NIAP CSfC Guidelines for Unified Access Gateway with Horizon

Unified Access Gateway with Horizon is NIAP/CSfC compliant and the validation requires specific configuration in the Unified Access Gateway appliance which is necessary for the NIAP/CSfC operation.

The configuration changes are listed as follows:

1. Deploy the FIPS version of Unified Access Gateway on VMware vSphere 7 or later.

2. Configure the following parameters during deployment.

   Note: You can configure these parameters only at the time of deployment. If you do not configure during deployment, Unified Access Gateway will include the default values.

   Parameters	Description
   Root Password Management Policies
   passwordPolicyMinLen	Minimum length of root password. The accepted range is 6-64 characters.
   passwordPolicyMinClass	Minimum complexity of root password. The accepted range is 1-4.
   rootPasswordExpirationDays	Number of days after which root password must be mandatorily reset.
   passwordPolicyFailedLockout	Number of failed login attempts after which root user access is locked out temporarily. The accepted range is 1–10 attempts.
   passwordPolicyUnlockTime	Duration in seconds that root user is unlocked after a temporary lockout. The accepted range is 1–3600 seconds.
   rootSessionIdleTimeoutSeconds	Duration in seconds after which an idle session of root user will expire.
   Admin Password Management Policies
   adminpasswordPolicyMinLen	Minimum length of admin password.
   adminpasswordPolicyFailedLockoutCount	Number of failed login attempts after which admin user access will be locked out temporarily. The accepted range is 1–100 attempts.
   adminpasswordPolicyUnlockTime	Duration in seconds that admin user is unlocked after temporary lockout. The accepted range is 1–9999 minutes.
   adminSessionIdleTimeoutMinutes	Duration in seconds after which an idle session of admin user will expire
   Other Parameters
   Login Banner Text	The banner text displayed during SSH or web console login
   SecureRandom Source	The parameter must be set to /dev/random

   For more information about these parameters and their values, see Run PoweShell Script to deploy.

3. Generate the CSR for TLS certificates and bind signed certificates for Unified Access Gateway admin and public interfaces. For more information, see Generate CSR and Private Key using uagcertutil Command.

Note: Ensure that all the certificates in the chain have SHA-384 signatures. Any mismatch of signature algorithms in the certificates and the TLS configurations under System Settings might result in TLS handshake failures and loss of access to the server.

4. Configure following parameters on the System Configuration section of Admin UI.

   1. Configure TLS Server Cipher Suites to TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.

   2. Configure TLS Client Cipher Suites to

      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384
      

   3. Configure SSL Provider to JDK.

   4. Configure TLS Named Groups to secp256r1,secp384r1,secp521r1,ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192.

   5. Configure TLS Signature Schemes to rsa_pkcs1_sha384.

   6. Configure the Admin Disclaimer Text.

   7. Turn on the Time Sync With Host toggle.

   8. Turn on the Extended Server Certificate Validation toggle.

      Note: Unified Access Gateway does not support LDAP URLs for CRL, only http URLs are supported.

5. Configure the Syslog Server Settings with TLS protocol.

   Note: The Syslog server certificate must have the extendedKeyUsagemarked as critical extension.

   • 1. Click Select to upload the Syslog TLS Client Certificate and TLS Syslog Client Certificate Key.

6. Turn on the Syslog Include System Messages toggle.

7. Click Add Syslog Entry to add a new syslog entry to the table with the following details.

   1. Set the Category is set to All Events.
   2. Set the Protocol to TLS.
   3. Add Syslog server Host and Port.

8. Click Select to upload trusted CA certificate.

9. Click Add to save the new entry and click Save to save the syslog settings.

10. Configure and enable X509 Certificate Authentication setting. For more information about these settings, see Configure certificate authentication.

    1. Open X.509 Certificate configuration under Authentication Settings.
    2. Turn on the Enable X.509 Certificate toggle.
    3. Click Select to upload the trusted Root and Intermediate CA Certificates of the client in PEM format.
    4. Turn on the Certificate Cert Revocation toggle.
    5. Configure CRL based certificate revocation check. You can either configure a URL to fetch CRL or configure to read the details from certificate chain itself.
    6. Save the X.509 Certificate Authentication settings configuration.

11. Generate SAML Identity Provider settings and Configure SAML Service Provider Settings.

    1. Open SAML settings and expand SAML Identity Provider settings.
    2. Generate Identity provider settings by uploading the Private Key and the Certificate Chain (signed with RSA+SHA384 algorithm).
    3. Download the generated identity provider settings XML by providing external Hostname of Unified Access Gateway.
    4. Upload the XML file at Connection Server and download the SAML metadata XML.
    5. Open SAML Settings and expand SAML Service Provider settings.
    6. Enter a Service Provider Name and paste the SAML Metadata XML content. For more information, see Copy Service Provider SAML Metadata.
    7. Save the SAML service provider settings.