ZyXEL Communications ZYWALL OTPV2 - Manual

ZyWALL OTPv2
Support Notes
Revision 1.10
December, 2010
Written by CSO

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
2
Table of Contents
1. Introduction....................................................................................................................................................... 3
2. Server Installation............................................................................................................................................. 7
2.1 Pre-requisites.......................................................................................................................................... 7
2.2 Installation on Windows Server 2003 Enterprise Service Pack 1 ...................................................... 7
2.3 Installation on Windows Server 2008 R2........................................................................................... 23
3. OTP Authentication to an OTP-protected Network via SSL VPN over ZyWALL USG................................. 42
3.1 ZyWALL USG Configuration ................................................................................................................. 43
3.2 SafeWord Server Configuration ........................................................................................................... 46
3.3 Verify OTP via Login from the Remote PC .......................................................................................... 50
4. OTP Authentication to an OTP-protected Network via IPSec VPN Client over the ZyWALL USG ............ 51
4.1 ZyWALL USG Configuration ................................................................................................................. 52
4.2 SafeWord Server Configurations ......................................................................................................... 55
4.3 ZyWALL IPSec VPN Client Configuration ............................................................................................ 59
4.4 Verify OTP via Login from the VPN Client........................................................................................... 61
5. OTP Troubleshooting...................................................................................................................................... 63

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
3
1. Introduction
One-Time Password (OTP) Authentication
One-Time Password (OTP) is an optimum security technology that enables a server to authenticate you
based on a password that is unique every time you try to access a protected network.
Two-Factor Authentication
Two-factor authentication is an optimum security methodology, because it requires something you have
(your ZyWALL OTP Token) and something you know (your secure password or PIN). A two-factor system
is far more secure than using just a password, since many skilled hackers can quite easily access
password-only protected computers and networks. The illustration shows the concept of Two-Factor
authentication.
User PIN and Token code
User PIN is what you know and Token code is what you have.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
4
ZyWALL OTP Products Components
ZyWALL OTP, which includes the ZyWALL OTP Token and SafeWord 2008, provides secure verification of
identity to remote Virtual Private Network (VPN) and Local Area Network (LAN) users.
SafeWord 2008 installation includes:
-SafeWord Core Server
Database server
Administration server
Authentication engine
-Management console (integrated in Windows Server AD)
-RADIUS Agents (IAS clients)
SafeWord Core Server
The SafeWord Core Server consists of 3 main components:
-Database server (MySQL) –installed by default. The SafeWord database serves as the repository for
token records independent of the management mode. It stores the Token serial numbers and Token
seed used to generate OTP. The database server listens on port 5010 by default and only the
Administration service and Authentication engines can query it directly.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
5
-Administration server –runs administration services and performs tasks initiated by administrators
or users. Updates the SafeWord database and synchronizes SafeWord database data in configurations
with MMC console and User Center. Also performs replication of changes between peers. It is listening
on port 5040 by default.
-Authentication engine (AAA) –runs the authentication engine that verifies that the passcode supplied
with an access request is correct for the token assigned to a specific user. It listens on port 5031 by
default.
Management Console (AD)
The Management console integrated in Microsoft AD is the interface used to directly update the database
via the SafeWord Administration Service.
You can use this to import Tokens (add Token serial numbers to SafeWord database) or backup and
restore Token data.
It also lets you view and manage all imported Tokens.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
6
RADIUS Agent
The OTP RADIUS agent contains a configuration file specifying where the SafeWord server holds the user
repository and the Authentication service. It verifies that the passcode supplied with an access request is
correct for the token assigned to a specific user.
An agent can be installed only if it is supporting (base) software components exist. Otherwise the agent
will not appear for selection in the installation components window. For example, the RADIUS server
agent can only be installed when the IAS has already been set up.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
7
2. Server Installation
2.1 Pre-requisites
Before starting to install the SafeWord server, user needs to verify:
-Hardware requirements of the system
CPU –Pentium IV or AMD @ 1.8 GHz (min), 2 GHz (recommended)
RAM –1 GB (min), 4 GB (recommended)
Disk space –3 to 5 GB (min)
-Software requirements of the system
Server OS –32 or 64-bit Windows Server 2003/2008 or Windows Server 2008 R2
Have a working Active Directory environment
Have IAS server installed for RADIUS authentication
2.2 Installation on Windows Server 2003 Enterprise Service Pack 1
Step1. Prepare the Active Directory
-Click on Start > Manage Your Server to open the installation wizard. Click “Add or remove a role”to
configure it.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
8
-Select to install the Domain Controller (Active Directory).
-Fill in the full DNS name for the new domain.
-Click Next to continue the installation process. When the process is done, Active Directory will be
installed and ready.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
9
Step2. Prepare the IAS Server
-Click Start > Control Panel > Add or Remove Programs > Windows Components Wizard > Networking
Services > Internet Authentication Service to install the component.
-After the installation, you can execute it through Start > Administrative Tools > IAS.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
10
Step3. Check pre-requisites before Install
Network prerequisites:
-32 or 64-bit Windows Server 2003 with Service Pack 1.
Note: Windows 2008 Core is not supported. Windows 2003/2008 Small Business Server is not supported.
-Active Directory populated with users.
Note: A Domain Controller is required for use with Active Directory.
-Internet access (to receive important product updates not on your installation CD)
Component prerequisites:
-Active Directory Users and Computers Management Console
.Net Framework 2.0 or greater installed
This component is only available when the installation machine is part of a domain
MMC 3.0 or greater installed (for Server 2003, user can download it from http://support.microsoft.com/kb/907265)
Note: Port 5040 must be open between the remote ADUC server and the server running the Admin Service. You may customize
this port.
-IAS/NPS Agent
IAS must be functioning and configured for RADIUS authentication (policies, secret keys, firewall ports, and user
permissions must be set correctly, and users must be able to successfully authenticate to IAS) before installing this
Agent.
Port 1812 must be open in any firewalls between the RADIUS clients and the IAS Server.
Step4. Install SafeWord 2008 server
In this section, we will walk through the system installation process. For the up to date user manuals,
please check SafeNet’s website. The link is: http://www.aladdin.com/safeword/docs/2008.aspx
Below is a flow chart-type snapshot of the installation process and the step-by-step installation. Users
can check for more detailed information in chapter 2 “Installing and Activating SafeWord 2008”of
SafeWord 2008 Administration Guide on the SafeNet website.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
11

