How can I install the system?

To install the system, you first need to configure your appliance or your VM to boot from the USP NAS .iso file. After booting from the .iso, select the option "Install appliance operating system" in the bootloader menu. Installation will proceed without needing any user interaction. Partitions and filesystems will be created and the USP NAS System will be installed. The System will then restart automatically and boot the USP NAS operating system.

Once the installation is completed, a login prompt will be displayed on the console. You can log in to the basic system configuration menu using the console user with the following credentials:

The network interface of the appliance and the default gateway can be set via the console menu. After completing the initial network setup, you can access the web-based USP NAS GUI using a webbrowser of your choice (Google Chrome, Mozilla Firefox or Microsoft Edge is recommended) via the configured IP address to continue with the configuration of the USP NAS application.

How can I update the system?

USP NAS offers the possibility to install software updates via the Web GUI (System → Update). You can upload the update image directly via the Web GUI file chooser. Alternately, the image can be uploaded via SFTP using the transfer user, whose password you can configure in the Web GUI (System → SSH Access). In this case, the image must be placed in the update directory. After selecting the update image and clicking the Update button in the Web GUI, the system will be updated and restarted without requiring further intervention. Please note that the update process can take several minutes.

What are the system requirements to install NAS?

We recommend the configurations for a virtual server:

How do I set up high-availability (HA)?

To set up high-availability, you need at least two USP NAS servers (further called nodes) and have the Authenticator module licensed. One of the nodes will run in MASTER-mode, and the other nodes(s) will run in AUTHENTICATOR-mode. This can be configured in the Web GUI in Configuration → HA Authenticator. The configuration is composed of two steps:

What does the HA architecture look like? How does the HA mode work?

An AUTHENTICATOR node is operating almost completely independently of the MASTER system. By default, an AUTHENTICATOR node fetches a copy of the policy and inventory from the MASTER system once a day. The AUTHENTICATOR checks the availability of the MASTER system at short regular intervals and forwards incoming SNMP traps and RADIUS requests to the master as long as it is available. If the master system fails (AUTHENTICATOR node gets no responses from MASTER) or is overloaded, the AUTHENTICATOR immediately takes over the authentication functionality. As soon as the master is online again, authentication requests are forwarded to the MASTER system again.

How does the synchronization between MASTER and AUTHENTICATOR systems work?

The high-availability functionality of USP NAS includes a periodic synchronization where an AUTHENTICATOR node copies the database from the MASTER node. This includes, among others:

Excluded from the synchronization are:

The synchronization schedule can be configured using a cron pattern.

The USP NAS Web GUI offers also the option to carry out a synchronization manually. It is recommended to do this after setting up a new authenticator node.

In addition to synchronizing the policy, an AUTHENTICATOR systems provides a function to synchronize particular system configuration information from the MASTER to an AUTHENTICATOR node. The following configuration settings are synchronized using the "Config Synchronization":

Not included in the config synchronization are, among others, the following settings which have to be set manually on every instance:

Where can I configure and manage users for Web GUI or system access?

There are two ways to manage Web GUI and system users:

How can users be managed locally?

In the All Users menu users can be added, edited and deleted. When you add or edit a user, you can define its password, decide if the user is active and define its roles. If you use tenants, you can also assign a user to a tenant.

How do I configure LDAP authentication for USP NAS?

The LDAP Login can be configured in the Web GUI in "Configuration → LDAP Configuration". From there, two types of LDAP logins can be configured:

What is the multi-domain login feature for Web GUI users?

Usually there is only one domain required to provide authentication for Web GUI users. With the multi-domain extension it is possible to store several domains as authentication backends. This feature is therefore only relevant for environments with multiple domains. The default configuration is the configuration which will be applied first if the username is provided without domain name. To login using another domain configuration, the user must provide the server name in the following format: servername/username.

For system user login, only one configuration may be defined. That means that system users may be managed only by one dedicated LDAP server. These users will all have root privileges on the USP NAS system. User home directories on USP NAS are not persistent across reboots, therefore, they should only be used to temporarily store files.

How can USP NAS user roles be mapped in Active Directory (for Web GUI users only)?

In the Web GUI, different user roles are available. To assign these roles to AD-based users, the roles which will be used have to be defined in Active Directory as group-objects. These group objects need to have an attribute which does match exactly the given role name. It might be the "cn" of the group or any other attribute like "description". No matter which attribute is chosen, the name of the attribute must be specified in the LDAP config under "LDAP name of the role attribute".

What is the Domain SID config in the LDAP configuration (for system users only)?

In the system LDAP configuration there is only one role, therefore no groups need to be defined for the roles. In contrast to the web GUI configuration, the domain SID must be specified here. The domain SID corresponds to the SID of any object (e.g. user object) of an AD without the part after the last hyphen i.e.:

The domain SID is required for successfully configuring system LDAP authentication. If you are logged in as a domain user in a Windows system you might get the user SID with the following command in the Windows Command Prompt:

wmic useraccount where name='{username}' get sid

How do I define LDAP Login configurations for Web GUI users?

