Sonicwall Tz350 Configuration Guide

0 views

Skip to first unread message

Nayra Waddles

unread,

Aug 3, 2024, 5:52:59 PM8/3/24

to unstocaddi

The iframe-based traditional Duo Prompt in SonicWall SRA or SMA RADIUS configurations reached its end of support on March 30, 2024. Customers must migrate to a supported Duo Single Sign-On application with Universal Prompt or a RADIUS configuration without the iframe for continued support from Duo.

We recommend you deploy Duo Single Sign-On for SonicWall SMA 200 Series to protect SonicWall SRA or SMA with Duo Single Sign-On, our cloud-hosted identity provider featuring Duo Central and the Duo Universal Prompt.

Another alternative is to reconfigure your existing radius_server_iframe Duo Authentication Proxy application so that it does not use the iframe, for example, RADIUS with Automatic Push for SonicWall SRA or SMA. See the "Related" links to the left to explore more RADIUS configurations.

If you are using SonicWall Mobile Connect client or SonicWall's Global VPN Client using IPsec, or an unsupported device as listed below, then see the VPN Client Instructions to configure the SonicWall device to use Duo Security's push authentication. The Duo Prompt shown in browsers does not work with SonicWall client VPN applications.

Sonicwall introduced a new "Contemporary mode" for SMA in v10.2. This mode may prevent display of the Duo prompt. The issue displaying the Duo prompt in "Contemporary mode" was fixed in SMA firmware update 10.2.1.0-17. If you have issues with the v10 "Contemporary mode" and cannot update your device firmware, access the "Classic mode" login page by changing the VPN login URL in your browser from to -bin/welcome. There is no setting in the SMA config to force use of "Classic mode".

Firewall configurations that restrict outbound access to Duo's service with rules using destination IP addresses or IP address ranges aren't recommended, since these may change over time to maintain our service's high availability. If your organization requires IP-based rules, please review Duo Knowledge Base article 1337.

Before moving on to the deployment steps, it's a good idea to familiarize yourself with Duo administration concepts and features like options for applications, available methods for enrolling Duo users, and Duo policy settings and how to apply them. See all Duo Administrator documentation.

You should already have a working primary authentication configuration for your SonicWall SMA/SRA SSL VPN users before you begin to deploy Duo.To integrate Duo with your SonicWall SMA/SRA SSL VPN, you will need to install a local Duo proxy service on a machine within your network. This Duo proxy server will receive incoming RADIUS requests from your SonicWall SMA/SRA SSL VPN, contact your existing local LDAP/AD or RADIUS server to perform primary authentication, and then contact Duo's cloud service for secondary authentication.

If you are already running a Duo Authentication Proxy server in your environment, you can use that existing host for additional applications, appending the new configuration sections to the current config. You don't have to set up a new Authentication Proxy server for each application you create. However, there are some cases where it might make sense for you to deploy a new proxy server for a new application, like if you want to co-locate the Duo proxy with the application it will protect in the same data center.

We do not recommend installing the Duo Authentication Proxy on the same Windows server that acts as your Active Directory domain controller or one with the Network Policy Server (NPS) role. If you must co-locate the Duo Authentication Proxy with these services, be prepared to resolve potential LDAP or RADIUS port conflicts between the Duo service and your pre-existing services.

The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!

The Duo Authentication Proxy can be installed on a physical or virtual host. We recommend a system with at least 1 CPU, 200 MB disk space, and 4 GB RAM (although 1 GB RAM is usually sufficient). See additional Authentication Proxy performance recommendations in the Duo Authentication Proxy Reference.

When installing, you can choose whether or not you want to install the Proxy Manager. The Proxy Manager is a Windows utility that helps you edit the Duo Authentication Proxy configuration, determine the proxy's status, and start or stop the proxy service. Learn more about using the Proxy Manager. Installing the Proxy Manager adds about 100 MB to the installed size.

