Jump to:navigation, search
Wiki

































De.png
En.png
Fr.png






Configure UTM via the Unified Security Console
Last adaptation to the version: 12.6.2
New:
Last updated: 
02.2024
notempty
This article refers to a Resellerpreview

v12.5.2

Requirements

  • At least version 12.2 is required
  • A user account from the Reseller Portal is required.
    In order to also be able to make changes, it is necessary to link the user access when logging into the Unified Security Portal for the first time.
    USC v1 RSP-Account verknüpfen-en.png
  • The license must be clearly assignable to a UTM
    • Cluster licenses must be reloaded from the reseller portal and assigned separately to the master or spare so that they are unique in the USC. notempty
      New as of: 12.6.2
  • The UTM must have access via https to the Unified Security infrastructure
  • The UTM does not have to, but can be reachable from outside
    (Exception: The function Security Scan)
    No connection is established from outside to the UTM
    The UTM logs itself into the Unified Security Portal and retrieves configuration changes and commands.
    The settings in the portal are therefore not executed in real time, but with a small delay.
  • Currently not yet available for all Wortmann/Terra licenses!


  • Preparations

    Enabling the control via the Unified Security Console

    Unified Security Console UTMuser@firewall.name.fqdn UTM v12.6.2 USC aktivieren-en.png

    notempty
    From version v12.6, this function is also available for cluster licenses (v12.6.0)
  • Note for cluster licenses:
    In order for both cluster members to be assigned to each other, special new licenses must be registered on both devices.
    Menu Extras Register Button Import license file
      
    To do this, two licenses must be downloaded from the reseller portal.
    If no license is marked as xynnnnn-SPARE in the reseller portal (matching licenses have an identical color marking on the left side of the table), please send an email to lizenzen@securepoint.de with customer name, customer number and the serial numbers of the devices or, in the case of VMs, with the license ID.
  • Access by then Unified Security Console must first be enabled in the UTM itself in the menu USC .
    The UTM reports to the license server after the update. Here, the availability of the service is indicated and the menu is activated.

    notempty
    Attention: It usually takes a few minutes, in unfavorable cases up to an hour, before the menu is displayed for the first time.

    The process can be shortened by executing the command system restrictions update on the CLI after a few minutes of runtime (the UTM must have had the opportunity to report to the license server!).

    Caption Value Description UTM v12.6.2 USC synchronisiert-en.png
    Privacy Policy: Yes The privacy policy must be accepted
    Activated: Yes This activates the Unified Security Console - and thus the display, configuration and access via the Securepoint Unified Security portal.
    Apply USC profiles: notempty
    New as of: v.12.6.2
    Yes USC profiles can only be used for this UTM after activation
    Authentication method:

    PIN (recommended)Login mask

    Authentication method for a web session
    PIN: •••••••• As authentication for a web session, a 6-digit PIN can be selected instead of the login mask with access data.
    • The pin must not consist of equal numbers
    • The pin must not consist of series of numbers (123456, 876543 etc.)
    • Pins that resemble a date (230508) or contain very simple number combinations are marked as »very weak«.
      
    Displays the Websession PIN
    Creates a new PIN
    The entered PIN is incorrect After 5 incorrect entries in a row, access is blocked.
    The block is only lifted again after correct login directly at the admin interface.
    Actions that can only be executed with a PIN:
    •  Reboot
    •  Shut down
    •  Restore factory settings
    • Cloud Backup  Restore
    •  Start new websession


    USC in the portal





    Note on Two-Factor Authentication

    MS 1.24 2FA-fehlt InfoDialog-en.png
    An information dialog with instructions on how to activate two-factor authentication.
    notempty
    As of version 1.24, USP administrators are required to use two-factor authentication as an additional security measure. You should activate two-factor authentication in your user account before the release of version 1.24, otherwise the login to USP will be blocked until two-factor authentication is activated. From version 1.24, activation is also possible via the login screen.
    Two-factor authentication must be activated by then.

