Nordic Edge

Table of Contents

---

Definitions

In this Step by Step guide the Check Point Secure Client VPN-1 is referred as "SSL-VPN Solution / Server"

2 Prerequisites

You will need to have a server available, for example a VMware virtual machine with Windows Server 2003 or higher installed with Ethernet in bridge mode. The server needs to have an ip-address configured and must also be able to reach your DNS-servers, your SSL-VPN solution and the Active Directory. Since the software is quite small (315 mb) and easy to remove, you can also use any existing server in your network.

Important information regarding communication

The One Time Password Server is a software that you can place on any server in your internal network or DMZ.

- The One Time Password Server needs to be able to communicate (Outbound traffic) with your LDAP or JDBC User Database. Default port for LDAP and Secure LDAP is TCP port 389 / 636.

- SSL-VPN solution needs to be able to communicate (Outbound traffic) with the One Time Password Server with Radius, UDP port 1812 or 1645 (Outbound traffic)

- If you want to use the Nordic Edge SMS Gateway, the One Time Password Server needs to be able to communicate (Outbound traffic) with otp.nordicedge.net and otp.nordicedge.se with HTTPS on TCP port 443.

In this test-scenario you will want to communicate with RADIUS port 1812 or 1645 and use our Nordic Edge 

SMS Gateway.

---

3 Getting started

Type in your name and contact details to receive the software.

You will receive a link for downloading the software. A 30 days evaluation license will be sent via e-mail when you download the software.

Download the 32 or 64 bit version depending on your platform.

4       Installation

 

Please note that if you are installing on a Windows 2008 Server you need to right click on the otp3install.exe using explorer and click on “Run as Administrator”.

 

 

5   Configuring the One Time Password Server

5.1  Start the OTP Configurator

Start the OTP Configurator by clicking on the left button - “Configuration”              

5.2   Configure the One Time Password Server

On the Server page you can set the length of the one time password and for how long it should be valid. Default is 5 minutes.

You can also set a default country prefix, which means that you will not need to state it in the mobile attribute. 

For more information regarding the optional setting please see One Time Password Server 3 – Administration manual

For now, leave this page as default and go on to the next part – Configure RADIUS.

5.3      Configure RADIUS

Change to the RADIUS tab and configure the RADIUS port you want to use to communicate with Check Point VPN-1 server. In this example we are using RADIUS port nb 1645.

 Click Save config.

5.4      Configure databases

In this setup we are going to use the LDAP database Microsoft Active Directory

Change to the Databases tab and click on the LDAP Database button.

5.5      Configure LDAP Host Settings

For our configuration we are going to use the active directory installed on the same server as the One Time Password Server. We will use the internal IP-address (127.0.0.1) as host address.

We will use the standard LDAP port nb (389) to communicate with Active Directory.

For Admin DN we are going to use the Administrator to search for users in the Active Directory. For now the user only need read rights to the user object but be aware that you later might want to use options like disable accounts and use the Pledge Enrollment concept for the Pledge Mobile Client. In examples like these the Admin DN need rights to modify the disable account attribute and to store oath-keys at optional user attributes.

Configure your LDAP host settings and click test. You should now get a messages saying “LDAP connection success”

Click OK and Save

 

Next step is to configure the LDAP database settings.

5.6   Configure the LDAP database settings

The BASE DN is the search base for where your users contains. Click on the button with three dots at the right side of the Base DN field to browse your LDAP Database.

Click on the Organization Unit or Organization where your store your users objects and click OK.

7    Configure Delivery Method

The Delivery Methods object category is used to enable and configure one or more delivery methods that the OTP Server can use to send the one-time passwords.

 

One Time Password Server offers various methods like SMS, Oath Tokens, Instant Messaging, HTTP, Yubikey.

In this example we will use SMS as Method and the Nordic Edge SMS-service as SMS-provider.

In the evaluating phase we offer customer to use our Nordic Edge SMS-service free of charge in 30 days from the activation of the Demo Account.

In the left Pane, click “Deliver Methods” and then Nordic Edge SMS. In the right pane enable Nordic Edge SMS Gateway.

To Request a demo account click “Request a demo account”.

Click “Yes”

You should now get a success message and the Username and Password for the Nordic Edge SMS-gateway has automatically been filled in. Click OK and Save Config.

8 Restart the One Time Password Server as Windows Service

In the server panel for click “Shutdown”

In Windows Control Panel, open Administrative Tools / Services

Find the NordicEdge OTPServer Service, right click on that service and click “Start”.

9  Add mobile phone number with Microsoft Management Console

Add mobile phone number to your test users mobile phone attribute by starting the Microsoft MMC and select the user that you want to use for testing and enter the mobile phone number in the Mobile attribute.

10 configuring Check Point Secure Client, VPN-1

Click OK

Now in the Service field choose the same Radius protocol as you have configured the OTP-server to run with. In this test scenario we are using 1645 which is RADIUS. If you would have used 1812 on
the One Time Password Side you would have been choosing New Radius.

Type in same shared secret as you have set in the One Time Password Server

Use Version 1.0 Compatible Radius protocol

 

In the Protocol field make sure you use Protocol PAP

 

Priority shall be set to 1.

Click OK

10.2 Add test user

Go to the User tab

Right click on users and choose new user. (default)

In the User properties select the user name for your test user. Note, this should be the same name as the User Id in Active Directory.

Go to the Authentication tab

IN the Authentication Scheme

Select the Authentication Scheme “ RADIUS”

Select the One Time Password Server as RADIUS Server.

Click OK

11       Test the authentication.

Open the SecureClient login and type in your Active Directory User ID and password as usual.

Click Connect.

You will now receive a one-time password to your cell phone.

Enter your one-time password and in the response field and click connect.

12     Purchase

If you want to purchase the product, you are more than welcome to contact us at e-mail sales: sales@nordicedge.se. phone: +46 8 122 07 500 fax: +46 8 122 07 508.

13     Technical questions

If you have any technical questions, please contact us at support@nordicedge.se 

 

Thank you for showing interest in our product!

The Nordic Edge One Time Password Server Team