15.3.2.1. Procedure – Configuring communication between Zorp and ZAS

1. First, the connection settings of ZAS have to be configured in the Bind section on the Authentication server ZMC component. Specify the IP address/port pair on which ZAS should accept connections.

   

   Figure 15.16. Configuring the bind parameters of ZAS

   Tip
   If ZAS and Zorp are running on the same machine, use the local loopback interface (IP:127.0.0.1).

   Note
   The same bind settings will have to be used when the Authentication provider is configured in the Policies tab of Zorp ZMC component.

2. If Zorp and ZAS are running on separate machines, enable and configure SSL encryption. Check the Require SSL for incoming connections checkbox and click on ... next to the Certificate textbox and select a certificate. This certificate has to be available on the ZAS host and will be presented to Zorp to verify the identity of the ZAS server. For details about creating certificates, see Procedure 11.3.8.2, Creating certificates.

   

   Figure 15.17. Configuring the SSL for ZAS

   To enable mutual authentication (that is, to verify the certificate of Zorp), check the Verify peer certificate checkbox and select the CA group containing the trusted certificates. Also make sure to set the Verify depth high enough so that the root CA certificate in the CA chain can be verified. The default value (3) should be appropriate for internal CAs.

3. The connection also has to be set up from the Zorp side. This can be accomplished by creating an Authentication provider on the Policies tab of the Zorp ZMC component. Click on New, select Authentication provider from the Policy type combobox, and enter a name for the provider into the Policy textbox.

   

   Figure 15.18. Creating an Authentication provider

4. Enter the IP address of the ZAS server into the Address field. This must be the same address as specified as Bind address for ZAS in Step 1.

   

   Figure 15.19. Configuring an Authentication provider

5. If SSL encryption was enabled in Step 2, select the Certificate Zorp will show to ZAS. Zorp can also verify the certificate shown by ZAS using the CAs specified in CA group.

   

   Figure 15.20. Configuring SSL for an Authentication provider

   Note
   Obviously, the CAs issuing the certificates of Zorp and ZAS must be members of the CA groups set to be used to perform the verification of the certificates, otherwise the verification will fail.