    Activation of two-factor authentication

    The activation of two-factor authentication depends on the type of user account:

    • If the user account is linked to the reseller portal and the RSP label is visible on the user account, two-factor authentication is activated via the Resellerportal
    • If the user account only exists in the portal, it is activated via User options reset password
    • A redirection to the necessary 2FA activation takes place via the button Enable 2FA in the information banner
    MS 1.22 2FA-E-Mail.png
    Fig.1
    • The user receives the following e-mail
    • Click on the link here
    MS 1.22 2FA Passwort-ändern.png
    Fig.2
    • Enter a new password
    • Confirm the password with the Change password button
    MS 1.22 2FA QR-Code.png
    Fig.3
    • Enter the displayed TOTP code in an authenticator app or scan the displayed QR code with an authenticator app
    • The two-factor authentication activation process for the user is now completed














    Login to the portal

    MS 1.24 Login-en.png
    MSP v1.5.3 Kundenauswahl-en.png

    Only a few steps are necessary for end customers to log into the portal:

    • Assign the × admin role to an user in the customer's tenant.
      The permissions will then be assigned automatically.
      If necessary, create a new user as described in User Management.
    • Call up the login page for the Securepoint Mobile Security Portal.
    • Selection of the option Login with Securepoint Unified Security account
    • Login with
    Tenant Domain can be found as part of the URL behind the word tenant. https://portal.securepoint.cloud/…-tenant-123456.sms-…123456.sms
    Username
    Password
    Password forgotten? notempty
    New as of: 1.24
    This link opens a dialog that allows you to reset the password. A password reset email will be sent to the user.
  • The registration now takes place exclusively in the tenant of the assigned customer.
    No information about other customers of the reseller can be viewed.

  • Two-factor authentication

    notempty
    New as of:1.24
    Dialog for entering the TOTP

    After successfully entering the login data, an input dialog for the TOTP of the two-factor authentication appears.
    Once the TOTP has been entered correctly, the login to the portal takes place automatically.





    Call USC

    USC v1.17 UTMs-en.png

    The Unified Security Console is accessed via the Securepoint Unified Security Portal at https://portal.securepoint.cloud

    Clicking on the device tile opens the device details.

  • The button should be used to change the default name in the device tile.
    Securepoint recommends assigning a unique name according to a clear structure.


  • Status Overview

    Show status in tile overview:

    Status Description
    Connected The UTM can reach the USC portal
    Disconnected The portal does not receive a message from the UTM
    USC active Is active if the Unified Security Console service is enabled    on the UTM in the  Unified Security Console menu.
    USR active Unified Security Report is configured and is sent out
    Update available There is an update on the UTM that can be installed
    Update highly recommended There is a security update that should be installed immediately!
    Cluster a1b2 Device belongs to a cluster license. The ID can be used to clearly identify cluster licenses that belong together.
    The hex number corresponds to the first 4 digits of the license_cluster_id, which can be found with the CLI command system info
      


    Detail display

    USC UTM-Details-en.png

    The detail display provides an overview of the most important states and messages for the UTM:

    • Hardware and software of the UTM
    • Messages from the Unified Security Report (if this option has been booked in the Reseller Portal)
    • An overview with information about the hardware status:
      • Memory usage
      • CPU utilization
      • Hard disk space used
    • Details on upgrade / rollback options
    • Display of the device location on a map (manual collection, no tracking)
    • License information
    • Information from the reseller portal about the company assigned to the license

    Operations

    Operations
    Device
    Action Description USC 1.23.17 UTMs Operationen-en.png

    1. After clicking the button Rollback to xy a security prompt appears USC 1.11 UTMs Rollback Sicherheitsabfrage-en.png
    2. The process is started USC 1.11 UTMs Dryrun pending-en.png
    3. After a successful reboot, the rollback version can be finalized and thus also set as the future boot version USC 1.11 UTMs Rollback finalisieren-en.png
    4. After clicking the button Finalize the new version xy another security prompt appears USC 1.11 UTMs Rollback finalisieren Sicherheitsabfrage-en.png
    5. Notification: Rollback finalized (is displayed briefly or call via in the title bar) USC 1.11 UTMs Rollback finalisiert-en.png