Download the most recent Authentication Proxy for Unix from -latest-src.tgz. From the command line you can use curl or wget to download the file, like $ wget --content-disposition -latest-src.tgz. Depending on your download method, the actual filename may reflect the version e.g. duoauthproxy-6.4.1-src.tgz. View checksums for Duo downloads here.

Follow the prompts to complete the installation. The installer creates a user to run the proxy service and a group to own the log directory and files. You can accept the default user and group names or enter your own.

If SELinux is present on the target server, the Duo installer will ask you if you want to install the Authentication Proxy SELinux module. Your selection affects whether systemd can start the Authentication Proxy after installation.

The Duo Authentication Proxy configuration file is named authproxy.cfg, and is located in the conf subdirectory of the proxy installation. With default installation paths, the proxy configuration file will be located at:

The Authentication Proxy may include an existing authproxy.cfg with some example content. For the purposes of these instructions, however, you should delete the existing content and start with a blank text file. Duo Authentication Proxy ManagerThe Duo Authentication Proxy Manager is a Windows utility for managing the Authentication Proxy installation on the Windows server where you install the Authentication Proxy. The Proxy Manager comes with Duo Authentication Proxy for Windows version 5.6.0 and later.

The Proxy Manager cannot manage remote Duo Authentication Proxy servers, nor can you install the Proxy Manager as a stand-alone application. There is no Proxy Manager available for Linux. The Proxy Manager only functions as part of a local Duo Authentication Proxy installation on Windows servers.

To launch the Proxy Manager utility:

Open the Start Menu and go to Duo Security.
Click the Duo Authentication Proxy Manager icon to launch the application. You must have administrative privileges on the Windows server and accept the prompt for elevation.
The Proxy Manager launches and automatically opens the %ProgramFiles%\Duo Security Authentication Proxy\conf\authproxy.cfg file for editing.

Use the Proxy Manager editor on the left to make the authproxy.cfg changes in these instructions. As you type into the editor, the Proxy Manager will automatically suggest configuration options. Accepting these suggestions helps make sure you use the correct option syntax.

When you complete the Authentication Proxy configuration steps in this document, you can use the Save button to write your updates to authproxy.cfg, and then use the authproxy.cfg button to start the Authentication Proxy service before continuing on to the next configuration steps.

Add an [ad_client] section if you'd like to use an Active Directory domain controller (DC) or LDAP-based directory server to perform primary authentication. This section accepts the following options:

The hostname or IP address of your domain controller or directory server. If this host doesn't respond to a primary authentication request and no additional hosts are specified (as host_2, host_3, etc.) then the user's login attempt fails.

The password corresponding to service_account_username. If you installed the Duo proxy on Windows and would like to encrypt this password, see Encrypting Passwords in the full Authentication Proxy documentation.

The hostname or IP address of a secondary/fallback domain controller or directory server, which the Authentication Proxy will use if a primary authentication request to the system defined as host times out. You can add additional servers as fallback hosts by specifying them as as host_3, host_4, etc.

To further restrict access, specify the LDAP distinguished name (DN) of a security group that contains the users who should be able to log in as direct group members. Nested groups are not supported. Users who are not direct members of the specified group will not pass primary authentication. Example:

LDAP attribute found on a user entry which will contain the submitted username. In most Active Directory configurations, it should not be necessary to change this option from the default value. OpenLDAP directories may use "uid" or another attribute for the username, which should be specified with this option.

The IP address of your primary RADIUS server. If this host doesn't respond to a primary authentication request and no additional hosts are specified (as host_2, host_3, etc.) then the user's login attempt fails.

A secret to be shared between the Authentication Proxy and your existing RADIUS server. If you installed the Duo proxy on Windows and would like to encrypt this secret, see Encrypting Passwords in the full Authentication Proxy documentation.

The IP address of a secondary/fallback primary RADIUS server, which the Authentication Proxy will use if a primary authentication request to the system defined as host times out. You can add additional servers as fallback hosts by specifying them as as host_3, host_4, etc.