Chat now with support
Chat with Support

Defender 6.4 - Administration Guide

Getting started Managing Defender objects in Active Directory Configuring security tokens Securing VPN access Securing Web sites Securing Windows-based computers Defender Management Portal (Web interface) Securing PAM-enabled services Delegating Defender roles, tasks, and functions Automating administrative tasks Administrative templates Integration with Active Roles Push Notifications Appendices
Appendix A: Enabling diagnostic logging Appendix B: Troubleshooting common authentication issues Appendix C: Troubleshooting DIGIPASS token issues Appendix D: Defender classes and attributes in Active Directory Appendix E: Defender Event Log messages Appendix F: Defender Client SDK Appendix G: Defender Web Service API

Default Defender Security Policy

If a user is a member of an Access Node and no Defender Security Policy is applied to the user explicitly or implicitly, then a default Defender Security Policy is effective for the user.

The default Defender Security Policy is configured as follows:

  • Primary authentication method is security token.
  • User’s violation count is incremented by one after each 3 unsuccessful authentication attempts.
  • Violation count upon which the user’s account is locked is 4. Lockout duration is 3 minutes.
  • Violation count is reset each time the user successfully authenticates.
  • The user can log on 24 hours a day, 7 days a week.
  • SMS token, e-mail token, and GrIDsure token are disabled for the user.

Managing Access Nodes

An Access Node is essentially an IP address or a range of IP addresses from which the Defender Security Server accepts authentication requests. If an Access Node is misconfigured, authentication requests may not reach the Defender Security Server and the user cannot get access to the resources protected by Defender.

After creating an Access Node, you need to assign it to a Defender Security Server, specify its members (users or groups you want to authenticate through the node), and select a Defender Security Policy for the node.

Creating an Access Node

To create an Access Node

  1. On the computer where the Defender Administration Console is installed, open the Active Directory Users and Computers tool (dsa.msc).
  2. In the left pane (console tree), expand the appropriate domain node, and then expand the Defender container.
  3. Right-click the Access Nodes container, point to New, and then click Defender Access Node.
  4. Complete the wizard that starts to create a new Access Node.

    For more information about the wizard steps and options, see New Object - Defender Access Node Wizard reference.

New Object - Defender Access Node Wizard reference

 

Table 10:

New Object - Defender Access Node Wizard reference

Wizard step

Options

Enter a name and description for this Access Node

Provides the following text boxes:

  • Name  Type a name for the Access Node being created.
  • Description  Type a description for the Access Node being created.

Select the node type and user ID type for this Access Node

Provides the following options:

  • Node Type  Use this list to select a type for the Access Node being created. The following node types are available:

    Radius Agent  Allows a NAS device to connect to Defender using the RADIUS protocol. RADIUS is transmitted over UDP and uses port 1812 by default. This is the default setting and is supported by most access devices.

    Radius Proxy  Allows RADIUS requests received from a RADIUS Agent access node to be forwarded to another RADIUS Server.

    Radius Proxy (to non-negotiating server)  Allows Defender to issue the response request on behalf of the RADIUS Server. This node type is typically used when migrating from RSA to Defender. In some cases, the user ID included in the request sent from the Access Node and proxied by the Defender Security Server to the RADIUS Server cannot be processed by the RADIUS Server, unless accompanied by a password.

    Defender Agent  Allows Defender agents to connect and process authentication requests. Typically, this node type is required for use with legacy Cisco ACS devices. Defender agents use a proprietary protocol to transmit data and use TCP (default port number 2626), instead of the UDP of RADIUS.

    NetScreen Agent  Select this node type if your Access Node is a NetScreen VPN.

    NC-PASS Radius Agent  Select this node type if you are using the NC-Pass two-factor authentication software.

    Nortel VPN Agent  Select this node type if you plan to authenticate using an SNK token in synchronous mode.

  • User ID  Use this list to select the required user ID type. This is the user ID that will be used to locate the user in Active Directory. The available options are SAM Account Name, Defender ID, User Principal Name, Proper Name, and E-mail Address.

    If you select E-mail Address, the e-mail address specified on the General tab of the user Properties dialog box is used.

Enter the connection details for this Access Node
  • IP Address or DNS Name  Type the IP address or Network ID (IP address or DNS name) from which the Defender Security Server will accept authentication requests.

    If you specify a single IP address, you must use the 255.255.255.255 subnet mask.

    If you specify a network ID (for example, 192.168.10.0) and subnet mask 255.255.255.0, this causes the corresponding Defender Security Server to accept authentication requests from all hosts on the specified subnet (192.168.10.0).

  • Port  Type the port number of the Defender Security Server.
  • Subnet Mask  Type the subnet mask you want to use for the Access Node.
  • Shared Secret  Type the shared secret you want to use. The shared secret configured on the access device must match the shared secret specified for the Access Node. The shared secret can be up to 63 alphanumeric characters. (For a Defender Agent Access Node, the shared secret can be 16 hex or 24 octal digits).
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating