Main Menu
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Events
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
SonicWall
  • Products
      All Products A–Z
      Free Trials
    • Network Security
      • Next-Generation Firewall (NGFW)
      • Network Security Services
      • Network Security Management
      • Secure SD-WAN
    • Threat Protection
      • Advanced Threat Protection Cloud
      • Advanced Threat Protection Appliance
      • Capture Labs
    • Secure Access Service Edge (SASE)
      • Zero-Trust Network Access (ZTNA)
    • Cloud Security
      • Cloud Firewall
      • Cloud App Security
    • Endpoint Security
      • Endpoint Detection & Response (EDR)
    • Email Security
      • Cloud Email Security
      • Hosted Email Security
      • On-Prem Email Security
    • Secure Access
      • Wireless Access Points
      • Network Switch
      • Virtual Private Network (VPN)
    • Wi-Fi 6 Access Points

      SonicWall SonicWave 600 series access points provide always-on, always-secure connectivity for complex, multi-device environments.

      Read More
  • Solutions
    • Industries
      • Distributed Enterprises
      • Retail & Hospitality
      • K-12 Education
      • Higher Education
      • State & Local
      • Federal
      • Healthcare
      • Financial Services
      • Carriers
    • Use Cases
      • Secure SD-Branch
      • Network Segmentation
      • Zero Trust Security
      • Secure SD-WAN
      • Office 365 Security
      • SaaS Security
      • Secure Wi-Fi
    • Solutions Widgets
      • Solutions Content Widgets
        Federal

        Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions

      • Solutions Image Widgets
  • Partners
    • SonicWall Partners
      • Partners Overview
      • Find a Partner
      • Authorized Distributors
      • Technology Partners
    • Partner Resources
      • Become a Partner
      • SonicWall University
      • Training & Certification
    • Partner Widgets
      • Custom HTML : Partners Content WIdgets
        Partner Portal

        Access to deal registration, MDF, sales and marketing tools, training and more

      • Partners Image Widgets
  • Support
    • Support
      • Support Portal
      • Knowledge Base
      • Technical Documentation
      • Community
      • Video Tutorials
      • Product Life Cycle Tables
      • Partner Enabled Services
      • Contact Support
    • Resources
      • Resource Center
      • Events
      • Free Trials
      • Blog
      • SonicWall University
      • MySonicWall
    • Capture Labs
      • Capture Labs
      • Security Center
      • Security News
      • PSIRT
      • Application Catalog
    • Support Widget
      • Custom HTML : Support Content WIdgets
        Support Portal

        Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials

      • Support Image Widgets
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Events
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
  • Contact Sales
  • English English English en
  • BLOG
  • CONTACT SALES
  • FREE TRIALS
  • English English English en
SonicWall
  • Products
      All Products A–Z
      Free Trials
    • Network Security
      • Next-Generation Firewall (NGFW)
      • Network Security Services
      • Network Security Management
      • Secure SD-WAN
    • Threat Protection
      • Advanced Threat Protection Cloud
      • Advanced Threat Protection Appliance
      • Capture Labs
    • Secure Access Service Edge (SASE)
      • Zero-Trust Network Access (ZTNA)
    • Cloud Security
      • Cloud Firewall
      • Cloud App Security
    • Endpoint Security
      • Endpoint Detection & Response (EDR)
    • Email Security
      • Cloud Email Security
      • Hosted Email Security
      • On-Prem Email Security
    • Secure Access
      • Wireless Access Points
      • Network Switch
      • Virtual Private Network (VPN)
    • Wi-Fi 6 Access Points

      SonicWall SonicWave 600 series access points provide always-on, always-secure connectivity for complex, multi-device environments.

      Read More
  • Solutions
    • Industries
      • Distributed Enterprises
      • Retail & Hospitality
      • K-12 Education
      • Higher Education
      • State & Local
      • Federal
      • Healthcare
      • Financial Services
      • Carriers
    • Use Cases
      • Secure SD-Branch
      • Network Segmentation
      • Zero Trust Security
      • Secure SD-WAN
      • Office 365 Security
      • SaaS Security
      • Secure Wi-Fi
    • Solutions Widgets
      • Solutions Content Widgets
        Federal

        Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions

      • Solutions Image Widgets
  • Partners
    • SonicWall Partners
      • Partners Overview
      • Find a Partner
      • Authorized Distributors
      • Technology Partners
    • Partner Resources
      • Become a Partner
      • SonicWall University
      • Training & Certification
    • Partner Widgets
      • Custom HTML : Partners Content WIdgets
        Partner Portal

        Access to deal registration, MDF, sales and marketing tools, training and more

      • Partners Image Widgets
  • Support
    • Support
      • Support Portal
      • Knowledge Base
      • Technical Documentation
      • Community
      • Video Tutorials
      • Product Life Cycle Tables
      • Partner Enabled Services
      • Contact Support
    • Resources
      • Resource Center
      • Events
      • Free Trials
      • Blog
      • SonicWall University
      • MySonicWall
    • Capture Labs
      • Capture Labs
      • Security Center
      • Security News
      • PSIRT
      • Application Catalog
    • Support Widget
      • Custom HTML : Support Content WIdgets
        Support Portal

        Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials

      • Support Image Widgets
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Events
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
  • Contact Sales
  • Menu

SMB SSL-VPN: Configuring the SSL-VPN Group Configuration for LDAP Authentication Domains

03/26/2020 83 People found this article helpful 196,805 Views

    Download
    Print
    Share
    • LinkedIn
    • Twitter
    • Facebook
    • Email
    • Copy URL The link has been copied to clipboard

    Description

    SMB SSL-VPN: Configuring the SSL-VPN Group Configuration for LDAP Authentication Domains

    Resolution

    Feature/Application:

    Please Note: The Microsoft Active Directory database uses an LDAP organization schema. The Active Directory database may be queried using Kerberos authentication (the standard authentication type; this is labeled "Active Directory" domain authentication in the SonicWall SSL VPN appliance), NTLM authentication (labeled NT Domain authentication in SonicWall SSL VPN appliance), or using LDAP database queries. An LDAP domain configured in the SonicWall SSL VPN appliance can authenticate to an Active Directory server.