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
12
1Insert the CD and select to Install SafeWord 2008.
2Enter your product serial number (located on your product package and/or on the Activation
Certificate is in the format NSXX-XXXX-XXXX-XXXX), then click OK.
3If there is a new version available, the software will download it automatically during the installation
process.
4Review the License Agreement, then click Yes to accept it.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
13
5When the Choose Destination Location window appears, accept the default installation location (or
browse to select another), then click Next. If you choose to install in a location different than the
default location, you must ensure that the following permissions are set:
• Administrators – full control
• Authentication users – read and execute
• CREATOR OWNER – full control (subfolders and files only)
• Server Operators – modify
• SYSTEM – full control
6The Select Components window for the specific version of SafeWord you selected appears.
In the ZyXEL pack, user needs to select the components as below:
-SafeWord Server
-Management Snap-in for Active Directory
-IAS-NPS (RADIUS) Agent
Note: Only components that can be installed on your system will display. If any of the above components doesn’t display, please check the
pre-requisites.
7Make your selections, and then click Next.
8Make any needed changes in the Select Program Folder window, then click Next.
9Review the information in the Start Copying Files window, then click Next.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
14
10 Select the preferred user management. Here leave the default setting “I will manage users in Active
Directory”, then click Next.
11 The Server Components window appears with the default ports through which SafeWord components
will communicate. Accept the default port settings or specify your own port settings. You will also be
personalizing your SafeWord installation by defining a unique Encryption Key and Signing Key on the
Database Security pane. Each key must be16 characters in length, and must remain the same for the
life of the installation. Click Next when all needed changes have been made.
Tip: A small exclamation point displayed next to a Port field indicates that port is already in use by another process, and you must select a
different port.
12 When the Host Address window appears, enter the Fully Qualified Domain Name to which this
machine belongs, and then click Next. If you do not know the domain, click Query to obtain it from
your DNS Server.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
15
13 If your SafeWord Server is not being installed on a Domain Controller, you will be prompted to
provide the administrator’s credentials for the machine on which the SafeWord Server is to be
installed, then click Next.
14 If you selected the IAS Agent for installation on Server 2003, you will be prompted to restart the IAS
service by clicking Yes. If installing on Server 2008, the Restart window will not appear, and you may
skip to “Finishing the installation”.
15 During installation, windows will appear and disappear, and the installation will take several minutes
to complete. The InstallShield Wizard Complete window appears when the installation is finished.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
16
16 After the software installation is complete, go to Services to Start the SafeWord User Center service.
17 User can verify the server status to make sure the installation is correct. Click Start > Aladdin >
SafeWord > Configuration > Server Configuration to enable the Utility.
18 Status of all the server components should be “Active” for a successful installation.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
17
Step5. Activate SafeWord 2008 server
The Activation Certificate that came with your software contains the SafeWord 2008 Serial number and
Token Group ID that allow you to download the activation key and token data records, and are in the
following formats:
• SafeWord Software Serial Number—The serial number is a 16-digit alphanumeric code in the form of
this example:
NSxx-xxxx-xxxx-xxxx. You will need the serial number to obtain your product activation key.
• Token Group ID—Your Token Group ID is a 16-digit alphanumeric code in the form of this example:
TKxx-xxxx-xxxx-xxxx.
Registering on the portal:
There are two methods of activating SafeWord 2008: using ADUC, or directly from Aladdin’s Website if
not using ADUC. In either case, you must sign in and register on the Aladdin portal at
https://portal.aladdin.com, before you can complete and submit an activation form. After activating, your
information will be verified, and the activation key and token records will be downloaded automatically
for ADUC, and manually if you are not using ADUC.
Activation using ADUC:
1In ADUC, click on the SafeWord folder. The first time you right-click on the SafeWord folder, you will be
prompted to enter and re-enter (to verify) an Administrator password. This Administrator password is
not your Windows Administrator password. If you have (or plan to have) multiple management
consoles, you must use the same Administrator password for all installations.

