Tavve zoneranger User Manual page 104

In order to configure the ZoneRanger to authenticate with Windows IAS, a specific Resource Policy
must be added in IAS. The Resource Policy must have a Policy condition where Service-Type
matches "Authenticate Only". An Attribute needs to be added to the Profile that matches the
following:
Attribute name:
Attribute number:
Attribute format:
Attribute values:
In order to configure the ZoneRanger to authenticate with FreeRadius, the following needs to be
added to the FreeRadius dictionary:
VENDOR
BEGIN-VENDOR
ATTRIBUTE
END-VENDOR
Configuring TACACS+/RADIUS Proxy on a Ranger Gateway
The Ranger Gateway can be configured to interact with a TACACS+ or RADIUS server in a variety
of ways. Where possible, the most convenient method is to install the Ranger Gateway software on
the same server where the TACACS+/RADIUS server application has been installed. In this case,
the Ranger Gateway can optionally be configured to spoof the source address in requests forwarded
to the TACACS+/RADIUS server, so that these requests appear to be coming directly from the
managed device. This is an important feature, because TACACS+/RADIUS servers typically can be
configured so that users have different privileges on different devices, and the source address in the
request is used to identify the device being accessed. Note that the spoofing feature requires GVI or
RGVI to be enabled and configured to intercept replies directed back to the managed devices.
When the spoofing feature is disabled, TACACS+ and RADIUS requests will appear to the server as
having been sent by the IP address of the Ranger Gateway rather than by specific managed devices.
This option is easier to configure, but is valid only in cases where the access privileges for given
users are the same across all managed devices.
Another option is to install the Ranger Gateway and the TACACS+/RADIUS server application on
different servers. In this case, if source address spoofing is enabled, additional configuration will be
required:
•
IP Forwarding will need to be enabled on the Ranger Gateway server.
•
Static routes will need to be configured on the TACACS+/RADIUS server, so that traffic
destined for managed devices is routed to the Ranger Gateway. Note that this requires the
TACACS+/RADIUS server and the Ranger Gateway server to be in the same subnet.
•
The Ranger Gateway must have GVI or RGVI enabled and configured to intercept traffic
destined for managed devices.
As before, disabling source address spoofing is a simpler option (much simpler in this case, as there
is no need for IP forwarding, static routes, or GVI/RGVI), but is valid only in cases where the
access privileges for given users are the same across all managed devices, because all requests will
appear to the server as having been originated by the Ranger Gateway.
ZoneRanger 5.5 User's Guide
Vendor-Specific
26
OctetString
Vendor: Vendor code: 2668
Value: admin
Tavve 2668
Tavve
SecurityLevel 1 string
104