SecureW2 and Wi-Fi in WatchGuard Cloud Integration Guide

Deployment Overview

This guide demonstrates how to integrate Wi-Fi in WatchGuard Cloud with SecureW2 authentication for users to authenticate and receive certificates for WPA2 Enterprise EAP-TLS Wi-Fi access.

Test Topology

SecureW2 JoinNow MultiOS Management Portal interacts with the WatchGuard AP330 access point through policies to end users.

SecureW2 Network Profile and RADIUS

Use the Device Onboarding section in the SecureW2 console to acquire the RADIUS information.

1. Log in to the SecureW2 JoinNow MultiOS Management Portal and select Device Onboarding > Getting started.
2. In the Quickstart Network Profile generator section, from the Profile Type drop-down list, select Wireless.
3. In the SSID text box, type the SSID for the network that you want to secure with TLS.
4. From the Security Type drop-down list, select WPA2-Enterprise.
5. From the EAP Method drop-down list, select EAP-TLS.
6. From the Policy drop-down list, select Default.
7. From the Wireless Vendor drop-down list, select WatchGuard.
8. From the RADIUS Vendor drop-down list, select SecureW2.
9. Click Create.
   The Network Profiles page appears. This process may take several minutes.
   

10. Select AAA Management > AAA Configuration.
11. Note the RADIUS Authentication Port, Primary IP Address, and the Shared Secret.

You will use this information in the WatchGuard Cloud configuration.

WatchGuard Cloud Configuration

For detailed information on Wi-Fi in WatchGuard Cloud deployment, see Get Started with Wi-Fi in WatchGuard Cloud.

Access points can have two different types of settings:

• Device-level settings — Settings that you apply individually to each access point.

• Access point site settings — Access point sites enable you to create SSID settings and apply them to multiple access points that subscribe to the site.

Configure SecureW2 RADIUS Information for EAP-TLS in WatchGuard Cloud

1. Log in to your WatchGuard Cloud account. If you have a Service Provider account, you must select a subscriber account from the Account Manager.
2. Select Configure > Authentication Domains.
3. Click Add Authentication Domain.
4. In the Domain Name text box, type a domain name.
5. Click Next.
6. In the Add servers section, select RADIUS.
7. From the Type drop-down list, select Host IPv4.
8. In the IP Address text box, type the Primary IP Address of the RADIUS server from SecureW2.
9. In the Port text box, type the authentication port number for the RADIUS server from SecureW2.
10. In the Shared secret text box, type the shared secret from the SecureW2 RADIUS server.
11. In the Confirm shared secret text box, type the shared secret from the SecureW2 RADIUS server.

12. Click Save to save the Authentication Domain settings.
13. Click Done.

Configure the Authentication Domain and SSID Settings for an Access Point (Device Level Configuration)

To configure Authentication Domain and SSID settings for a single access point at the device level configuration:

1. From WatchGuard Cloud, select Configure > Devices.
2. Select your Access Point.
3. Select Device Configuration.
4. In the Authentication tile, click Domains.
5. Click Add Authentication Domain.
6. From the Select an existing Authentication Domain drop-down list, select the domain you created in the previous section.
7. From the RADIUS Server drop-down list, select the RADIUS server.

8. Click Save to save the Authentication Domain settings.
9. Click Back to return to the configuration settings.
10. Click SSIDs.
11. Click Add SSID.
12. In the SSID Name text box, type the SSID name.
13. Select the Broadcast SSID check box.
14. From the SSID Type drop-down list, select Private.
15. From the Radio drop-down list, select 2.4 GHz and 5 GHz.
16. From the Security drop-down list, select WPA2 Enterprise.
17. From the Authentication Domain drop-down list, select the domain you created in the previous section.
18. In the Network section, select Bridged.

19. Click Save.
20. Click Schedule Deployment.
21. Select Deploy changes now.
22. In the Description text box, type a description for the deployment.

