This article describes how to integrate RSA Cloud Access Service (CAS) with Stormshield SSL VPN by using RADIUS.

Configure CAS

Perform these steps to configure CAS.

Procedure

1. Sign in to the RSA Cloud Administration Console.

2. Click Authentication Clients > RADIUS.

   

3. Click Add RADIUS Client and Profiles.

4. On the RADIUS Client page, configure the client:

   1. Name: Enter a descriptive name for the RADIUS client.

   2. IP Address: Enter the public IP address of the Stormshield server.

   3. Shared Secret: Enter a secure shared secret for communication between the RADIUS client and server.

   

5. Click Save and Next Step, complete the RADIUS profile configuration, and then click Finish.

6. Click Publish Changes and wait for the operation to finish.

Configure Stormshield SSL VPN

Perform these steps to configure Stormshield SSL VPN.

Procedure

1. Sign in to the Stormshield Network Security (SNS) administrator console.

2. Click the Configuration tab, and then go to Users > Authentication.

   

3. On the Available Methods tab, click Enable a method, and then select Radius.

   

4. In the RADIUS settings, click the plus sign next to Server.

   

5. Create the RADIUS server object:

   1. Object name: Enter a descriptive name for the RADIUS server.

   2. IPv4 address: Enter the management IP address of the RSA Identity Router.

   3. Click Create.

6. In the RADIUS settings, configure access to the server:

   1. In Server, select the server object that you created.

   2. In Port, keep radius.

   3. In Pre-shared Key, enter the shared secret that you configured in RSA.

   

7. Create the first authentication policy:

   1. Go to Users > Authentication > Authentication Policy.

   2. Click New rule, and then select Standard rule.

   

   3. On the User tab, select the user group that must authenticate through RADIUS.

   4. On the Source tab, click Add an interface. In the interface list, select [Ethernet] out.

   

   5. On the Authentication methods tab, select Default method, and then click Remove.

   6. Click Enable a method, and then select RADIUS.

   7. Click OK.

   

8. Create the second authentication policy by repeating the preceding procedure. On the Source tab, select [SSL VPN] SSL VPN. Keep the remaining settings the same as the first policy.

9. Enable and apply the policies:

   1. In the Status column, double-click Disabled for each policy so that the status changes to Enabled.

   2. Click Apply.

   

Increase the RADIUS Timeout

The default RADIUS timeout in Stormshield is 3 seconds. Increase it to 30 seconds so that users have enough time to complete authentication.

1. Open a Stormshield CLI session as an administrator. Use SSH or open System > CLI Console on the firewall.

2. Enter the following command to set the primary RADIUS server timeout to 30,000 milliseconds:

   CONFIG AUTH RADIUS timeout=30000

3. Enter the following command to apply the authentication settings:

   CONFIG AUTH ACTIVATE

The configuration is complete.