• Secure Mobile Access 10.2 for the SMA 100 Series
• About This Guide
  • Organization of This Guide
  • Guide Conventions
• Virtual Office Overview
  • About Virtual Office
    • Accessing Virtual Office Resources
  • Browser Requirements
  • About Certificates
  • About the Virtual Office Web Interface
  • Logging Out of the Virtual Office
• Using Secure Mobile Access Connect Agent
  • What is the Secure Mobile Access Connect Agent?
  • Supported Operating Systems
  • Downloading and Installation
  • Setting Up the SMA Connect Agent
    • Proxy Configuration
    • Logs
    • Browser Warning
  • End Point Control (EPC)
  • PDA (Personal Device Authorization)
    • SonicWall Application
• Using Virtual Office Authentication
  • Importing Certificates
  • Using Two-Factor Authentication
    • User Prerequisites
    • RSA Two-Factor User Authentication Process
      • Logging into Virtual Office Using RSA Two-Factor Authentication
      • Creating a New PIN
      • Waiting for the Next Token
    • VASCO Two-Factor User Authentication Process
      • Logging into Virtual Office Using VASCO Two-Factor Authentication
      • Other RADIUS Server Two-Factor User Authentication Process
    • DUO Security Authentication Support on NetExtender/Mobile Connect Clients
  • Using One-Time Passwords
    • User Prerequisites
    • Logging In with an Email One-Time Password
    • Logging In with a Mobile App Time-based One-Time Password
    • Logging In with an SMS One-Time Password
    • Generating Backup Codes
    • Configuring One-Time Password Settings for E-mail
    • Configuring One-Time Password Settings for Mobile App
    • Configuring One-Time Passwords for SMS-Capable Phones
    • Configuring One-Time Password Settings for SMS
    • Verifying User One-Time Password Configuration
  • Using NetExtender
    • User Prerequisites
    • User Configuration Tasks
      • Installing NetExtender on Windows
      • Launching NetExtender Directly from Your Computer
      • Pre-Filling the Key Fields While Installing with Microsoft Installer
      • Configuring NetExtender Properties
      • Configuring NetExtender Connection Scripts
      • Configuring Batch File Commands
      • Configuring Proxy Settings
      • Configuring NetExtender Log Properties
      • Configuring NetExtender Acceleration Properties
      • Configuring NetExtender Packet Capture Properties
      • Configuring Language Properties
      • Configuring Protocol
      • Viewing the NetExtender Log
      • Disconnecting NetExtender
      • Upgrading NetExtender
      • Changing Passwords
      • Authentication Methods
      • Uninstalling NetExtender
      • Verifying NetExtender Operation from the System Tray
        • Displaying Route Information
        • Displaying Connection Information
      • Using the NetExtender Command Line Interface
      • Installing NetExtender on Linux
      • Using NetExtender on Linux
  • Using Mobile Connect
    • Prerequisites for Apple iOS Clients
    • Prerequisites for Android Smartphone Clients
  • Using File Shares
    • Using HTML-based File Shares
    • Downloading Files and Folders using HTML5 File Share
  • Managing Bookmarks
    • Adding Bookmarks
      • RDP Bookmarks
        • Determining the Remote Computer’s Full Name or IP Address
        • Configuring Remote Desktop Access on the Remote Computer
      • VNC Bookmarks
      • Citrix Bookmarks
      • Web Bookmarks
      • Mobile Connect Bookmarks
      • FTP Bookmarks
      • SSHv2 Bookmarks
    • Editing Bookmarks
    • Removing Bookmarks
    • Using Bookmarks
      • Using Remote Desktop Bookmarks
      • Using VNC Bookmarks
      • Using Citrix Bookmarks
      • Using Web Bookmarks
      • Using Mobile Connect Bookmarks
      • Using File Share Bookmarks
      • Using FTP Bookmarks
      • Using Telnet Bookmarks
      • Using SSHv2 Bookmarks
      • Global Bookmark Single Sign-On Options
      • Per-Bookmark Single Sign-On Options
• Warranty and License Agreements
  • GNU General Public License (GPL) Source Code
  • Limited Hardware Warranty
  • End User License Agreement
• SonicWall Support
  • About This Document

DUO Security Authentication Support on NetExtender/Mobile Connect Clients

The SMA series supports DUO Security Authentication during user login. SMA appliances introduced the Capture Security Center (CSC). DUO Security Authentication login is now supported for different clients such as web browsers, NetExtender, and Mobile Connect clients.

• About DUO Authentication
• About RADIUS
• DUO Security Authentication with SMA appliance
• DUO Security Authentication with Web Browser Login
• DUO Security Authentication with NetExtender Windows
• DUO Security Authentication with NetExtender Linux
• DUO Security Authentication with Mobile Connect for iOS
• DUO Security Authentication with Mobile Connect for macOS
• DUO Security Authentication with Mobile Connect for Android

About DUO Authentication

DUO has several options for securing your authentication of users. Refer to information on the DUO website to determine which method works best for your SonicWall solution.

There are three main methods the receiver can use to authenticate with DUO :

• DUO push: A prompt comes up on the screen from the DUO app that has been downloaded on the user’s mobile device.
• Phone call: A call comes to the mobile device requesting the user to click one or more buttons to authenticate.
• Passcode: A passcode comes by email or SMS/Text to the user’s mobile device, which the user then enters as part of the authentication process.

