You configure WinSec Controller through its web-based Management Console. We strongly recommend using the console for configuration and administration activities. The procedures here assume that you are logged in to the Management Console. For details about accessing the WinSec Controller console, see Accessing the WinSec Controller Management Console.

You can clear all fields in a form in the Management Console by clicking Reset.

Before you begin, ensure that your WinSec Controller and all peer appliances meet the minimum hardware and software requirements. See About peer appliance hardware and software requirements.

Configure the WinSec Controller first, and then configure the SteelHeads. Here’s some of the information you’ll need on hand while configuring WinSec Controller:

If the WinSec Controller is located behind a firewall, you’ll need to configure the firewall to allow traffic through these ports:

WinSec Controller base interfaces are its primary and auxiliary interfaces. Routing tables are necessary when the WinSec Controller and peer SteelHead appliances are located on different subnets. When that is the case, you’ll need to connect the WinSec Controller and SteelHeads by configuring static routes between them on each appliance. If the WinSec Controller and your Active Directory, or domain controller, also are not on the same subnet, you’ll need to configure an additional static route for connectivity.

You can use DHCP on the primary interface if you ensure the IP configuration on the DHCP server is tied to the WinSec Controller’s primary MAC address.

The WinSec Controller and its peer SteelHeads communicate and optimize traffic through their primary interfaces. Connect the primary interface on each appliance to the data plane. We recommend that you manually configure this interface with a static IP address.

The Management Console and SSH access use the auxiliary interface. Connect this interface to your management network. The default configuration for this interface uses DHCP. After the WinSec Controller is powered on, it will attempt to fetch a DHCP lease through this interface.

For non-DHCP environments, you can use a restricted CLI to configure interfaces with limited functionalities. See About WinSec Controller CLI commands.

To return to the default values, click Reset.

Route configuration uses standard Linux conventions. All routes, including those automatically created during base interface configuration, are displayed in the Main IPv4 Routing Table.

To remove a route, select it and click Remove selected.

Unified interface mode is useful in environments where many peer SteelHeads and Domain Controllers are spread across several subnets. Normally, connecting these appliances would require the manual configuration of many static routes. When this feature is enabled, all traffic (management and data) flows through the primary interface. The primary interface becomes the default interface, and the auxiliary interface is disabled. With all traffic flowing through the primary interface, you do not need to configure static routes on WinSec Controller for each peering SteelHead subnet.

This feature can be configured in the web interface or through the CLI, and it can be configured prior to bootstrapping the appliance.

You can configure some interface functionalities, such as enabling and disabling unified interface mode, through the WinSec Controller CLI.

These are the supported CLI commands:

For more details about using CLI commands, see the Riverbed Command-Line Interface Reference Manual.

WinSec Controller host settings include these items:

We strongly recommend that you also add a Network Time Protocol (NTP) server. Your domain controller can also serve as your NTP server.

NTP server settings include these items:

To remove a server, select it from the list, and then click Remove selected.

WinSec Controller communicates with peer appliances through an IPsec secure tunnel. You can choose one of these two methods for authentication: shared secret or self-signed certificate. Remember to verify the certificate if you choose the self-signed certificate method.

To establish a peering relationship, you’ll need to configure peering on the WinSec Controller and on the server-side SteelHead. For details, see Configuring WinSec Controller Peers.

Perfect forward secrecy (PFS) is a feature of key agreement protocols that protects session keys from being compromised even if long-term secrets used in the session key exchange are compromised. PFS protects past sessions against future compromises of keys or passwords. When this feature is enabled, the WinSec Controller will renegotiate keys at specified intervals. If one key is compromised, subsequent keys are secure because they’re not derived from previous keys.

The WinSec Controller secure vault encrypts and stores SSL certificates and replication user data.

You’ll need to supply the server domain of the replication server, and you can choose whether to specify domain information for the Kerberos replication user domain. WinSec Controller requires one Kerberos Replication Account per domain to support cross domain authentication. If you do not specify user domain information, the system will assume that the user domain and server domain are the same.

When specifying domain names, you can use the wildcard character (*) to include all child domains.

After you configure replication users, you can test key and account replication to ensure your configurations are correct.

About WinSec Controller key and password replication tests.

Click Finish if the correct groups and users appear with the permissions Replicating Directory Changes and Replicate Directory Changes All.

You can view detailed statistics on replication activities on the Statistics > Replication page. You can filter reports by response code, domain, source, response time, time, and SPN. Filters are additive.

You can search for key terms. The contents of the table, except the contents of the Time column, are searchable. Key terms must be alphanumeric and can include these special characters: underscore (_), hyphen (-), period (.), and forward slash (/). Regex and phrases are not allowed. Search is case sensitive.