How do I define the LDAP Login configuration for system users?

What roles are there available in the Web GUI? How do the permissions work?

USP NAS has several WebGUI user roles with different system permissions:

What is the transfer user?

The transfer user is a user that has limited SSH access to the system. The user can connect via SCP or SFTP and access some useful directories and files like backups, logs, updates or imports. The default password for the transfer user is transfer, but it can be changed in the WebGUI in System → SSH Access

How do I make a backup?

USP NAS offers different backup options: Backups can be created manually in the Web GUI in Operation → Backup or on a regular schedule, and generated backup files can be stored on USP NAS, downloaded to a local PC via the Download link or copied to a remote file server using SFTP/SCP.

USP NAS offers various backup types:

The following shows in more detail which configuration data is contained in which backup type:

How do I restore a backup?

Restoring a backup consists of the following steps:

Please take note that only backups created with the same USP NAS version can be restored. If a backup of a different USP NAS version is restored, this can lead to an inconsistent state. If the checkbox "Force restore" is not checked in the GUI, the system prevents restoring a backup which was created with a different release number.

After restoring a backup, the system will reboot automatically.

Also note that the following settings are ignored when restoring a full backup:

This means that restoring a full backup will normally not change your current network settings.

How do I schedule an automatic regular backup?

The automatic backup can be scheduled in the WebGUI in Operation→Scheduled backup. The same backup options are available for the automatic backup as for the manual backup.

A daily, weekly or monthly interval is available for the execution interval. The automatic backups can be stored either locally on the appliance or remotely via SCP/SFTP on a remote server.

The backups stored locally on the appliance appear in the list of manual backups and can be downloaded analogously to the manual backups.

Important: The name of the automatic backup cannot contain spaces or special characters.

How can I import data into USP NAS?

The first way of importing data into USP NAS is to use the Import interface. Inventory systems and NMS deliver data to USP NAS in the form of flat CSV files. The files are transferred to the USP NAS server via SFTP (SSH File Transfer Protocol). The supplemental document "Specification Inventory Import and NMS Import" describes the technical procedure of the import process as well as the data format of the CSV files to be imported. CSV files can also be uploaded manually via the Web GUI in Operation → Upload import data.

The second way of importing data is to use Scheduled Scripts. These scripts can be created using a template in the Web GUI in Configuration → Scheduled Scripts. You can then customize the script to import data from any source (for example using Nmap, LDAP, SQL server or HTTP API).

Which network equipment vendors are supported by USP NAS?

USP NAS should support many common switches through the use of generic/standardized SNMP query functionality, but the following switch/router/access point vendors and model series have been observed to work well in customer setups:

How can a token be generated for REST-API authentication?

Authentication for the REST API is implemented with a user-based authentication token.

In order for an authentication token to be created for a user, the "REST API" role must be assigned to the user.

A user having the "REST API" role can generate a corresponding token in the user profile page in the Web GUI. This token can then be used for authentication, either via cookie or HTTP header.

How does a REST-API request look like?

The URL for querying the REST-API looks as follows:

https://{IP}/api/v1/

An example of a request using curl with the token set as cookie looks as follows:

curl -b jwttoken=eyJhbG.....sXtRrBRY https://NAS_IP/api/v1/status

Using the token in the authorization header looks as follows:

curl -H "Authorization: Bearer eyJhbG.....sXtRrBRY" https://NAS_IP/api/v1/status

What data is provided by the REST-API?

Where can I get detailed documentation about the REST-API?

A detailed REST API documentation is available in the Web GUI. It can be displayed using the following link (available also via the help menu):

https://[IP]/ng/swagger-ui/index.html

Note that the user needs to be logged into the USP NAS Web GUI first to view this documentation.

How can I configure DNS zone transfer?

You can define which DNS zones on which DNS servers are to be taken into account for the DNS zone transfer. This can be configured in Configuration → DNS zone configuration.

On this page, you can configure multiple DNS zones by providing the DNS zone name and the DNS server IP address.

Please note that one DNS zone can be assigned to multiple DNS server IPs.

How do I set up system monitoring?

The monitoring can be configured under Configuration → Monitoring configuration. On this page, monitoring thresholds can be configured for each sensor. When a measured value is out of range, an alert will be displayed in the status overview page.

It is further possible to define a remote alarming system for each log message. This can be done in Configuration → Alarming configuration. When nothing is configured for a message, the message will only be displayed on the Monitoring status pages of the WebGUI.

What Scheduled Scripts templates are available?

Here is a list of the different script templates:

What benefits does USP NAS’s network transparency generate?