    1. After clicking on the Schedule one-time update button, a new window appears USC 1.23.17 UTMs Operationen Einmaliges-Update-planen 1-en.png
    2. After a date has been selected, it is saved with the   Save button USC 1.23.17 UTMs Operationen Einmaliges-Update-planen 2-en.png


     Reboot PIN recommended Performs a restart of the UTM
     Shut down PIN recommended Shuts down the UTM
  • Starting the UTM via the USC when powered off is not possible! This requires physical access to the unit.
  • Firmware
     Restore factory settings PIN recommended Restores the factory settings
  • Attention, the UTM will not contact the USC by itself afterwards
  •  Rollback to version 12.x.y Performs a rollback to the previously installed version
     Plan a one-time update notempty
    New as of: 1.23.1
    A one-time firmware update can be planned
    Regular updates can be configured in the UTM profiles. This Wiki article describes this configuration

    Cluster

    Cluster notempty
    New as of v12.6
    Information on the cluster:
    Cluster-UUID, Status, Cluster-Version (Firmware version of the cluster partner),
    Synchronization status und License serial number
    Click on Go to other cluster UTM to go to the other cluster partner.
    In order for both cluster members to be assigned to each other, special new licenses must be registered on both devices.
    Menu Extras Register Button Import license file
      
    To do this, two licenses must be downloaded from the reseller portal.
    If no license is marked as xynnnnn-SPARE in the reseller portal (matching licenses have an identical color marking on the left side of the table), please send an email to lizenzen@securepoint.de with customer name, customer number and the serial numbers of the devices or, in the case of VMs, with the license ID.
    USC Reiter Cluster.png







    Websession

    Websession
     Start new websession Opens the dialog to start the administrative web interface of the UTM USC Reiter Websession-en.png
    Websession with UTM up to v12.5.0

    notempty

    An update to the latest version is recommended

    IP address All interfaces with IP addresses on the UTM are offered in the drop-down menu.
    It is also indicated whether the IP addresses are public or local.

    Interface with a public IP address

    203.0.113.203 (A0) [Public]

  • A Websession PIN is required (see below)
  • If the first login 'after the first update of the UTM to a version 12.5.x via a web session, the initial PIN 000000 is valid.
    The PIN must be changed at the first login.
  • Interface with private IP address

    192.168.12.50 (A1) [Local]

    • A link to the local administration web interface will be provided
  • User credentials with administrator rights for the UTM are required
  • The own IP must be registered as manager IP on the UTM
  • A connection in the local network to the UTM is required
  • USC 1.17 Websession PIN-en.png
    Web session with PIN (UTM up to v12.5.0)
    Port 11115
    Port through which the admin interface of the UTM can be reached (is read from the settings of the UTM under Network Server Settings )
    PIN: ••••••••
    Websession PIN (Configured on the UTM in the USC menu in the Unified Security Console section
    The entered PIN is incorrect
    After 5 incorrect entries in a row, access is blocked.
    The block is only lifted again after correct login directly at the admin interface.
    Version Version
    Currently used firmware version
     Start new websession PIN Opens the admin interface of the UTM in a new tab of the used browser
  • Pop-ups may need to be allowed for portal.securepoint.cloud in the browser used!
  • Web session with PIN
    notempty
    Websession with PIN (UTM from v12.5.1)
    The connection is established via the interface on which the default route of the UTM is set up.
    User admin
    If there is no user with the name admin, a user with admin rights can be selected here with whom the web session connection is to be started.
    USC v1.23 Websession PIN-en.png
    Web session with PIN (UTM as of v12.5.1)
    PIN:
    _ _ _ _ _ _
    Websession PIN (Configured on the UTM in the USC menu in the Unified Security Console section
    After entering the PIN, the web session can be started directly using ↵ Enter.
    The entered PIN is incorrect
    After 5 incorrect entries in a row, access is blocked.
    The block is only lifted again after correct login directly at the admin interface.
     Start new websession Opens the admin interface of the UTM in a new tab of the used browser
  • Pop-ups may need to be allowed for portal.securepoint.cloud in the browser used!
  • Web session with login screen
    notempty
    Web session with login screen (UTM from v12.5.1)
    The connection is established via the interface on which the default route of the UTM is set up. UTM 12.5.1 Websession Loginmaske.png
    Web session with login screen (as of UTM v12.5.1)
    As the web session PIN is deactivated, no automatic login can take place. Access data (user name and password) are required.
     Start new websession Opens the admin interface of the UTM in a new tab of the used browser
  • Pop-ups may need to be allowed for portal.securepoint.cloud in the browser used!
  • Cloud backup

