Lab 2: Deploy Priviledged User Access (PUA) using Radius

In this lab ephemeral authentication is configured on Access Policy Manager (APM) using Radius authentication.

Note

An External LDAP server is required for this scenario

Task 1 - Access Lab Environment

To access your dedicated student lab environment, you will need a web browser and Remote Desktop Protocol (RDP) client software. The web browser will be used to access the Unified Demo Framework (UDF) Training Portal. The RDP client will be used to connect to the jumphost, where you will be able to access the BIG-IP management interfaces (HTTPS, SSH).

1. Click DEPLOYMENT located on the top left corner to display the environment

2. Click ACCESS next to jumpbox.f5lab.local

   

3. Select your RDP resolution.

4. The RDP client on your local host establishes a RDP connection to the Jumphost.

5. Login with the following credentials:

   • User: f5labuser1
   • Password: user1

6. After successful logon the Chrome browser will auto launch opening the site https://portal.f5lab.local. This process usually takes 30 seconds after logon.

   

7. Click the Classes tab at the top of the page.

8. Scroll down the page until you see 302 Ephemeral Authentication-v16 on the left

   

9. Hover over tile Implement Priviledged User Access Authentication. A start and stop icon should appear within the tile. Click the Play Button to start the automation to build the environment

   

10. The screen should refresh displaying the progress of the automation within 30 seconds. Scroll to the bottom of the automation workflow to ensure all requests succeeded. If you you experience errors try running the automation a second time or open an issue on the Access Labs Repo.

    

Task 2 - Create Ephemeral Authentication configuration

Ephemeral authentication Configuration defines the authentication method (LDAP or radius) and ephemeral password usage for privileged user access.

1. Navigate to Access >> Ephemeral Authentication >> Authentication Configuration >> Click the + (Plus Symbol)

   

2. Configure the General Properties:

   1. Name: pua.radius.auth.conf
   2. Remove the ldap Authentication Method
   3. Select Radius and click Add to set the Authentication Method
   4. Click Save

   

Note

Password Expiration section defines the password usage and timer.

Task 3 - Create an SSH Security Configuration

The SSH Security Configuration defines the ciphers, exchange methods, HMACs, and compression algorithms required by the backend resource.

1. Navigate to Access >> Ephemeral Authentication >> WebSSH Configuration >> SSH Security. Click the + (Plus Symbol).

   

2. Configure the General Properties

   1. Name: pua.radius.ssh.conf
   2. Ciphers: aes256-ctr, aes192-ctr
   3. Key Exchange Methods: diffie-hellman-group1-sha14, diffie-hellman-group-exchange-sha1
   4. HMACs: hmac-sha1
   5. Compression Algorithms: none
   6. Click Save

   

Task 4 - Create an Access Configuration for Ephemeral Authentication

Ephemeral Authentication Configuration specifies the password setting for privileged use access.

1. Navigate to Access >> Ephemeral Authentication >> Access Configuration. Click the + (plus symbol)

   

2. Configure the General Properties

   1. Name: pua.radius.access.conf
   2. Authentication Configuration: pua.radius.auth.conf
   3. SSH Security Configuration: pua.radius.ssh.conf
   4. Click Save

   

Task 5 - Create WebSSH Resource

1. Navigate to Access >> Ephemeral Authentication >> WebSSH Configuration >> Resource. Click the + (plus symbol)

   

2. Configure the General Properties

   1. Name: Client01
   2. Destination:
   3. select: IP Address radio button
   4. Enter IP: 10.1.20.8
   5. Authentication configuration: pua.radius.ssh.conf

3. Configure the Customization Setting for English

   1. Caption: Client01
   2. Click Save

   

Task 6 - Creating an RADIUS Authentication configuration

The RADIUS Authentication configuration defines the external LDAP server used to identity users.

1. Navigate to Access >> Ephemeral Authentication >> RADIUS Authentication >> Profile. Click the + (plus symbol)

   

2. Configure General Properties

   1. Name: radius.conf
   2. shared Secret: secret

   

Task 7 - Create a Webtop

The Webtop houses links to resources we would like to access.