Network transparency is the first step in implementing network access control. This provides a view of what is and was connected to the network, when and where.

Network transparency provides the basis for important use cases in the areas of

This means that important requirements from security audits can be met.

How is network transparency implemented with USP NAS?

The implementation of network transparency with USP NAS is usually very easy and can be implemented with little effort. There are two possible approaches to implementing network transparency.

How to list switches for network transparency (query using SNMP)?

Switches (netdevices) may be either managed via Web GUI or by uploading a CSV list with IP, DNS name and SNMP read credentials. In addition to defining the switches, at least one uplink (netport) must be defined for each device. The uplink ports can also either be recorded via the web GUI or imported via a CSV list.

How to define uplinks (netports) of switches?

Netports have to be defined on the switches explicitly. This is because MAC addresses registered in the forwarding table of an uplink-port are not connected on this port and should therefore not be considered as connected on the port. Netports may be defined for every switch by selecting the link “Netports”. Netports can be set or removed with a check mark. The number of detected MAC addresses on this port (MAC count), the VLAN trunk ports and the vendor announcements ports (VA) are displayed for assistance. Ports with check marks on the last two attributes mentioned should be defined as netports in USP NAS. Having multiple devices connected to one port is also a strong indicator of a Netport. As soon as a netdevices is added and the netport is defined, a portscan is automatically started. The portscan will update the netdevice details as well as the connected endpoints. By default, a switch scan runs periodically at regular intervals. It can also be triggered manually in the Web GUI.

How to configure network transparency with automatic switch detection?

The second option of implementing network transparency is using the approach of activating RADIUS authentication on the netdevices. By default, USP NAS is configured to answer any RADIUS authentication requests from the network. If a request is received from a network device that is not yet listed in the system, it is automatically created as a device of type "RADIUS authentication device". With this approach, the network devices do not have to be explicitly entered initially or during operation. The network area (subnet) from which switches are allowed to send RADIUS requests to the USP NAS can be restricted if necessary.

Is it necessary to define netports for RADIUS auth devices?

No uplinks need to be recorded for RADIUS auth devices that are automatically listed after receiving an authentication request.

How can the results of network transparency be checked/used?

The result of the network transparency mode is a list of all connected endpoints during operation of USP NAS. In case of automatic listing of netdevices, a list with information of all netdevices will be generated. In case of querying netdevices using SNMP, detail information like netdevice description and port information will be available after the initial scan.

All collected information is available in the Web GUI and may be filtered/exported from there. In addition, the data can also be retrieved using the REST API.

The following table list the specific information and preconditions to collect it:

What are the requirements for network authentication?

The rollout of network authentication in an existing network has to be well planed and carefully applied. The requirement for a successful rollout is an accurate onboarding process of all endpoints which should have access in a controlled network. The result of the onboarding process is a complete inventory of all endpoint entities. USP NAS provides efficient features to support a seamless and efficient onboarding process.

What kind of identity may be used for authentication?

There are mainly two different kinds of authentication available, which are the MAC address with which an endpoint communicates on the network, or a certificate which the endpoint/user provides when connecting to the network.

The current best practice is to use certificates for endpoints which are managed in an Active Directory. Technically, it is also possible to use certificates for other endpoints. The problem is usually how to manage the certificate lifecycle for those endpoints. Therefore, the MAC address is used normally as identity for endpoints which are not managed in an Active Directory.

What kind of protocols may be used for authentication?

If certificates are use for identity it is required to use RADIUS as the authentication protocol. If only MAC-addresses are used for endpoint identity it may be possible to use only SNMP for authentication.

What are the requirements for SNMP authentication?

The requirements for SNMP authentication are that Bridge-MIBs are available on the netdevices and that write access is available on those netdevices. Additionally, SNMP may be used for authentication, if certificates are not used as identity of endpoints. That means that SNMP authentication may be used in an "MAC Identity" - only environment.

Why is there a delay of more than 10 seconds from plugging in a cable until receiving an SNMP connection event?

When using SNMP authentication, switches send up/down notification traps to USP NAC when cables are (un)plugged. This will trigger a scan of the related switch port, to see which MAC address(es) the switch has learned to be present on that interface.

At the time when a link-up trap is sent, the MAC address is not yet present in the bridge table, as it is only entered there when the client has sent the first packet. Since it is “relatively” time-consuming to make query the switch for MAC addresses, it is usually only done a few seconds later so that the probability of a successful query on the first attempt is as high as possible.

The timeout can be fine-tuned in the USP NAS application configuration in the category "SNMP". The related setting is called "GetMac Retry Timeouts". In smaller environments this could be turned down without any problems, in very large ones it is not recommended.

Can USP NAS be used as a RADIUS server?