    Cloud backup
    Indication of the following values:
    • Time of regular backup creation.
    • Exact time of the saved backups
    • Name of the saved backups
    • UTM version of the saved backups
    USC v1 Cloud-Backup-en.png
     Download Downloads the backup locally
     Restore PIN recommended Restores the selected configuration.
    In the configuration management in the admin interface of the UTM, this can then be set as the active or start configuration.
     Delete Deletes the configuration backup
    Operations
     Set new password Opens a dialog for creating a new password
  • Existing configuration backups remain encrypted with the old password!
  •  Create a new backup Creates a configuration backup

    Applications

    Applications
    Shows the status of the applications on the UTM with possible actions.
    The chart can be sorted by application name or status by clicking on the respective column.
    Status DOWN The application is not active USC v1 Anwendungen-en.png
    Status UP The application is active
    Status N/A The application is not available on this UTM
     Start Starts the application
     Restart Stops the application and performs a restart
     Stop Stops the application

    Status

    Status
    Shows utilization and consumption in the course of time for
    • CPU
    • Load
    • Memory
    • Data Disk
    USC v1 Status-en.png

    Operations log

    Operations log
    Log of the communication between UTM and the Unified Security infrastructure
    notempty
    New as of: 1.23.1
    The status of the transmitted UTM profiles is also logged here
  • The Unified Security Console and UTM commands are stored with user data in the Unified Security Portal audit log:  Auditlog
  • USC 1.23.17 USC UTMs Operationen-Log-en.png
    Time Shows the date and time at which the job is executed
    Job Displays the job that is being executed
    Profile notempty
    New as of: 1.23.1
    Displays the UTM Profiles on which the job is being performed
    Direction Indicates the direction of communication
    • { in Message from the device to the server
    •  out Message from the server to the device
    Status Displays the status of the executed job
    •  Sent the transmitted job was sent to the device or the transmitted UTM profile was sent
    •  Received the device has received the transmitted job without errors
    •  Confirmed the submitted job or the submitted UTM profile has been applied
    •  Offline the device is offline
    •  Pending the submitted job has not yet been sent
    •  Error the error is described in the Info column
    Info Displays further information on the transmitted job. If an error has occurred, the type of error is described here.
    Operations Operations displayed here can be executed

    Security Scan

    Security Scan
  • For this function, the UTM must be accessible from outside by a public IP!
  •  Start new scan Starts the port scan dialog USC v1 UTM Scan-en.png

    USC v1 UTM Scan starten-en.png
    IP address 192.0.2.192
    Public IP address to be scanned.
    If multiple interfaces with public IP addresses that can be reached from outside are identified, a separate result can be displayed for each interface.
    Profile
      Securepoint TOP 100 (TCP)
    Clicking on the profile entry shows the list of ports that are scanned with applications and services that usually use that port.
     Show details Displays open ports and applications and services that usually use them.

    Inventory

    Inventory
    Here you can save information about the device and (for devices with SIM card) the contract:
    • Inventory:
      • Bill number
      • Bill date
      • Warranty starts on
      • Warranty ends on
      • External inventory link
      • Description
    • Contract:
      • Provider
      • Tariff
      • Customer number
      • Contract number
      • Start of contract
      • Contract term
      • Handover date
    USC v1 UTM Inventar-en.png