[Ended] Round 5 | Technical Document Scavenger Hunt

Dear members,

We are excited to announce the launch of our Technical Document Scavenger Hunt! This activity aims to encourage all users to dive deeper into our newly published technical document in the Knowledge Base, enhancing your understanding and engagement with the material.

By participating, you'll not only sharpen your skills but also have the chance to collaborate and share insights with fellow users.

We hope this scavenger hunt will not only enrich your knowledge but also spark engaging discussions. Happy hunting, and may the best reader win!

1. Activity Rules                                                                                                                     

1)  All community users are invited to participate in the scavenger hunt.

2)  There will be a total of 4 questions related to the SANGFOR IAG v13.0.80 Password-Based Authentication Configuration Guide.

3)  Participants must submit their answers via the designated platform by October 15th.

4)  Winners will be announced next Tuesday on the community platform.

2. Activity Duration                                                                                                               

Oct. 8th - Oct. 14th

3. How to Participate                                                                                                                                                                                                                  

1) Browse the Questions:

We have provided a list of questions based on the content of the document. Your goal is to find the

answers within the text.

2) Read the Document:

Start by simply reading the catalog. Taking your second reading thoroughly with the given questions

which will make you read more efficiently.

3) Use the Search Function:

Most digital documents have a search feature. Use keywords from the questions to quickly locate

relevant sections.

4) Submit Your Answers:

Once you have your answers, post them in the designated thread by the deadline.

5) Collaborate:

Feel free to discuss your findings in the forum and win 100 coins. Sharing thoughts and interpretations can lead to a deeper understanding and may help others in their search.

Entrance: https://community.sangfor.com/forum.php?mod=viewthread&tid=10527

4.  Rewards                                                                                                                             

Correct Answers: 100 coins for each correct answer.

All Correct: An additional 100 coins for those who answer all questions correctly.

5. Scavenger Hunt Questions                                                                                               

Q1: Based on this guide, how to choose the right value for Auth Method and External Auth Server when configuring Authentication Policy?

Q2: What is the path of checking the online users after being authenticated successfully?

Q3: Is it required to enable MAC acquisition across the L3 network if there is a need to bind a MAC address with a local user account?

Q4: Should we bind an IP address if the local network is using DHCP?

Read this document: SANGFOR IAG v13.0.80 Password-Based Authentication Configuration Guide.

6. How to Reply This Post                                                                                                   

Answer the above four questions starting with the following format which will make us work efficiently.

Q1: xxxxx

Q2: xxxxx

Q3: xxxxx

Q4: xxxxx

Note: Try to make it simple! Do not copy the questions when typing your answers.

--------------------------------------------------------------------------------------------------------------------------------------

Recommended Reading                                                                                                          

Round 1 | Technical Document Scavenger Hunt

Round 2 | Technical Document Scavenger Hunt

Round 3 | Technical Document Scavenger Hunt

Round 4 | Technical Document Scavenger Hunt

Congratulations to the following participants on getting coins!

Q1
Summary:
Auth Method: Choose based on the authentication infrastructure (Local, LDAP/AD, or RADIUS).
External Auth Server: Configure based on your external server type (Active Directory, LDAP, or RADIUS).

Q2
Summary:
To check online users after successful authentication in Sangfor IAG, log in to the management console, navigate to Monitoring > Online Users, and view detailed information about authenticated users and their sessions.

Q3
-Key Points:
MAC Binding and User Authentication:

MAC address binding ties a specific device (identified by its MAC address) to a particular user account. This ensures that only the device with the associated MAC address can log in using the corresponding user credentials.
For this feature to work effectively, the IAG needs to be able to acquire and track the MAC addresses of the devices attempting to connect.
-Challenges in L3 Networks:

In a Layer 3 network, devices communicate across different subnets, and MAC addresses are generally not forwarded across these subnets.
Routers (which operate at Layer 3) strip the original MAC address when traffic moves between subnets, and they use the MAC address of the next-hop device (the router interface) instead.
This makes it difficult for the IAG to automatically acquire the correct MAC address of a device in an L3 network unless additional mechanisms are in place.
Enabling MAC Acquisition Across L3 Networks:

To overcome this limitation, MAC acquisition across the L3 network must be enabled.
This feature allows the IAG to collect and recognize the MAC addresses of devices even if they are in different subnets (L3 segments). It typically works by using DHCP snooping, ARP inspection, or other mechanisms to capture the device’s MAC address at Layer 2 and associate it with the Layer 3 IP traffic.
Why It's Required:
Without enabling MAC acquisition, the IAG would not be able to consistently capture and bind the correct MAC address to the local user account, especially in an L3 environment where the traffic passes through routers and the original MAC address might not be visible to the IAG.
Steps to Enable MAC Acquisition (General Guidelines):
Log in to the IAG Web Management Console.

Navigate to the "Network Configuration" section.

Look for the MAC Acquisition or MAC Binding Settings:

Enable MAC acquisition across the L3 network.
You may need to configure additional features like DHCP snooping or ARP inspection depending on the network architecture.
Test the Configuration:

Q4 :
In a DHCP-based network, it is not advisable to bind an IP address to a user account because the dynamic nature of DHCP can cause IP changes, leading to failed authentications and increased management overhead. Instead, opt for MAC address binding or use credential-based authentication methods.

Q1:  On the Auth Method tab, select Password based for the Auth Method andLocal user database for External Auth Server

Q2: This will appear in online user . Go to Status and Users

Q3: Yes its must be L3 Network

Q4: No need to Bind the IP address

Q1: According to the guide, when configuring Authentication Policy, you should select "Password based" for the Auth Method and "Local user database" for the External Auth Server.

Q2: After being authenticated successfully, you can check the online users by navigating to the Status > Users page.

Q3: Yes, if there is a need to bind a MAC address with a local user account and the local area network is an L3 environment, it is required to enable MAC acquisition across the L3 network.

Q4: No, if the local network is using DHCP, you should not bind with an IP address.

Q1: On the Auth Method tab, select Password based for the Auth Method and
Local user database for External Auth Server.
Q2: After being authenticated successfully, the user will appear on the Online Users
list. You can navigate to the Status > Users page to see the user details.
Q3: It is required.
Q4: Do not bind

Q1: On the Auth Method tab, select Password based for the Auth Method and Local user database for External Auth Server.
Q2: Status > Users
Q3: Yes, required to enable MAC acquisition
Q4: If the local network is using DHCP, do not bind with an IP address

Q1: Auth Method used Password based and  External Auth Server used local user database

Q2: Status > Users

Q3: Yes, it is required

Q4: No need to bind with IP address

Q1: Select Password based for the Auth Method and Local user database for External Auth Server.
Q2: The user will appear on the Online Users list. You can navigate to the Status > Users page to see the user details
Q3: Yes
Q4: No

Q1: When you are configuring the authentication policy, on the Auth Method tab, select Password based for the Auth Method and Local user database for External Auth Server
Q2: You can navigate to the Status > Users page to see the user details.
Q3: If there is a need to bind a MAC address with a local user account, please ensure that the local area network is an L3 environment. If so, it is required to enable MAC acquisition across the L3 network
Q4: If the local network is using DHCP, do not bind with an IP address

Q1: choose password based for Auth method, and choose local user database for external auth server
Q2: Status -> Users
Q3: yes it is required
Q4: NO, do not bind

Q1: Navigate to Access Mgt > Authentication > Web Authentication >
Authentication Policy. On the Auth Method tab, select Password based for the Auth Method and Local user database for External Auth Server
Q2: Status > Users page to see the user details
Q3: Yes
Q4: No