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
18
2Click OK when done.
3Right-click on the SafeWord folder and select Activate Product.
4Log into the portal using the credentials received in your mail when you registered.
5Enter the Software Serial Number and the Token Group ID(s) (if you are importing token records) for
the product you are activating. E.g.: Activation Software Serial Number example:
NSXX-XXXX-XXXX-XXXX, Token Group ID example: TKXX-XXXX-XXXX-XXXX.
6Complete the activation form, then click Submit.
7The SafeWord Activation window appears showing the license activation and token import progress.
Upon completion, the activation file key.html is downloaded to
<Install_Dir>\Aladdin\SafeWord\ImportData. This is the key to activate your software and your token

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
19
data records. You should back up these files in case you need to reactivate the product or re-import
token records later. The Administration Server and Authentication Engine services will restart.
8When the activation and authentication process is complete, click OK.
9The Activations Complete window displays with important download and installation information. To
manually save the files from this window, right click on each file name, and then select the Save Target
As option.
10You should verify that the key.activated.html file is located on the SafeWord server by browsing to
<Install_Dir>\SERVERS\AdminServer\activation.
11If you are also importing token records, ensure that the token(s) were successfully imported into the
SafeWord database by opening ADUC and then expanding the SafeWord Node. The Tokens sub-folder
will display with the imported tokens.
12If the key.activated.html file exists, the activation is complete. If the file does not exist, please refer to
the manual activation process.
Activating manually via Website:
If you don’t use ADUC to activate SafeWord server, you might need to activate it manually. For off-line
activation, two files are provided to the customer upon purchase of tokens:
-Server license - a software activation file ( key.html ) that includes an activation key. This key should be
entered in place of the software serial ID.
-An import file containing the serial numbers of the tokens bought by the customer ( import*.dat ).
1If you are simply obtaining the latest activation package (key.html file + import*.dat), please jump to
11 and continue. If you want to download the activation package for your customers to use, please
create the RCR.txt file first and follow below steps for it. The process for creating RCR.txt file is

ZyXEL –ZyWALL OTPv2 Support Notes
All contents copyright © 2010 ZyXEL Communications Corporation.
20
described below.
A.On the SafeWord installation server, select Start > Programs > Aladdin > SafeWord > Active
Directory Users and Computers.
B.Right-click the SafeWord folder in the left directory tree and select Support.
C.Click the Save button to automatically save the RCR.txt file to a temporary directory.
2Log into the Portal (http://partner.safenet-inc.com) using the user name and password you received
during registration.
Note: You may be required to create a login at your first visit to the activation site.
3Click the SafeWord Activation link on the left pane of the window. The SafeWord Activations page
appears.
4Enter your product SafeWord Software Serial Number in the SafeWord SoftWare Serial Number field.
For example: NSXX-XXXX-XXXX-XXXX.
5Click the Continue button. The SafeWord Activation page appears.
6Click the Browse button and retrieve the RCR.txt file you saved earlier in this process. The file name
displays in the Support Data File field.
7Enter the product Token Group ID in the Token Group ID field.
8Scroll down to the bottom of the page and click Submit.
9You can now download the files that contain the key to activate your software and your token data
records. You should backup these files in case you need to reactivate the product or re-import token
records later.
10Right click on each link and select the Save Target As option. Save the files on to the SafeWord Server
and unzip them.
11Rename the license file to key.html. (For example, change the name from NSxx-xxxx-xxxx-xxxx.html to
key.html)