About RADIUS

RADIUS is a protocol or language SMA uses to authenticate users through the DUO authentication process. The SMA appliance uses RADIUS to communicate with the DUO authentication system.

DUO Security Authentication with SMA appliance

Configure SMA for multi-factor authentication using the following steps

1. Log in to the SMA appliance and navigate to Portals > Domains.

2. Add a new domain by clicking Add Domain.

   

3. Create a new RADIUS domain for DUO Authentication.

   

4. Navigate to Portals > Portals and modify the default portal for duo authentication.

   

5. On the General tab, select Display login message on custom login page to display custom login messages at login.

6. Remove the default Login Message and paste in the “<script src="https://api-f74dbf3b.duosecurity.com/frame/hosted/Duo-SonicWall-SRA-v1.js"></script>” message.

   

7. Access the user portal and choose DUO Authentication using the Radius credential for authentication.

   

8. Choose an authentication method for DUO Authentication and proceed with the login.

   

9. All three options, DUO Push, Call Me, or Passcode can be approved through a DUO application installed on a mobile device to proceed with the authentication.

   

   Creating an Offloaded Web Application Portal

   Log in to the user portal with DUO Authentication as the default user portal.

   

10. Navigate to Portals > Portals after logging in to the appliance using the Admin portal.

    

11. Click Offload Web Application to create an offloaded portal.

    

12. Click Next. On the Server page, enter the Application Server Address along with options selected as shown here.

    

13. Click Next twice. Remove the default Login Message and paste in the “<script src="https://api-f74dbf3b.duosecurity.com/frame/hosted/Duo-SonicWALL-SRA-v1.js"></script>” message.

    

14. Edit the DUO Radius domain to associate it with the DUO offloaded portal.

    

15. Edit the duo portal and paste the “<script src="https://api-f74dbf3b.duosecurity.com/frame/hosted/Duo-SonicWall-SRA-v1.js"></script>”duo security portal API configuration script into the Login Message field.

16. Enable Display custom login page and select Display login message on custom login page.

    

17. Access the offloaded portal (host entry is required if the DNS is not being used) and choose the duo authentication domain for duo authentication.

    

18. DUO Push, Call Me, or Passcode can be approved from a duo application installed on a mobile device to proceed with the authentication.

    

19. Ensure you have successfully accessed the offloaded portal with duo authentication.

    

DUO Security Authentication with Web Browser Login

For Duo Security Authentication with a Web Browser Login, after setting up the DUO portal configuration, you can login to a portal with DUO authentication with a web browser. Input a User Name and Password within a Radius domain. Prompt the DUO authentication page and select one authentication method such as Send Me a Push, Call Me, or Enter a Passcode. Click Login. After completing the DUO authentication, you should be redirected back to the portal.

DUO Security Authentication with NetExtender Windows

For DUO Security Authentication with NetExtender Windows

1. Open NetExtender and input a Server IP/Hostname, along with RADIUS authentication credentials Username, Password, and Domain name.

   

2. Click Connect for NetExtender.

3. Open the DUO Security Authentication page in your default browser. Select one authentication method such as Send Me a Push, Call Me, or Enter a Passcode. Click Login. NetExtender returns an error message if all conditions are not met.

   

4. DUO Push, Call Me, or Passcode can be approved from a duo application installed on a mobile device to proceed with the authentication.

   

5. DUO Authentication is successful in the Windows NetExtender client.

6. DUO Authentication fails in the Windows NetExtender client when the EPC check has failed.

   

7. DUO Authentication fails in the Windows NetExtender client when a device is prohibited.

   

DUO Security Authentication with NetExtender Linux

For DUO Security Authentication with NetExtender Linux, input a User Name and Password. Click the Connect button for an SMA connection.

DUO Authentication with NetExtender in Ubuntu Linux with Device management enabled.

DUO Authentication with NetExtender successful in Ubuntu Linux.

Open the DUO Security Authentication page in your default browser. If using Firefox, the following is default user portal from Linux in Firefox with DUO Authentication.

Login and select one authentication method such as Send Me a Push, Call Me, or Enter a Passcode. Click Login. Click Login. After completing the DUO authentication, you should be redirected back to the portal.

The following screen indicates successful DUO authentication with the user portal.

DUO Security Authentication with Mobile Connect for iOS

For DUO Security Authentication with Mobile Connect for iOS, click connect for an SMA connection. Input a User Name and Password. Open the DUO Security Authentication page as a WKWebview page in your default browser. Select one authentication method such as Send Me a Push, Call Me, or Enter a Passcode. Click Login. WKWebview returns an error message if all conditions are not met.

DUO Security Authentication with Mobile Connect for macOS

For DUO Security Authentication with Mobile Connect for macOS, click connect for an SMA connection. Input a User Name and Password. Open the DUO Security Authentication page in your default browser. Select one authentication method such as Send Me a Push, Call Me, or Enter a Passcode. Click Login. After completing the DUO authentication, you should be redirected back to the portal.

DUO Security Authentication with Mobile Connect for Android

For DUO Security Authentication with Mobile Connect for Android, click connect for an SMA connection. Input a User Name and Password. Open the DUO Security Authentication page in your default browser. Select one authentication method such as Send Me a Push, Call Me, or Enter a Passcode. Click Login. After completing the DUO authentication with Mobile Connect, you should be redirected back to the portal.