If the contents of the table become too large, you can remove statistics older than the date you specify.

For details about reports, see Viewing WinSec Controller Statistics.

Run the Replication test to determine if WinSec Controller can replicate keys from the Active Directory server or a domain controller.

You can configure the system to send logs to remote log servers. You can configure multiple destination servers, and you can enable or disable each one separately. Available transport modes are UDP, TCP, and TLS.

For TLS mode, first add certificates in Administration > Certificate Management. Add the trusted CA certificate in the Certificate Authority section, and then add a client certificate signed by the trusted CA to the Remote Logging section. Then those certificates will appear for selection while configuring remote log forwarding.

After you add the certificates, they are available as options when configuring remote logging in TLS mode.

Before configuring remote logging, you need to add remote servers to the WinSec Controller.

You can add and remove any of these types of certificates in the Certificate Management page:

Adding a trusted Web UI certificate is particularly useful as it obviates the need to add exceptions for the Management Console in your browser’s settings. See Accessing the WinSec Controller Management Console. After you add a Web UI certificate, the system logs you out and restarts the Management Console service.

For Web UI and SMTP certificates, adding a new certificate overwrites the previous certificate—only one certificate at a time is supported.

For self-signed certificates, you can view the certificate details and generate new certificates.

To remove a certificate, select the certificate, and then click Remove Selected.

You can enable and disable the account control feature in the Password Policy page. The account control feature enables you to specify the number of login attempts a user can try before being locked out. You can also specify in seconds the duration of the lockout period.

Email notifications are used for resetting a user’s password if they have forgotten it. By default, the WinSec Controller will use the domain name in the user’s email address to form the FQDN of the email server. If your organization uses a custom hostname or port (the default is port 25) for your email server, you can configure the WinSec Controller to use your custom settings.

If your email server is configured to use SSL, you can add your own SMTP certificate to the WinSec Controller and enable the SSL option. When the SSL option is not enabled, or when it is enabled and you do not add your own SMTP certificate, the WinSec Controller uses a self-signed certificate. For details about certificates, see About WinSec Controller certificates.

You set up Security Assertion Markup Language (SAML) in the Administration > SAML page.

WebUI access defaults to “local auth.” Enabling SAML disables “local auth” on WebUI access.

Security Assertion Markup Language (SAML) 2.0 is an XML standard that acts as an authentication interface between the WinSec Controller and an identity provider (IdP). You can use the IdP to provide additional requirements for authentication, such as a multifactor authentication based on a common access card (CAC) or personal identity verification (PIV).

When the WinSec Controller receives a login request, it determines if SAML is enabled. If SAML is enabled, user authentication through AAA is disabled and the WinSec Controller redirects the authentication request to the IdP. The IdP authenticates the user and redirects the user to the WinSec Controller, which allows access.

To enable IdP authentication, you configure the WinSec Controller and the IdP with XML metadata that provides detailed appliance identification. The metadata also establishes a trust relationship between the WinSec Controller and the IdP.

Administrators must add users to the IdP server to provide them login access, and those users need to correspond to the WinSec Controller users. You can have one-to-one mapping of users between IdP and the WinSec Controller, or you can have multiple users on IdP map to single account on the WinSec Controller, such as the admin account. (You have to create individual user accounts on the WinSec Controller for one-to-one mapping as the user accounts determine the access permissions.)

If a user who has not been set up in the IdP tries to log in to the WinSec Controller, the login fails on the IdP login page. If the user has been set up but their user mapping has not been defined in the IdP, the login succeeds but the WinSec Controller displays an error page.

If you cannot log in using SAML (for example, if the IdP server is unavailable), you can log in through the CLI and disable SAML using the no enable saml command. Once SAML is disabled, you revert to the previously configured authentication method for the web interface. For command details, see the Riverbed Command-Line Interface Reference Manual.

You must be logged in as the administrator to enable or disable SAML.

You can create roles for specific types of users and activities. For example, you might create a role for a small group of network admins, empowering that role to change network-related settings but limiting access to security settings like certificate management.

For custom roles, you can set permissions to read only, read and write (edit), or deny. These items are read-only for all roles and users: dashboard, help, and pending actions. Users assigned the admin role can change the password policy and licenses, and you can provision edit permission for those settings to a custom role, but we recommend limiting edit access to admin users.

Four default roles, which cannot be modified, provide convenient starting points:

To edit or remove a custom role, you need to select it. Click the row to edit that role, enter updated values, and click Submit. Click Remove selected row to delete it.

You can add and remove users. You can also change a user’s role, email, full name, description, and password.

To remove a user account, select the account and click Remove selected row.