The USP NAS can be configured as a RADIUS server or as RADIUS proxy. For RADIUS MAC authentication USP NAS always has the role of RADIUS server. For RADIUS EAP authentication you may configure whether USP NAS is a proxy and sends the EAP requests to a server or handles them locally.

The RADIUS Servers can be configured in Configuration → RADIUS server config. There you can add as many servers as needed, by providing the IP address, the port and the shared secret.

How to use local RADIUS server for EAP authentication

To use the local RADIUS server for certificate authentication, you need to activate the integrated "RADIUS server" module. After the module is activated, you can upload the CA certificate and the Server certificate in System → SSL certificate management. USP NAS will now answer RADIUS requests directly, without forwarding them to an external RADIUS server.

What kind of endpoint onboarding process USP NAS provides?

There are basically two options for efficiently onboarding endpoints: The system has an automatic onboarding mechanism for devices that authenticate themselves in the network using a certificate, and the system has also bulk onboarding mechanisms for devices that authenticate on the network using their MAC address. These devices can be filtered based on specific properties and then imported as a whole list. During this process, attributes that determine their type/class membership can also be assigned to the devices

How does the onboarding process work for endpoints using a certificate for authentication?

For devices that log on to the network with a certificate, onboarding is extremely easy - onboarding occurs automatically as soon as they log on to the USP NAS with their certificate for the first time. The devices are registered in the local inventory with the CN of the certificate and the MAC address currently used. If an endpoint logs in once over the WLAN and once over the LAN with the same certificate, a separate entry is created for each connection type.

How does the onboarding process work for endpoints that are using MAC address for authentication?

For devices that are supposed to authenticate themselves on the network via the MAC address, there are special onboarding functions that make this process as efficient as possible. The prerequisite for onboarding via MAC address is that the devices have already been scanned once by the USP NAS system via the SNMP scan, or the switch has already sent a RADIUS authentication request for the MAC address.

The devices can then be filtered by specific properties (manufacturer, connection point, connection time, etc.) and imported as a list. During the import process, attributes can be assigned to the devices which determine the type/class of the devices. These assigned attributes can later be used to define the policies that a terminal device is assigned when it is connected to the network.

What kind of policy does USP NAS provide?

USP NAS supports different options how an access decision can be enforced on a port ("Access Control Enforcement").

The applicable option is specified in the global configuration, but can also be overridden locally for individual switches if required.

The following table lists the possible options and their purposes:

Is it possible to apply different policies for different locations?

It is possible to define different policies for different locations. The basis for this is formed by policy groups, each of which can be assigned a specific access rule. A policy group consists of any grouping of switch ports and WLAN controllers, which can be labeled with a label. This allows locations in particular to be grouped together and provided with a specific policy.

Is it possible to apply different policies for different endpoint types?

The assignment of a policy to a specific endpoint type is done in an access rule. The access rule contains a mapping of endpoint type to access profile. The access profile then contains the definition of which VLAN or which RADIUS attributes should be applied to the end device.

Are there best practices for policy rollout?

A step-by-step approach is usually recommended for policy rollout.

How does the policy management work?

When endpoint is connected in the network, the Access Control Engine determines the policy valid for this connection point. A policy consists of the operating mode, the access policy (access rule and access profile) and, if necessary, the client security policy (health rule and health profile).

How can I configure the system so that no device is blocked?

The operating mode has an effect on the access type. The operating mode specifies whether a failed authentication is enforced (restrictive), not enforced but displayed to the Helpdesk for verification (permissive) or whether the negative access decisions are not enforced at all (allowed).

The operating modes of USP NAS are described in detail in the following table:

Are changes to the rule set or the operating mode activated instantly?

Changes made by the Admin user on the rule set or on the operating mode are implemented in a workspace. The workspace is a copy of the rule set. Thus changes on the policy will not affect the current operation. As soon as the policy has been changed in the WEB-console, a red button Impact analysis will be displayed. By clicking this button, the changes in the policy workspace may be applied to the productive policy configuration.

Is it possible to disable the control of the network?

The ability to disable the control of the network depends on the type of authentication which is activated. It depends on whether the endpoint authentication is done using SNMP or RADIUS.

Disable network access control using SNMP authentication mode:

When using SNMP authentication, the access control may be disabled just by changing the operation mode from "SYSTEM" to "OFF". There will neither be a communication to the netdevices nor the execution of blocks as long as this mode is set! All endpoints are unblocked if this mode is activated.

Disable network access control using RADIUS authentication mode:

When using RADIUS authentication for access control, the access control has to be disabled on the SWITCHES. To just change the operation mode of USP NAS would have strong impact on the connectivity of the endpoints on the network. In this case the switch still requires an authentication response but the USP NAS would no longer answer to authentication requests in the OFF Mode. Therefore, the only way to disable network authentication is to deactivate RADIUS authentication on the switches.