23. Click Deploy.

Configure the Authentication Domain and SSID Settings for an Access Point Site

To configure Authentication Domain and SSID settings and apply the configuration to multiple access points with an Access Point Site:

1. From WatchGuard Cloud, select Configure > Access Point Sites.
2. Click Add Site.
3. In the Name text box, type a name for the site.
4. Click Add.

5. In the Authentication tile, click Domains.
6. Click Add Authentication Domain.
7. From the Select an existing Authentication Domain drop-down list, select the domain you created in the previous section.
8. From the RADIUS Server drop-down list, select the RADIUS server.

9. Click Save to save the Authentication Domain settings.
10. Click Back to return the site configuration settings.
11. Click SSIDs.
12. Click Add SSID.
13. In the SSID Name text box, type the SSID name.
14. Select the Broadcast SSID check box.
15. From the SSID Type drop-down list, select Private.
16. From the Radio drop-down list, select 2.4 GHz and 5 GHz.
17. From the Security drop-down list, select WPA2 Enterprise.
18. From the Authentication Domain drop-down list, select the domain you created in the previous section.
19. In the Network section, select Bridged.

20. Click Save.
21. Click Schedule Deployment.
22. Select Deploy changes now.
23. In the Description text box, type a description for the deployment.
24. Click Deploy.
25. Click Close.
26. Click Back to return to the site configuration settings.
27. Select the Subscribed Devices tab.

28. Click Select Devices.
29. Select the access points to subscribe to the site.
30. Click Save.

Configure the WatchGuard Firebox for SecureW2 Access to Active Directory

SecureW2 connects to Active Directory at its public IP address 52.41.166.6 on port 389. You can also use port 636 for secure access.

1. Log in to your WatchGuard Firebox.
2. From Fireware Web UI, select Firewall > SNAT > Add.
3. In the Name text box, type a name for the SNAT configuration.
4. For Type, select Static NAT.
5. In the SNAT Members section, click Add.
6. From the IP Address or Interface drop-down list, select Any-External, External, or a public IP address.
7. From the Choose Type drop-down list, select Internal IP Address.
8. In the Host text box, type the private address of the Active Directory server.

9. Click OK to add the member.
10. Click Save.
11. Select Firewall > Firewall Policies > Add Policy.
12. Select Custom then Click Add.

13. Type a Name and Description.
14. Select Packet Filter.
15. Add TCP port 389.

16. Click Save. You are redirected to the Select a policy type page with your new custom policy selected in the drop-down list.
17. Click Add Policy to continue with the policy creation.
18. In the From field, remove Any-Trusted.
19. Click Add.
20. From the Member type drop-down list, select Host IPv4.
21. Type the SecureW2 public IP address 52.41.166.6.
22. Click OK.
23. In the To field, remove Any-External.
24. Click Add.
25. From the Member type drop-down list, select Static NAT.
26. Select the SNAT configuration you created in the previous section.
27. Click OK.

28. Click Save.

Create a Wi-Fi Authentication Group in Active Directory

A Security Group is created in the Active Directory to connect the user to the SecureW2 Authentication Policies, User Role Policies, and Enrollment Policies.

1. From Windows Server 2019, open Server Manager.
2. Select Tools > Active Directory Users and Computers.
3. Expand the domain and right-click Users, then select New > Group.
4. In the Group name text box, type the name of the security group associated with the users.
5. In the Group name (pre-Windows 2000) text box, type the same name.
   This text box might already be pre-defined with the correct name.
6. In the Group scope section, select Global.
7. In the Group type section, select Security.

8. Click OK.
9. Double-click the name of the new security group.
10. Select the Members tab.
11. Click Add.
12. Type the full name of each user.
13. Select Check Names to verify, then click OK to submit.

14. Click OK.

Configure SecureW2 for Active Directory Queries

1. From the SecureW2 Management Portal, select Identity Management > Identity Providers.
2. Click Add Identity Provider.
3. Type a Name and Description.
4. From the Type drop-down list, select LDAP.
5. Click Save.

