Configuring Authentication Servers for Remote Access

1. In the RADIUS Servers section, click Configure.

2. In the Primary tab, configure the Primary RADIUS server:

   • IP address - The IP address of the Primary RADIUS server.

   • Port - The number of the listening port on the Primary RADIUS server. The default is 1812.

   • Shared secret - The secret (pre-shared information used for message "encryption") between the Primary RADIUS server and the Quantum Spark Gateway.

     Notes: You cannot use these characters in a password or shared secret: { } [ ] ` ~ | ‘ " \ (maximum number of characters: 255) Select Show to see the shared secret.

   • Timeout (seconds) - A timeout value in seconds for communication with the RADIUS server. The default timeout is 3 seconds.

   Note - To remove all settings, click Clear.

3. Optional: In the Secondary tab, configure the Secondary RADIUS server:

   • IP address - The IP address of the Secondary RADIUS server.

   • Port - The number of the listening port on the Secondary RADIUS server. The default is 1812.

   • Shared secret - The secret (pre-shared information used for message "encryption") between the Secondary RADIUS server and the Quantum Spark Gateway.

     Notes: You cannot use these characters in a password or shared secret: { } [ ] ` ~ | ‘ " \ (maximum number of characters: 255) Select Show to see the shared secret.

   • Timeout (seconds) - A timeout value in seconds for communication with the RADIUS server. The default timeout is 3 seconds.

   Note - To remove all settings, click Clear.

4. Click Save.

5. Enable the Remote Access permissions for RADIUS users:

   1. In the line Remote Access permissions for RADIUS users are disabled, click the link permissions for RADIUS users.

      The RADIUS Authentication window opens.

   2. Select User Awareness, Remote Access and Hotspot.

   3. Optional: Select For Remote Access use specific RADIUS groups only and enter the names of the applicable RADIUS groups.

   4. Click Save.

1. In the Active Directory section, click New.

2. Configure the Active Directory Domain settings:

   • Domain - The domain name.

     You can configure this domain only one time.

   • IP address - The IPv4 address of one of the Active Directory domain controllers of your domain.

   • User name - The username to connect to the Active Directory domain controller. This user must have administrator privileges to ease the configuration process and create a user-based policy using the users defined in the Active Directory.

   • Password - The user's password to connect to the Active Directory domain controller.

     Note - You cannot use these characters in a password or shared secret: { } [ ] ` ~ | ‘ " \ (maximum number of characters: 255)

   • User DN - The user's FQDN. Click Discover for automatic discovery of the DN of the object that represents that user or enter the user DN manually.

     For example: CN=John James,OU=RnD,OU=Germany,O=Europe,DC=Acme,DC=com

   • Optional: Select Use user groups from specific branch only if you want to use only part of the user database defined in the Active Directory:

     1. Click New.

     2. Enter the full DN of the applicable Active Directory branch.

     3. Click Save.

3. Click Save.

4. Configure how to synchronize Active Directory groups from the Active Directory domain controller:

   1. In the Active Directory section, click Configure.

   2. Select the applicable option:

      • Automatic synchronization (this is the default, runs every 24 hours)

      • Manual synchronization

        Note - You can synchronize the user database in all locations in WebUI where this user database can be viewed. For example: The Users & Objects view > Users Management section > Users page. The Access Policy view > Firewall section > Policy page. In the Incoming, Internal and VPN Traffic section > the Source column > click [+]. Note - You cannot select a user from the Active Directory, only an Active Directory user group.

   3. Click Save.

5. Enable the Remote Access permissions for Active Directory users:

   1. In the line Remote Access permissions for Active Directory users are set in the Remote Access Users page, click the link permissions for Active Directory users.

      The Active Directory Global Permissions window opens.

   2. Select the applicable option:

      • All users in Active Directory

        Note - Most Active Directory domains contain a large list of users. Consider limiting the Remote Access VPN permissions only to specific user groups.

      • Selected Active Directory user groups (this is the default)

        Note - Requires additional configuration. FollowConfiguring Remote Access Users.

   3. Click Save.

Remote Access VPN users enter their Microsoft Entra ID credentials to connect to the Quantum Spark Gateway and access the internal resources.

This is easier than using specific credentials only for the Quantum Spark Gateway.

The administrator can manage user groups and enforce authentication methods such as Single Sign-On (SSO) and Two-Factor Authentication (2FA) in the Microsoft Entra ID portal.

In the advanced use case, you can override the Route Internet traffic from connected clients through this Security Gateway global configuration for specific groups in Microsoft Entra ID. For more information about Route Internet traffic from connected clients through this Security Gateway, see Configuring Advanced Remote Access Options.

1. A Remote Access VPN user wants to access internal resources located behind the Quantum Spark Gateway using Remote Access VPN.

2. The SAML portal of the Quantum Spark Gateway redirects the user to the SAML Identity Provider (IdP) for authentication.

3. The IdP asks the remote user for credentials according to the policy you configure in the IdP portal.

   For example, you can configure Single Sign-On (SSO) to recognize that a user is already signed in, or require Two-Factor Authentication (2FA).

4. The IdP authenticates the user and sends a SAML assertion to the user's web browser.

5. The remote user's web browser sends the SAML assertion to the Quantum Spark Gateway.

6. The Quantum Spark Gateway validates the SAML assertion and allows the remote user to access internal resources.

• Only one IdP configuration is supported. For example, if your organization has two Microsoft Entra ID environments, you can use only one of them as a SAML Identity Provider

• It is not supported to create Access Control Rules for users who authenticate with the SAML Identity Provider.