    Procedure:

    To configure LDAP authentication, perform the following steps:

    Step 1 Click Add Domain to display the Add New Domain dialog box.
    Step 2 Select LDAP from the Authentication Type menu. The LDAP domain configuration fields is displayed.

    Image

     
    Step 3 Enter a descriptive name for the authentication domain in the Domain Name field. This is the domain name users will select in order to log into the SonicWall SSL-VPN appliance user portal. It can be the same value as the Server Address field.
     
    Step 4 Enter the IP address or domain name of the server in the Server Address field. Portals > Domains
    Step 5 Enter the search base for LDAP queries in the LDAP baseDN field. An example of a search base string is CN=Users,DC=yourdomain,DC=com.
     
    Tip: It is possible for multiple OUs to be configured for a single domain by entering each OU on a separate line in the LDAP baseDN field. In addition, any sub-OUs will be automatically included when parents are added to this field.
     
    Note:  Do not include quotes ("") in the LDAP BaseDN field.
     
    Step 6 Enter the common name of a user that has been delegated control of the container that user will be in along with the corresponding password in the Login Username and Login Password fields.
     
    Note: When entering Login Username and Login Password, remember that the SSL-VPN appliance binds to the LDAP tree with these credentials and users can log in with their sAMAccountName.
     
    Step 7 Enter the name of the layout in the Portal Name field. Additional layouts may be defined in the Portals > Portals page.
     
    Step 8 Optionally select the Allow password changes (if allowed by LDAP server) checkbox. This option, if allowed by your LDAP server, will enable users to change their LDAP password during an SSL VPN session.
     
    Step 9 Optionally select the Use SSL/TLS checkbox. This option allows for the SSL/TLS encryption to be used for LDAP password exchanges. This option is disabled by default as not all LDAP servers are configured for SSL/TLS.
     
    Step 10 Optionally select the Enable client certificate enforcement checkbox to require the use of client certificates for login. By checking this box, you require the client to present a client certificate for strong mutual authentication. Two additional fields will appear:
     Verify user name matches Common Name (CN) of client certificate - Select this checkbox to require that the user's account name match their client certificate.
     
     Verify partial DN in subject - Use the following variables to configure a partial DN that will match the client certificate:
     
     User name: %USERNAME%
     Domain name: %USERDOMAIN%
     Active Directory user name: %ADUSERNAME%
     Wildcard: %WILDCARD%
    Step 11: Optionally select the One-time passwords checkbox to enable the One Time Password feature. A drop-down list will appear, in which you can select if configured, required for all users, or using domain name. These are defined as:
     if configured - Only users who have a One Time Password email address configured will use the One Time Password feature.
     required for all users - All users must use the One Time Password feature. Users who do not have a One Time Password email address configured will not be allowed to login.
     using domain name - Users in the domain will use the One Time Password feature. One Time Password emails for all users in the domain will be sent to username@domain.com .
     
    If you selected if configured or required for all users in the One-time passwords drop-down list, the LDAP e-mail attribute drop-down list will appear, in which you can select mail, userPrincipalName, or custom. These are defined as:
     
     mail - If your LDAP server is configured to store email addresses using the "mail" attribute, select mail.

     mobile or pager - If your AD server is configured to store mobile or pager numbers using either of these attributes, select mobile or pager, respectively. Raw numbers cannot be used, however, SMS addresses can.

     userPrincipalName - If your LDAP server is configured to store email addresses using the "userPrincipalName" attribute, select userPrincipalName.

     custom - If your LDAP server is configured to store email addresses using a custom attribute, select custom. If the specified attribute cannot be found for a user, the email address assigned in the individual user policy settings will be used. If you select custom, the Custom attribute field will appear. Type the custom attribute that your LDAP server uses to store email addresses. If the specified attribute cannot be found for a user, the email address will be taken from their individual policy settings.

    If using domain name is selected in the One-time passwords drop-down list, the E-mail domain field will appear instead of the LDAP e-mail attribute drop-down list. Type in the domain name where one-time password emails will be sent (for example, abc.com).
     
    Step 12 Click Add to update the configuration and add the domain to the Domains Settings table.

    Source: SonicWall SSL VPN 4.0 Administrator's Guide

    Related Articles

    • SMA1000: How to manage Connect Tunnel client Auto-updates
    • Appliance reboot changes the configuration.
    • How to secure Virtual Office portal from all external access

    Categories

    • Secure Mobile Access > SMA 100 Series

    Not Finding Your Answers?

    ASK THE COMMUNITY

    Was This Article Helpful?

    YESNO

    Article Helpful Form

    Article Not Helpful Form

    Company
    • Careers
    • News
    • Leadership
    • Awards
    • Press Kit
    • Contact Us
    Popular resources
    • Communities
    • Blog
    • SonicWall Capture Labs

    Stay In Touch

    • By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. You can unsubscribe at any time from the Preference Center.
    • This field is for validation purposes and should be left unchanged.
    • Facebook
    • Twitter
    • Linkedin
    • Youtube
    • Instagram

    © 2023 SonicWall. All Rights Reserved.

    • Legal
    • Privacy
    • English
    Scroll to top