 126
Upload a file of filtering profiles to the tree .................................... 127
C HAPTER 5: A SSIGN /S ET UP G ROUPS , M EMBERS .......... 130
Assign Sub Admin to NT/LDAP Entity .................................. 130
Create and Maintain Filtering Profiles ...................................133
Add a group member to the tree list .............................................. 134
Add or maintain an entity’s profile ................................................. 135
Category Profile ...................................................................... 136
Redirect URL . ......................................................................... 139
Filter Options . ......................................................................... 140
Add an Exception URL to the profile ............................................. 141
URL entries ............................................................................. 142
Block URL frame . ................................................................... 143
ByPass URL frame ................................................................. 143
Apply settings ......................................................................... 143
Create a Time Profile for the entity ............................................... 144
Add a Time Profile .................................................................. 144
Remove an entity’s profile from the tree ....................................... 149

CONTENTS
8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE ix
C HAPTER 6: A UTHENTICATION D EPLOYMENT ................. 150
Test Authentication Settings ................................................. 150
Test Web-based authentication settings ....................................... 152
Step 1: Create an IP Group, “test” .......................................... 152
Step 2: Create a Sub-Group, “workstation” . ........................... 153
Step 3: Set up “test” with a 32-bit net mask ............................ 154
Step 4: Give “workstation” a 32-bit net mask .......................... 155
Step 5: Block everything for the Sub-Group . .......................... 156
Step 6: Use Authentication Request Page for redirect URL ...157
Step 7: Disable filter options ................................................... 158
Step 8: Attempt to access Web content . ................................ 159
Test net use based authentication settings ................................... 161
Activate Authentication on the Network ............................... 162
Activate Web-based authentication for an IP Group ..................... 163
Step 1: Create a new IP Group, “webauth” ............................ 163
Step 2: Set “webauth” to cover users in range . ...................... 164
Step 3: Create an IP Sub-Group . ........................................... 165
Step 4: Block everything for the Sub-Group . .......................... 167
Step 5: Use Authentication Request Page for redirect URL ...168
Step 6: Disable filter options ................................................... 169
Step 7: Set Global Group to filter unknown traffic . ................. 170
Activate Web-based authentication for the Global Group ............. 175
Step 1: Exclude filtering critical equipment ............................. 175
Step 1A: Block Web access, logging via Range to Detect . .... 176
Range to Detect Settings .................................................. 176
Range to Detect Setup Wizard ......................................... 178
Step 1B: Block Web access via IP Sub-Group profile . ........... 184
Step 2: Modify the Global Group Profile . ................................ 187
Activate NT authentication ............................................................ 191
Step 1: Modify the 3-try login script ........................................ 191
Step 2: Modify the Global Group Profile ................................. 192
C HAPTER 7: T ECHNICAL S UPPORT ................................ 194
Hours ........................................................................................ 194
Contact Information ................................................................ 194
Domestic (United States) .............................................................. 194
International .................................................................................. 194

CONTENTS
x8E6 TECHNOLOGIES, R3000 INTERNET FILTER AUTHENTICATION USER GUIDE
E-Mail ............................................................................................ 194
Office Locations and Phone Numbers .......................................... 195
8e6 Corporate Headquarters (USA) ....................................... 195
8e6 Taiwan ............................................................................. 195
Support Procedures ................................................................ 196
A PPENDIX A: A UTHENTICATION O PERATIONS ................ 197
Authentication Tier Selections ..............................................197
Tier 1: Net use based authentication ............................................ 197
Tier 2, Tier 3: Web-based authentication ...................................... 198
Tier 1: Single Sign-On Authentication .................................. 199
Net use based authentication process .......................................... 199
Re-authentication process . ..................................................... 201
Tier 1 authentication methods ....................................................... 201
SMB protocol .......................................................................... 201
SMB Signing ..................................................................... 201
LDAP protocol ........................................................................ 202
Name resolution methods ............................................................. 203
Configuring the authentication server ........................................... 204
Login scripts ........................................................................... 204
Enter net use syntax in the login script ............................. 204
View login script on the server console .................................. 205
Block page authentication login scripts ............................. 205
LDAP server setup rules ............................................................... 206
Tier 2: Time-based, Web Authentication ............................... 207
Tier 2 implementation in an environment ...................................... 208
Tier 2 Script . ........................................................................... 209
Tier 1 and Tier 2 Script . .......................................................... 210
Tier 3: Session-based, Web Authentication ......................... 212
8e6 Authenticator .................................................................... 213
Environment requirements ............................................................ 214
Windows minimum system requirements ............................... 214
Recommended system requirements ............................... 214
Macintosh minimum system requirements ............................. 215
Workstation requirements ............................................................. 215