Product Documentation
下載:PDFPRINT

Configuring the Authentication Virtual Server

Aug 13, 2014
To configure AAA, first configure an authentication virtual server to handle authentication traffic. Next, bind an SSL certificate-key pair to the virtual server to enable it to handle SSL connections. For additional information about configuring SSL and creating a certificate-key pair, see the Citrix NetScaler Traffic Management Guide at "Traffic Management."

To configure an authentication virtual server by using the command line interface

To configure an authentication virtual server and verify the configuration, at the command prompt type the following commands in the order shown:
  • add authentication vserver <name> ssl <ipaddress>
  • show authentication vserver <name>
  • bind ssl certkey <certkeyName>
  • show authentication vserver <name>
  • set authentication vserver <name> -authenticationDomain <FQDN>
  • show authentication vserver <name>

Example 

> add authentication vserver Auth-Vserver-2 SSL 10.102.29.77 443 
 Done 
> show authentication vserver Auth-Vserver-2 
        Auth-Vserver-2 (10.102.29.77:443) - SSL Type: CONTENT 
        State: DOWN[Certkey not bound] 
        Client Idle Timeout: 180 sec 
        Down state flush: DISABLED 
        Disable Primary Vserver On Down : DISABLED 
        Authentication : ON 
        Current AAA Users: 0 
 Done 
> bind ssl certkey Auth-Vserver-2 Auth-Cert-1 
 Done 
> show authentication vserver Auth-Vserver-2 
        Auth-Vserver-2 (10.102.29.77:443) - SSL Type: CONTENT 
        State: UP 
        Client Idle Timeout: 180 sec 
        Down state flush: DISABLED 
        Disable Primary Vserver On Down : DISABLED 
        Authentication : ON 
        Current AAA Users: 0 
        Authentication Domain: myCompany.employee.com 
 Done 
> set authentication vserver Auth-Vserver-2 -AuthenticationDomain myCompany.employee.com 
 Done 
> show authentication vserver Auth-Vserver-2 
        Auth-Vserver-2 (10.102.29.77:443) - SSL Type: CONTENT 
        State: DOWN[Certkey not bound] 
        Client Idle Timeout: 180 sec 
        Down state flush: DISABLED 
        Disable Primary Vserver On Down : DISABLED 
        Authentication : ON 
        Current AAA Users: 0 
        Authentication Domain: myCompany.employee.com 
 Done

To configure an authentication virtual server by using the configuration utility

  1. Navigate to Security > AAA - Application Traffic > Virtual Servers.
  2. In the details pane, do one of the following:
    • To create a new authentication virtual server, click Add.
    • To modify an existing authentication virtual server, select the virtual server, and then click Edit.
    The Configuration dialog opens with the Basic Settings area expanded.
  3. Specify values for the parameters as follows (asterisk indicates a required parameter):
    • Name*—name (Cannot be changed for a previously created virtual server)
    • IP Address*—ipaddress
    • Domain*—authenticationDomain
    • Failed login timeout—failedLoginTimeout (Seconds allowed before login fails and user must start login process again.)
    • Max login attempts—maxLoginAttempts (Number of login attempts allowed before user is locked out)
    Note: The authentication virtual server uses only the SSL protocol and port 443, so those options are greyed out. Any options that are not mentioned are not relevant and should be ignored.
  4. Click Continue to display the Certificates area.
  5. In the Certificates area, configure any SSL certificates you want to use with this virtual server.
    • To configure a CA certificate, click the arrow on the right of CA Certificate to display the CA Cert Key dialog box, select the certificate you want to bind to this virtual server, and click Save.
    • To configure a server certificate, click the arrow on the right of Server Certificate, and follow the same process as for CA certificate.
  6. Click Continue to display the Advanced Authentication Policies area.
  7. If you want to bind an advanced authentication policy to the virtual server, click the arrow on the right side of the line to display the Authentication Policy dialog box, choose the policy that you want to bind to the server, set the priority, and then click OK.
  8. Click Continue to display the Basic Authentication Policies area.
  9. If you want to create a basic authentication policy and bind it to the virtual server, click the plus sign to display the Policies dialog box, and follow the prompts to configure the policy and bind it to this virtual server.
  10. Click Continue to display the 401-Based Virtual Servers area.
  11. In the 401-Based Virtual Servers area, configure any load balancing or content switching virtual servers that you want to bind to this virtual server.
    • To bind a load balancing virtual server, click the arrow to the right of LB virtual server to display the LB Virtual Servers dialog box, and follow the prompts.
    • To bind a content switching virtual server, click the arrow to the right of CS virtual server to display the CS Virtual Servers dialog box, and follow the same process as to bind an LB virtual server.
  12. If you want to create or configure a group, in the Groups area click the arrow to display the Groups dialog box, and follow the prompts.
  13. Review your settings, and when you are finished, click Done. The dialog box closes. If you created a new authentication virtual server, it now appears in the Configuration window list.