Firmware Version supported: 4.5 and above

Integrating your GajShield firewall with Microsoft Active Directory (AD) lets the firewall identify users by their domain login instead of just their IP address. Once the firewall is joined to your domain and users are synchronised, you can:

  • build identity- and group-aware browsing, DLP and access policies through UserSense,
  • show real usernames (not just IPs) in live connections, logs and reports, and
  • reuse your existing AD group structure instead of maintaining users separately on the firewall.

This guide covers the full workflow: defining the AD service group, allowing the firewall to reach your Domain Controller, joining the domain, synchronising users and groups, and enabling AD as the identification source in UserSense.

Before you begin

Have the following ready. Most failed AD joins are caused by a missing item in this list rather than a wrong setting on the firewall.

Requirement Detail
Domain Controller IP The LAN IP of a reachable AD Domain Controller (DC).
A join account A domain account with rights to join a computer to the domain. The built‑in administrator (or a Domain Admin) is recommended.
Your domain names Both the short NetBIOS / workgroup name and the full FQDN — e.g. testdc and testdc.com. The firewall asks for both, separately.
Time in sync AD authenticates over Kerberos, which rejects logins when the clock difference between the firewall and the DC exceeds ~5 minutes. Point both at the same time source before joining. See How to configure GajShield Firewall as a NTP Server.
Name resolution The firewall must be able to resolve and reach the DC. Using the DC itself as a DNS server is the simplest reliable option.
Port reachability The firewall must be allowed to reach the DC on the AD service ports (you set this up in Steps 1 and 3).

AD service ports reference

When you build the service group in Step 1, include the ports your AD actually requires. A typical set:

Service Port(s)
LDAP 389 TCP/UDP
LDAP over SSL (LDAPS) 636 TCP
Global Catalog 3268 / 3269 TCP
Kerberos 88 TCP/UDP
Kerberos password change 464 TCP/UDP
DNS 53 TCP/UDP
SMB 445 TCP
RPC endpoint mapper 135 TCP
NTP 123 UDP

A minimal join + LDAP sync usually needs 389, 88, 445, 135 and 53. Confirm the exact requirement with your AD administrator before locking the service group down.

Active Directory is Microsoft's trademarked directory service, an integral part of the Windows architecture. Active Directory is a centralized and standardized system that automates network management of user data, security, and resources.

Step 1: Create a service group on the firewall by going to Definitions -> Protocols and Services -> Configure Service Group.

Step 2: Create a host by going to Definitions-> Hosts and add ADServer as a host by specifying the appropriate IP Address.

Step 3: Now create the rules for allowing AD service through the GajShield firewall by going to Firewall -> Policies -> Rules

You will need to add a rule by going on Firewall -> Policies -> Rules & use ADServer in services tab, to allow the firewall to access the Active Directory Server as shown below.

NOTE: After adding the firewall rules, install the firewall policies by going to Firewall -> Policies -> Install Policies

Step 4: Now go to Configuration -> User Management -> Active Directory and configure AD as shown below.

 

Workgroup name: Type you domain name without abbreviation. (Example: Domain name is testdc.com, only insert testdc).

Server name: Insert the host name / NetBIOS name of the server.

Domain name: Insert Domain name. (Example: Domain name is testdc.com, insert the same).

Server IP: Select the Domain controller LAN IP Host.

Username: Provide username of an administrator or any user with administrative right. (Recommended is administrator user).

Password: Insert password of the user in the Username field.

Enable Group Synchronization: Check if you want to enable user group synchronization from active directory.

Join Active Directory Domain

Join Active Directory Domain: After adding active directory settings, click on Join button to join active directory domain server.

Synchronize Active Directory Users

Synchronize Active Directory Users: After joining the active directory domain server, click on Synchronize button to synchronize active directory domain server users and groups.

NOTE: You will have to specify Active Directory option by going to Browsing -> Setup -> Browsing Options, tick on userSense and specify Active Directory from the drop-down menu.

NOTE: Active Directory domain groups will only synchronize if "Enable Group Synchronization" is selected under Active Directory Settings.

Verify it worked

  • Join status — the Active Directory page should show the firewall as joined to the domain.
  • Users synced — synchronised AD users (and groups, if enabled) should now be selectable when you build firewall and browsing policies.
  • Live identification — once a domain user generates traffic, their username (not just their IP) should appear in live connections, logs and browsing reports.

Troubleshooting

Symptom Likely cause and fix
Join fails — credentials rejected Check the username/password, and confirm the account has rights to join a computer to the domain.
Join fails — cannot contact the domain Confirm DNS resolves the DC, that Server IP points at the correct DC host (Step 2), and that the Step 3 rule is installed and permits Kerberos (88) and LDAP (389).
Join fails — Kerberos / clock error The firewall and DC clocks differ by more than ~5 minutes. Sync both to the same NTP source and retry.
Joins, but testdc vs testdc.comerrors Re‑check the fields: Workgroup name is the short name (testdc); Domain name is the FQDN (testdc.com).
Users join but groups are missing after Synchronize Enable Group Synchronization was not ticked before syncing. Tick it and run Synchronize again.
Users not identified in policies / reports UserSense is not pointed at AD. Re‑check Browsing → Setup → Browsing Options — UserSense ticked, Active Directory selected.

Note: Active Directory domain groups synchronise only if Enable Group Synchronization is selected under the Active Directory settings (Step 4).

That completes Active Directory configuration on your firewall.

Thus, you have configured AD on your firewall.


Attached Files:
How_to_configure_AD_on_your_firewall.pdf