Microsoft Entra ID Users with WatchGuard Access Portal Integration Guide

Deployment Overview

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, go to the documentation and support resources for that product.

This document describes how to configure the WatchGuard Access Portal to integrate with Microsoft Entra ID users.

Contents

• Microsoft Entra ID Users with WatchGuard Access Portal Integration Guide
• • Deployment Overview
  • Contents
  • Integration Summary
  • Topology
  • Before You Begin
  • Configure Microsoft Entra Domain Services
  • • Configure Secure LDAP
    • Configure a Security Rule in Microsoft Azure
    • Add Microsoft Entra ID Group and User
  • Configure the Firebox
  • • Configure Active Directory Authentication
    • Configure the Access Portal
  • Test the Integration

Topology

This topology diagram shows the data flow for Microsoft Entra ID authentication with a WatchGuard Firebox and Microsoft Entra Domain Services.

Before You Begin

Before you begin these procedures, make sure that:

• You have an Microsoft Azure global administrator account within the Microsoft Entra ID tenant.
• You have an active Microsoft Azure subscription.
• You have created and configured Microsoft Entra Domain Services.
  
• You have a Firebox feature key with an Access Portal license.

Additional charges might apply for the use of Microsoft Azure. To learn more about Microsoft Azure, go to What is Microsoft Entra Domain Services.

Configure Microsoft Entra Domain Services

The steps in this section describe how to configure Microsoft Entra Domain Services.

Configure Secure LDAP

To configure Secure LDAP:

1. Log in to the Azure portal with your Microsoft Azure account credentials.
2. From Search, type Microsoft Entra Domain Services.
3. Enter the created Managed Domain.
   

4. Select Settings > Secure LDAP.
5. Enable the Secure LDAP toggle.
6. Enable the Allow secure LDAP access over the internet toggle.
7. Next to the .PFX file with secure LDAP certificate text box, click the folder icon and upload your certificate. For information about how to create and export the certificate, go to Configure Secure LDAP in the Microsoft documentation.
8. In the Password to decrypt .PFX file text box, type the password.

9. Click Save.

10. Click Properties.
11. Copy the Secure LDAP external IP addresses value. You need this information when you configure the Firebox.

Configure a Security Rule in Microsoft Azure

To configure a security rule in Microsoft Azure:

1. On the Microsoft Azure home page, from Search, type Resource groups.
2. Select your Microsoft Entra Domain Services resource group.
3. Select the Network security group.

4. Select Settings > Inbound security rules > Add.
5. From the Source drop-down list, select IP Addresses.
6. In the Source IP addresses/CIDR ranges text box, type the public IP address or range for your environment.
7. In the Source port ranges text box, type *.
8. From the Destination drop-down list, select Any.
9. From the Service drop-down list, select Custom.
10. In the Destination port ranges text box, type 636.
11. For Protocol, select TCP.
12. For Action, select Allow.
13. In the Priority text box, type a number between 100 and 4096. In our example, we type 311.
14. In the Name text box, type a name.
15. Click Add.

Add Microsoft Entra ID Group and User

To add an Microsoft Entra ID group and user:

1. On the Microsoft Azure home page, from Search, type Microsoft Entra ID.
2. Select Manage > Groups.
3. Click New group.
4. From the Group type drop-down list, select Security.
5. In the Group name text box, type a group name.
6. From the Membership type drop-down list, select Assigned.

7. Click Create.
8. To add a user, select Manage > Users.
9. Click + New user > Create new user and enter your user information.
   

10. Assign the user to the group created previously.
    One or more roles can be assigned to this user. In this example, we select user administrator.
    

11. Click Review + create.
12. Click Create.

For cloud-only user accounts, users must change their passwords before they can use Microsoft Entra Domain Services. The password change process causes the password hashes for Kerberos and NTLM authentication to be generated and stored in Microsoft Entra ID. The account is not synced from Microsoft Entra ID to Microsoft Entra Domain Services until the password is changed. It might take a few minutes after the password change before the new password can be used in Microsoft Entra Domain Services.

Configure the Firebox

The WatchGuard Access Portal is a subscription service and needs an active license applied in your Firebox feature key before you can configure it on your Firebox.

You must configure the Active Directory authentication settings and enable Access Portal.

Configure Active Directory Authentication

To configure Active Directory authentication:

1. Log in to Fireware Web UI (https://<your Firebox IP address>:8080).
2. Select Authentication > Servers.
   The Authentication Servers page opens.

3. From the Authentication Servers list, click Active Directory.
   The Active Directory page opens.
4. Click Add.
5. Click Next.
6. In the Domain Name text box, type the domain name. You cannot change the domain name after you save the settings.

7. Click Next.
8. In the Server Address text box, type or paste the secure LDAP external IP address you copied in the previous section.
9. Select the Enable secure SSL connections to your Active Directory server (LDAPS) check box.

10. Click Next.
11. Click Finish.

Configure the Access Portal

To configure users and groups:

1. Select Authentication > Users and Groups.
2. Click Add. You can add a user or a group. This example adds a group.
   The Add User or Group window opens.
3. For Type, select Group.
4. In the Name text box, type a name for the group. The name of this group must match the name of the Microsoft Entra ID group your users belong to.

   If you add a user, the name of the user must be the same as the name of the Microsoft Entra ID user.

5. From the Authentication Server drop-down list, select the authentication server you configured.
6. Click OK.

7. Click OK.
8. Click Save.

To configure the Access Portal:

1. Select Subscription Services > Access Portal.
2. Select the Enable Access Portal check box.
3. To add an application, in the Applications section, click Add. In our example, add a Web Application.

4. In the Name text box, type a description name.
5. In the URL text box, type the URL address.
6. Click OK.
   

7. Select the User Connection Settings tab.
8. In the Authentication Servers section, from the Authentication Server drop-down list, select the authentication server you created.
9. Click Add.
10. In the Authentication Server list, select your authentication server.
11. To make this authentication server the default server, click Move Up until the server appears at the top of the list.
    

12. (Optional) To give all users and groups permission to connect to all applications, in the User Access section, select All applications are available to all users and groups authenticated with the Access Portal. To specify which users and groups can access which applications, select Specify the applications available to each user and group.
13. Click Add.
14. From the Authentication Server drop-down list, select the authentication server you created.
15. From the Type drop-down list, select Group.
16. In the Name text box, type the group name. The name of this group must be the same as the name of the Microsoft Entra ID group your users belong to.
17. Select the applications that are available to this group.

18. Click OK.

19. Click Save.

Test the Integration

To test the integration of Microsoft Entra ID users and the WatchGuard Access Portal:

1. In a browser, go to https://<Firebox external IP address or FQDN>.

2. Type your Microsoft Entra ID user name and password.
3. Click Log In.
   You are logged in successfully, the user can get access to the resource.