Authentication Methods

Negotiates with the device to determine whether it uses Kerberos or NTLM authentication. This is useful for devices that support various authentication methods, such as browsers and software applications. The Smoothwall Filter offers both methods to the device so that it can use the most secure method that it supports. The account specified on the Directories page must have permission to connect the device to the domain.

Note: Devices must be connected to the same Active Directory domain for this to work seamlessly. However, devices not connected to the domain can still use this authentication method. Typically done by requesting the user to enter valid domain credentials.

Negotiates with the device to determine whether it uses Kerberos or NTLM authentication. This is useful for devices that support various authentication methods, such as browsers and software applications. The Smoothwall Filter offers both methods to the device so that it can use the most secure method that it supports. The account specified on the Directories page must have permission to connect the device to the domain. This method works with network devices using Microsoft Terminal Services (Remote Desktop Connections), where multiple users might connect from the same IP address. However, authentication policies that use this method won't work with user groups when configuring firewall rules, see our help topic, Adding new Smoothwall Firewall rules.

Note: Devices must be connected to the same Active Directory domain for this to work seamlessly. However, devices not connected to the domain can still use this authentication method. Typically done by requesting the user to enter valid domain credentials.

Identifies users based on the username used to log on to their Windows-based device.

Note: NTLM identification doesn't verify a user's credentials. You should only use it where all devices are secured and are members of a Windows domain. Unsecured devices can spoof their credentials. The Smoothwall Filter supports NTLM on Microsoft operating system software and browsers only. NTLM should not be used with any other browser or platform, even if the platform claims to support NTLM. NTLM should only be used on single domain networks because the protocol doesn't support the transmission of domain information with usernames.

Identifies users based on the username used to log on to their Windows-based device. It can be used in conjunction with Microsoft Terminal Services. This method works with network devices using Microsoft Terminal Services (Remote Desktop Connections), where multiple users might be connecting from the same IP address. However, authentication policies that use this method won't work with user groups when configuring firewall rules, see our help topic, Adding new Smoothwall Firewall rules.

Note: NTLM identification doesn't verify a user’s credentials. You should only use it where all devices are secured and are members of a Windows domain. Unsecured devices can spoof their credentials. The Smoothwall Filter supports NTLM on Microsoft operating system software and browsers only. NTLM mode should not be used with any other browser or platform, even if the platform claims to support NTLM. NTLM should only be used on single domain networks because the protocol doesn't support the transmission of domain information with usernames.

Identifies users based on the username used to log on to their Windows-based device and validates their credentials with the domain controller. However, there must be a device account for the Smoothwall Filter in the Active Directory and the account specified on the Directories page must have permission to connect the device to the domain.

Note: The Smoothwall Filter supports NTLM on Microsoft operating system software and browsers only. NTLM mode should not be used with any other browser or platform, even if the platform claims to support NTLM. NTLM should only be used on single domain networks because the protocol doesn't support the transmission of domain information with usernames

Identifies users according to the username logged into their Windows-based device and validate their credentials with the domain controller. Can be used in conjunction with Microsoft Terminal Services. However, there must be a device account for the Smoothwall Filter in Active Directory and the account specified on the Directories page must have permission to connect the device to the domain. This method is designed to work with network devices using Microsoft Terminal Services (Remote Desktop Connections), where multiple users might be connecting from the same IP address. However, authentication policies that use this method won't work with user groups when configuring firewall rules, see our help topic, Adding new Smoothwall Firewall rules.

Note: The Smoothwall Filter supports NTLM on Microsoft operating system software and browsers only. NTLM mode should not be used with any other browser or platform, even if the platform claims to support NTLM. NTLM should only be used on single domain networks because the protocol doesn't support the transmission of domain information with usernames.

If a user’s browser can't accept cookies or if a user’s browser plug-ins or applications need the authenticated session to remain active. If the device isn't logged in, web requests are redirected to the non-SSL login page, which checks their username and password. The authentication service supports only one user per device IP address. Using this method, the non-SSL login page automatically refreshes itself so that the authentication time-out period doesn't elapse. Because of this, the user must always leave the non-SSL login page open. To securely sign out, the user must click Logout on the non-SSL login page, see our help topic, Customizing the SSL Login Page.

Note: This page isn't secure because it uses HTTP to submit the username and password, but avoids the certificate needed for SSL login.

This method is useful for users of tablets and other mobile devices, which have problems keeping tabs in browsers open in the background. If the device isn't logged in, web requests are redirected to the non-SSL Login page, which checks their username and password. The authentication service supports only one user per device IP address. Using this method, the Smoothwall stores a session cookie in the user’s browser. The cookie removes the need for the user to re-authenticate. To securely sign out, the user must click Logout from the non-SSL Login page, see our help topic, Customizing the SSL Login Page.

Note: The page isn't secure because it uses HTTP to submit the username and password, but avoids the certificate needed for SSL login.

Negotiates with the device to identify whether it uses Kerberos or NTLM authentication. This is useful for devices that support various authentication methods, such as browsers and software applications. The Smoothwall Filter offers both methods to the device so that it can use the most secure method that it supports. The account specified on the Directories page must have permission to connect the device to the domain.

Note: Devices must be connected to the same Active Directory domain for this to work seamlessly. However, devices not connected to the domain can still use this authentication method. Typically done by requesting the user to enter valid domain credentials.

Identifies users using the Secure Global Proxy service. Users must be logged in using NTLM credentials. You can implement device authentication using certificates on your devices. For a detailed description of how to configure these, see our help topic, About the global proxy.

Note: Even if your Smoothwall Filter has multiple internal interfaces, you can only create one Global Proxy using NTLM authentication policy. Turning on this policy adds the Smoothwall Firewall rules to allow external access to the proxy port automatically.