Application Note

SSL312 VPN Concentrator: Integration with Microsoft

Active Directory

Summary

The SSL312 is a versatile tool that allows end users to connect to the corporate network

from any remote location with internet access. Since SSL is not VPN there is no need for

client software. The end user opens the desired application such as email, enters the user

name and password to authenticate, and a secure connection is created. This document

Even though, there are generic references to Active Directory procedures, it is

recommended to utilize a Microsoft technical training document for Active Directory

configurations. This document is not a good source for settings, configurations, or

troubleshooting Active Directory.

This document elaborates on and does not replace the NETGEAR® ProSafe® SSL VPN

Concentrator 25 SSL312 Reference Manual, sections 3 through 10. Windows Active

Directory is one of many authentication options on the SSL VPN concentrator. For more

options, please refer to the SSL 312 VPN Concentrator user manual on the NETGEAR

support site.

Active Directory is a centralized location for managing services, such as user

and Bookmarks for Active Directory users at the group level without needing to define

Active Directory users in the SSL VPN concentrator. Policies and Bookmarks provide

end users with access to company resources such as applications and servers. When a

user logs in, if no corresponding user name is configured on the local database, then SSL

VPN Concentrator will query the Active Directory server for the list of groups to which

the user belongs.

Once you create an Active Directory domain, you can add groups that correspond with

groups on your Active Directory server. If the Active Directory user is configured in the

SSL VPN concentrator, then the SSL VPN concentrator will ignore the AD group

information and, instead, implement policies and bookmarks based on the settings of the

2. Ensure that there is IP communication between the AD server and the SSL box. Do a

simple ping from the AD server to the SSL and from the SSL box using the

Diagnostics menu to ping the AD as well as a DNS lookup, if applicable.

Preliminary Configurations

There are a few procedures to configure in preparation for AD, which are Portal Layouts,

Groups, and User configurations. For detailed step-by-step procedures for configuring

Portal Layouts, Groups, and Users, please refer to the Reference Manual found on the

support site at http://kbserver.netgear.com/main.asp.

Portal Layouts

Portal Layouts allow you to create a custom page that remote users will see when they

Custom Portals are accessed at a different URL than the default portal. For example, if

your SSL VPN portal is hosted at https://vpn.company.com, and you created a portal

layout named “sales”, then users will be able to access the sub-site at

https://vpn.company.com/portal/sales.

Configuring Users and Groups

It is important to understand the policy hierarchy. There are Global Policies that apply to

all groups and users accessing the SSL VPN concentrator and Group Policies that apply

to all users. The following list describes the hierarchy:

User Policies take precedence over all Group Policies.

Group Policies take precedence over all Global Policies.

If two or more user, group, or global policies are configured, the most specific policy

all group policies and group policies take precedence over all global policies, regardless

of the policy definition. (A user policy that allows access to all IP addresses will take

precedence over a group policy that denies access to a single IP address).

SSL VPN concentrator groups are also defined using the Users and Groups menu.

To configure a group:

1. Under the Access and Administration menu in the left navigation pane, click Users

and Groups. The Add Group window displays for you to add your group.

2. In the Group Name field, enter the group name.

3. Select a domain from the Domains drop-down menu.

4. When you are finished, click Apply.

Domains then click Add Domain. The Add Domain window displays.

2. From the Authentication Type drop-down menu, select Active Directory. Fields

for Active Directory configuration display.

3. In the Domain Name field, enter a descriptive name for the authentication domain.

This is the same value as the Server Address field or the Active Directory Domain

field, depending on your network configuration.

4. In the Server Address field, enter the IP address or host name of the Active

Directory server.

5. In the Active Directory Domain field, enter the Active Directory domain name.

certificate must be generated by a certificate authority (CA). That is trusted by the

SSL VPN concentrator.

8. Click Apply to update the configuration. Once the domain has been added, the

domain displays in the table on the Domains screen.

Troubleshooting Tips

The time settings between the Active Directory server and the SSL VPN concentrator

must be synchronized. Kerberos authentication, used by Active Directory to authenticate

clients, permits a maximum of a 15-minute time difference between the Windows server

and client (the SSL VPN concentrator). The Easiest way to solve this issue is to configure

Network Time Protocol (NTP) on the Date and Time screen, and make sure that the

authentication. For Kerberos to work, the clock skew between the server (Windows) and

the client (SSL312) must be less than 60 minutes.

For NETGEAR FAQs please refer to the following links:

the following links:

SSL VPN concentrator at

http://tools.netgear.com/landing/2006/SSLVPN/index_eu.aspx?cid=70130000000GqmP

Support and documents at http://kbserver.netgear.com/main.asp

Conclusions

SSL312 VPN Concentrator can easily integrate with a wide variety of pre-existing

authentication methods, such as AD. Integration with AD saves the administrator time

and money by having a centralized location to manage all users. The SSL312 VPN

Concentrator allows end users to easily access company resources such as email and file

share. Since SSL is not VPN it is not necessary to install client VPN software which