1. Navigate to Access >> Webtops >> Webtop Lists. Click the + (plus symbol)

   

2. General Properties

   1. Name: pua.webtop
   2. Type: Full
   3. Click Finish

   

Task 8 - Create an Access Profile

1. Navigate to Access >> Profiles / Policies >> Access Profiles (Per-Session Policies). Click the + (plus symbol)

   

2. Configure General Properties

   1. Name: pua.radius.psp
   2. Profile Type: All

   

3. Configure Language Setting

   1. Click English
   2. CLick <<
   3. Click Finish

   

Task 9 - Create an Admin Access Macro

1. Click Edit to modify the access profile

   

2. Click Add Macro

   

3. Enter Admin Access for the Name

4. Click Save

   

5. Expand the Admin Access Macro

6. Click the + (plus symbol) symbol between In and Out

   

7. Click Assignment

8. Click SSO credentials Mapping

9. Click Add Item

   

10. Click Save

    

11. Click the + (plus symbol) symbol to right of SSO Credential Mapping

    

12. Click Assignment

13. Click Advance Rsource Assign

14. Click Add Item

    

15. Click Add new entry

16. Click Add/Delete

    

17. Click WebSSH

18. Click /Common/Client01

    

19. Click Webtop

20. Click /Common/pua.webtop

21. Click Update

    

22. Click Save

    

Task 10 - Create an GET UPN from CAC Macro

1. Click Add New Macro

   

2. Name: GET UPN from CAC

3. Click Save

   

4. Expand GET UPN from CAC

5. Click + Symbol

   

6. Click Assignment

7. Click Variable Assign

8. Click Add Item

   

9. Name: GET UPN

10. Click Add new entry

11. Click change

    

12. Define Custom Variable and Custom Expression

    Custom Variable = session.custom.ephemeral.upn
    
    Custom Expression =
    set x509e_fields [split [mcget {session.ssl.cert.x509extension}] "\n"];
    # For each element in the list:
    foreach field $x509e_fields {
    # If the element contains UPN:
    if { $field contains "othername:UPN" } {
    ## set start of UPN variable - updated for new CACs
    set start [expr {[string first "othername:UPN<" $field] +14}]
    # UPN format is <user@domain>
    # Return the UPN, by finding the index of opening and closing brackets, then use string range to get everything between.
    return [string range $field $start [expr { [string first ">" $field $start] - 1 } ] ];??} }
    # Otherwise return UPN Not Found:
    return "UPN-NOT-FOUND";
    

13. Click Finished

    

14. Click Save

    

15. Click + (plus symbol) beside GET UPN

    

16. Click General Purpose

17. Click Empty

18. Click Add Item

    

19. Name: Check UPN

20. Click Branch Rules

    

21. Click Add Branch Rule

22. Name: NO UPN

23. Click change

    

24. Click Advance

    

25. Enter: expr { [mcget {session.custom.ephemeral.upn}] == “UPN-NOT-FOUND” }

26. Click Finished

    

27. Click Save

    

28. Click + (plus symbol) to the right of NO UPN

    

29. Click General Purpose

30. Click Message Box

31. Click Add Item

    

32. Name: NO UPN

33. Tile: NO UPN

34. Click Save

    

35. Click Edit Terminals

    

36. Name: Found

37. Click Add Terminal

38. Name: Not Found

39. Click Save

    

40. Click the Found Terminal beside NO UPN

    

41. Click Not Found

42. Click Save

    

Task 11 - Create the LDAP Macro

1. Click Add New Macro

   

2. Name: LDAP Query

3. Click Save

   

4. Expand the LDAP Query Macro

5. Click + (plus symbol)

   

6. Click Authentication

7. Click LDAP Query

8. Click Add Item

   

9. Update the Properties tab . Server = */Common/pua-ldap-servers** . SearchDN = **DC=f5lab*, DC=local . SearchFilter = **UserPrincipalName=%{session.custom.ephemeral.upn}* . Fetch groups to which the user or group belong = **Direct* . Click **Branch Rules*

   

10. Click the X to remove the User Group Membership query

    

11. Click Add Branch Rules

12. Name: LDAP Query

13. Click change

    

14. Click Add Expression

1. Context: LDAP Query

2. Condition: LDAP Query Passed

3. LDAP Query has Passed

4. Click Add Expression

   

5. Click Finished and Save

   

6. Click + (plus symbol) on the fallback branch

   

7. Click General Purpose

8. Click Message Box

9. Click Add Item

   

10. Name: LDAP Failure

11. Tile: LDAP Failure for user %{UserPrincipalName}

12. Click: Save

    

13. Click: Edit Terminals

    

14. Name: Success

15. Click Add Terminal

16. Name: Failure

    

17. Click the Success Terminal beside LDAP Failure

    

18. Click Failure

19. Click Save

    

Task 12 - Create the CAC AUTH Macro

1. Click Add New Macro

   

2. Name: CAC AUTH

3. Click Save

   

