topic Authentication Policy other ports confusion in General Topics

Authentication Policy other ports confusion

raji_toor — Tue, 13 Jul 2021 22:18:51 GMT

We just started looking into authentication policy and while testing it works for web services but what about any other services rdp/ssh/or anything else. The BPA document says we should set authentication policy to Any, but doing that SSH in our test gets blocked, with a auth-policy-deny, and there are no redirects for SSH.

Also if the user information is already known to firewall form other sources such as user agent, is the firewall still supposed to redirect and ask for authentication.

Re: Authentication Policy other ports confusion

BPry — Wed, 14 Jul 2021 00:54:13 GMT

@raji_toor,

The authentication policy really can't be used for things like RDP or SSH if you want to serve the authentication prompt properly because you can't redirect users, as you've experienced. In regards to your second question, that really depends on how you've configured the authentication policy. Since authentication policy can be used as an additional authentication check against users, if you want it to not apply to known users you would simply target unknown as your source-user so it doesn't match on know users.

Re: Authentication Policy other ports confusion

raji_toor — Wed, 14 Jul 2021 14:13:53 GMT

@BPry Thanks, I had forgotten about the unknown user option. Why does the BPA say to set service to any as it will only work for HTTP/HTTPS. I understand we want to cover all the ports for web but setting it to any in authentication policy effects other applications, such as ssh in our example test.

"Captive Portal identifies user information for web traffic (HTTP or HTTPS) that matches an Authentication policy rule so you can identify users whose information isn’t available to the firewall.
Setting service as 'any' in Authentication rules for captive portal functionality ensures web traffic on all ports can be monitored to learn user information. Hence not just HTTP and HTTPS but all ports need to be enabled as web traffic can originate on non standard ports too."