6. In the Subject Name Attribute text box, type the subject name attribute.
   • sAMAccountName — Use this attribute deploy a simple user name login.
   • userPrincipalName — Use this attribute for the format [email protected].

7. Click Update.
8. Edit the Identity Provider you created, then select the Connections tab.
9. Click Add Connection.
10. In the Name text box, type the name of the IDP connection.
11. In the Hostname text box, type the public IP Address.
    In this example, we use the public IP address of the WatchGuard Firebox.
12. In the Port text box, type 389. If the connection is secured with a certificate, select the TLS/SSL check box to change the port number to 636. Upload a server self-signed certificate for LDAP over SSL.
13. Select Admin.
14. In the Admin DN text box, type the administrator of the Active Directory server.
15. In the Admin Password text box, type the password of the administrator account.
16. To retrieve and select a Subject Base DN from the Active Directory, click Naming Contexts, then select or type the Subject Base DN.
17. To retrieve and select a Group Base DN from the Active Directory, click Naming Contexts, then select or type the Group Base DN.
18. In the Server timeout text box, type 30.

19. Click Test Connection.

20. Click OK.
21. Click Update.
22. Select the Attribute Mapping tab.
23. Click Add.
24. In the Local Attribute text box, type displayName.
25. From the Remote Attribute drop-down list, select USER_DEFINED, then in the adjacent text box, type displayName.

26. Click Next.
27. Click Add.
28. In the Local Attribute text box, type upn.
29. From the Remote Attribute drop-down list, select USER_DEFINED, then in the adjacent text box, type userPrincipalName.
30. Click Next.
31. Click Add.
32. In the Local Attribute text box, type email.
33. From the Remote Attribute drop-down list, select USER_DEFINED, then in the adjacent text box, type mail.
34. Click Next.
35. Select the Groups tab.
36. Click Add.
37. In the Local Group text box, type the local group name.
38. In the Remote Group text box, type the group attribute received from IDP.
    This remote attribute is mapped to the local attribute. This value for Remote Group is case-sensitive.

39. Click Next.
40. Click Update.

Configure the SecureW2 Authentication Policy

The SecureW2 Authentication Policy defines the protocols that the JoinNow MultiOS uses to communicate with the devices and assign the Identity Provider.

1. From the SecureW2 JoinNow MultiOS Management Portal, select Policy Management > Authentication.
2. Click Edit on the auto-created Authentication Policy.
3. Select the Settings tab.
4. From the Identity Provider drop-down list, select the Identity Provider you created.
5. Click Update.

Configure the SecureW2 User Role Policy

1. From the SecureW2 JoinNow MultiOS Management Portal, select Policy Management > User Roles.
2. Click Edit on the Default Role Policy 1.
3. Select the Conditions tab.
4. From the Identity Provider drop-down list, select the configured identity provider.

5. Click Update.

Configure the SecureW2 Enrollment Policy

1. From the SecureW2 JoinNow MultiOS Management Portal, select Policy Management > Enrollment.
2. Select Edit on the Default Enrollment Policy 1.
3. On the Conditions tab, from the User Role and Device Role drop-down list, select the default role and default device policies.

4. Click Update.

Republish the SecureW2 Network Profile

1. From the SecureW2 JoinNow MultiOS Management Portal, select Device Onboarding > Network Profiles.
2. In the Functions column, click Re-publish.
3. In the Name text box, type a name for the profile.

4. Click OK.
   This process may take several minutes.
5. In the Functions column, click View, and copy the URL. You will use the URL in the Test a Wireless Client section.
   

If you use a local identity provider, you can create the user directly on SecureW2 and you do not need to republish the network profile.

Test a Wireless Client

1. Open a web browser, then go to the SecureW2 URL you retrieved in the Republish the SecureW2 Network Profile section.

2. Click JoinNow.
3. Run the downloaded application. Click Next.
4. Type the Username and Password. Click Next.

The user is automatically redirected to the EAP-TLS wireless connection.