This article describes how to configure a F5® FirePass SSL VPN device to authenticate users against an ESA Server. Before proceeding, verify that you've installed the RADIUS Server component of ESET Secure Authentication and can access the RADIUS service that allows external systems to authenticate users.
Before your F5® FirePass SSL VPN device can use the ESA Server to authenticate users via RADIUS, it must be set up as a RADIUS client on the ESA Server. Next, your server running the ESA RADIUS service must be setup as a RADIUS Server on the F5® FirePass SSL VPN device. Once these configurations have been specified, you can start logging into your F5® FirePass SSL VPN device using ESA OTPs.
Step I - RADIUS client configuration
To allow the F5® FirePass SSL VPN device to communicate with your ESA Server, you must configure the F5® FirePass SSL VPN device as a RADIUS client on your ESA Server:
- Launch the ESA Management Console (found under Administrative Tools).
- Navigate to RADIUS Servers and locate the hostname of the server running the ESA RADIUS service.
- Right-click the hostname and select Add Client from the context menu.
- Configure a RADIUS client (see Figure 1-1).
- Click OK - you will be prompted to restart the RADIUS Service, do so from the Services control panel.
ESA has now been configured to communicate with the F5® FirePass SSL VPN device. You must now configure the F5® FirePass SSL VPN device to communicate with the ESA Server.
Step II - Configure your F5® FirePass SSL device
Follow the steps below:
- Login to your F5® FirePass SSL administrative interface.
- Click Users.
- Click Groups → Master Groups → Create New Group (or modify an existing group)
- Set the following parameters to the values shown below:
- Group Name: ESA
- Users in group: external
- Authentication method: RADIUS
- Click Create.
- Navigate to the Authentication tab for your new group and set the following parameters to the values shown below:
- Timeout: 30
- Retries: 2
- Server: The IP address of your ESA RADIUS server
- Port: 1812
- Shared Secret: The shared secret from your RADIUS server configuration (see Figure 1-1)
- Confirm Shared Secret: Repeat the shared secret
- Click Save Settings
Step III - Test the connection
To test the newly configured connection:
- Navigate to the URL that you normally use for SSL VPN logins with your F5® FirePass SSL VPN appliance.
- Enter the credentials of your test user. Ensure that you are using an account with Mobile Application 2FA using ESA enabled. When prompted for a password, append the OTP generated by the Mobile Application to your AD password. For example, if the user has an AD password of Esa123 and an OTP of 999111, you should type Esa123999111.
If you are unable to authenticate via the ESA RADIUS server, make sure that you have performed the following steps:
- Run a smoke test against your RADIUS server, as per the Verifying ESA RADIUS Functionality.
- If no faults were fixed and you are still unable to connect, revert to an existing sign-in configuration that does not use 2FA and verify that you are able to connect.
- If you are able to connect using the old settings, restore the new settings and verify that there is no firewall blocking UDP 1812 between you VPN device and your RADIUS server.
- If you are still unable to connect, contact ESET technical support.