• Microsoft Entra ID Identity Tags are not supported.

Keep the Azure Portal and the Quantum Spark Gateway WebUI open throughout this procedure.

1. In the Azure Portal, create a SAML application for the Quantum Spark Gateway:

   1. Click Enterprise Application.

   2. Click New application.

   3. Click Create your own application.

      The Create your own application window opens.

   4. Enter a name for the application.

   5. Make sure this default option is selected:

      Integrate any other application you don't find in the gallery (Non-gallery)

   6. Click Create.

2. In the Azure Portal, assign users or groups of users to the SAML application:

   1. On the Overview page for the application, in the Getting Started section, click Assign users and groups.

   2. Click add user/group.

   3. Select users and groups.

   4. Click Assign.

3. In the Azure Portal, navigate to the SAML-based Sign-on screen for your application:

   1. In the left menu, expand Manage.

   2. Click Single sign-on.

   3. Select SAML.

   4. In the Basic SAML Configuration section, click the edit (pencil) icon.

      The Basic SAML Configuration window opens.

4. In the Quantum Spark Gateway WebUI, from the left navigation panel, click the VPN view.

5. In the Remote Access section, click the Authentication Servers page.

6. In the Identity Provider section, click Configure.

   The Configure Identity Provider window opens.

7. In the Data required by the SAML Identity Provider section, follow these steps:

   1. Copy these values from the Quantum Spark Gateway WebUI and paste them in the Azure portal > Basic SAML Configuration window:

      • Copy the Unique identifier URL value from the Quantum Spark Gateway WebUI and paste it in the Azure portal in the Identifier (Entity ID) field.

      • Copy the Reply URL from the Quantum Spark Gateway WebUI and paste it in the Azure portal in the Reply URL (Assertion Consumer Service URL) field.

      Note - By default, the WebUI generates these values based on the DDNS settings in the Device view > System section > DDNS & Device Access page. If you did not configure DDNS, these values are based on the appliance's public IP address. If you did not configure DDNS for a cluster, these values are based on the cluster's Virtual IP Address (VIP).

   2. Optional: You can override the DDNS or IP address of the Quantum Spark Gateway:

      • To use a static IPv4 address instead of DDNS, select Override DDNS/IP and enter an IPv4 address.

        The Quantum Spark Gateway WebUI generates a new Unique identifier URL and Reply URL based on the IPv4 address.These fields are automatically generated the first time the user configures the identity provider object on the gateway.

        If DDNS was configured before, these fields are created with the domain name. Otherwise, they are created with the gateway’s IP.

      • To use DDNS instead of a static public IP address for the Unique identifier URL and Reply URL, select Override DDNS/IP and enter a DDNS.

      Example: You configured DDNS but want to use an IP address for the Unique Identifier URL and the Reply URL. After you select the checkbox Override DDNS/IP and enter an IP address, the values of the Unique Identifier URL and the Reply URL change, because they are now based on the IP address, not the DDNS.

   3. In the Azure portal > Basic SAML Configuration window, click Save.

8. In the Data received by the SAML Identity Provider section, select and configure the applicable option:

   • Import Metadata File

     1. In the Azure Portal >SAML Certificates section, next to Federation Metadata XML, click Download.

        Your computer downloads the metadata file.

     2. In the Quantum Spark WebUI > Data received from SAML Identity Provider section, next to Metadata file, click Upload.

     3. On your computer, select the metadata file and click Open.

   • Insert manually

     1. In the Azure portal > Set up [NAME OF YOUR APPLICATION] section, copy the Microsoft Entra Identifier.

     2. In the Quantum Spark Gateway WebUI > Data received from the SAML Identity Provider section, paste the Microsoft Entra Identifier you copied from the Azure portal.

     3. In the Azure portal > Set up [NAME OF YOUR APPLICATION] section, copy the Login URL.

     4. In the Quantum Spark Gateway WebUI > Data received from the SAML Identity Provider section, paste the Login URL you copied from the Azure portal.

     5. In the Azure portal >SAML Certificates section, next to Certificate (Base64), click Download.

        Your computer downloads the certificate file.

     6. In the Quantum Spark Gateway WebUI > Data received from SAML Identity Provider section, next to Certificate, click Upload.

     7. On your computer, select the certificate file and click Open.

9. In the Quantum Spark Gateway WebUI, click Save.

10. There are two possible deployment scenarios:

    • The Quantum Spark Gateway is already installed and has an existing Remote Access community with a different authentication method, and the administrator wants to change the method to "SAML User."

      1. Instruct members of the Remote Access community to disconnect from the site and connect again. Select "SAML User" as the preferred login option.

      2. The user, on connecting to the Gateway, is redirected to Azure to enter their Azure credentials.

      3. On verification, the Remote Access User gets access to corporate resources.

    • The Quantum Spark Gateway is already installed but has no Remote Access community and the administrator creates it for the first time.

      1. Instruct members of the Remote Access community to create the site with the Quantum Spark Gateway as the URL. ("SAML User" is already set as the default authentication method).

      2. The user, on connecting to the Gateway, is redirected to Azure to enter their Azure credentials.

      3. On verification, the Remote Access User gets access to corporate resources.

    For more information, see:

    • Remote Access VPN Clients for Windows Administration Guide > "Getting Started with Remote Access Clients" > "Helping Users Create a Site"

    • Endpoint Security VPN for macOS Administration Guide > "Helping Your Users" > "Helping Users Create a Site".