4. Expand the CAC AUTH Macro

5. CLick + (plus symbol) between the IN and Out Terminal

   

6. Click Authentication

7. Click On-Demand Cert-Auth

8. Click Add Item

   

9. Ensure Auth Mode is set to Request

10. Click Save

    

11. Click + between On-Demand Cert-Auth and Out on the successful branch

    

12. Click Macro

13. Click GET UPN from CAC

14. Click Add Item

    

15. Click + on the Not Found branch between GET UPN from CAC and Out

    

16. Click General Purpose

17. Click Message Box

18. Click Add Item

    

19. Name: CAC Failure

20. Title: CAC Failure

21. Click Save

    

22. Click + (plus symbol) on the Found Branch between GET UPN from CAC and CAC Failure

    

23. Click Macro

24. Click LDAP_Query

25. Click Add Item

    

26. Click Edit Terminal

    

27. Name: Success

28. Click Add Terminal

    

29. Name: Failure

30. Click the down arrow beside the Failure box to change the order.

    

31. Click Save

    

32. Change the 1st, 2nd, and 4th Success terminals to Failure, and click Save

    

    

    

Task 13 - Update the Initial Access Policy

1. Click the + (plus symbol) between the Start and Deny Terminals

   

2. Click General Purpose

3. Click Message Box

4. Click Add Item

   

5. Name: Warning Banner

6. Title: Official Lab Use Only!!

7. Click Save

   

8. Click + (plus symbol) between the Warning Banner and Deny Terminals

   

9. Click Macro

10. Click CAC Auth

11. Click Add Item

    

12. Click + (plus symbol) between CAC Auth and Deny Terminals on the successful branch

    

13. Click Assignment

14. Click Variable Assign

15. Click Add Item

    

16. Click Add new entry

17. Click Change

    

18. Set Custom Variable = session.custom.ephemeral.last.username

19. Set Custom Expression = session.logon.last.username

20. Click Finish

    

21. Click Add new entry

22. Click Change

    

23. Set Custom Variable = session.logon.last.username

24. Change Customer Expression to AAA Attribute

25. Change Agent Type: LDAP_Query to LDAP

26. Change LDAP attribute name to sAMAccountName

27. Click Finish

    

28. Click Add new entry

29. Click Change

    

30. Set Custom Variable = session.custom.ephemeral.last.dn

31. Change Customer Expression to AAA Attribute

32. Change Agent Type: LDAP_Query to LDAP

33. Change LDAP attribute name to dn

34. Click Finish

    

35. Click Save

    

36. Click +* (plus symbol) between the Variable Assign and deny Terminals

    

37. Click Macro

38. Click Admin Access

39. Click Add Item

    

40. Click the Deny terminal beside Admin Access

    

41. Click Allow

42. Click SAVE

    

43. Click Apply Policy

    

Task 14 - Create an SSL Profile

1. Navigate to Local Traffic >> Profiles >> SSL >> Client

2. Select the webtop partition

   

3. Click pua-client hyperlink

   

4. Verify Certificate is set to acme.com-wildcard

5. Verify Key is set to acme.com-wildcard

   

6. Verify Trusted Certficate Authorities is set to ca.f5lab.local

7. Verify Advertised Certificate Authorities is set to ca.f5lab.local

8. Click update

   

Task 15 - Create a Connectivity Profile

Navigate to Access >> Profiles / Policies >> Connectivity / VPN >> Connectivity >> Profile + (plus symbol)

1. Profile Name: pua.cp

2. Parent Profle: /Common/Connectivity

3. Click OK

   

Task 16 - Add the pua.webtop.ssl profile to pua.webtop.ssl virtual Server

Navigate to Local Traffic >> Virtual Servers #. Select the webtop partitiion #. Click pua.webtop link

1. Under Configuration, ensure pua-clientssl SSL Profile to Selected

   

2. Access Policy #. Set Access Profile to pua.radius.psp #. Set Connectivity Profile to pua.cp

3. Ephemeral Authentication . Set Access Configuration to **radius.access.conf* . Click **Update*

   

4. Navigate to Local Traffic >> Virtual Servers

5. Select the radius partitiion

6. Click pua-radius

   

7. Ephemeral Authentication #. Set Access Configuration to pua.access.conf #. Set LDAP Authentication Configuration to pua.ldap.conf #. Click Update

   

Task 17 - PUA testing

1. Open a browser to https://webtop.acme.com

2. Click Continue

   

3. Uncheck Remember this decision

4. Choose user1 Certificate

5. Click OK

   

6. Click Client01 tab

   

7. Observer the user logged into the server and connectivity status