Zyxel Networks launches Nebula 20.10 with identity federation – TNGlobal

body {
font-family: ‘Segoe UI’, Tahoma, Geneva, Verdana, sans-serif;
line-height: 1.6;
color: #333;
max-width: 900px;
margin: 20px auto;
padding: 0 20px;
background-color: #f9f9f9;
border-radius: 8px;
box-shadow: 0 2px 10px rgba(0,0,0,0.05);
}
h1, h2, h3 {
color: #0056b3;
margin-top: 30px;
margin-bottom: 15px;
}
h1 {
font-size: 2.5em;
text-align: center;
color: #003366;
}
h2 {
font-size: 1.8em;
border-bottom: 2px solid #eee;
padding-bottom: 10px;
}
h3 {
font-size: 1.3em;
color: #007bff;
}
p {
margin-bottom: 1em;
text-align: justify;
}
ul {
list-style-type: disc;
margin-left: 20px;
margin-bottom: 1em;
}
ol {
list-style-type: decimal;
margin-left: 20px;
margin-bottom: 1em;
}
li {
margin-bottom: 0.5em;
}
code {
background-color: #eef;
padding: 2px 4px;
border-radius: 4px;
font-family: ‘Consolas’, ‘Monaco’, monospace;
font-size: 0.9em;
color: #c7254e;
}
strong {
color: #0056b3;
}
.note {
background-color: #e6f7ff;
border-left: 5px solid #007bff;
padding: 15px;
margin: 20px 0;
border-radius: 5px;
}

This guide will walk you through the essential steps to set up and configure identity federation in your Zyxel Nebula 20.10 network environment. By following these instructions, you’ll learn how to enhance security, simplify user access, and centralize management for your network administrators and users.

What you’ll need

• An active Zyxel Nebula Control Center (NCC) account with administrative privileges for your organization.
• A Zyxel Nebula organization that is running firmware version 20.10 or later on its devices, ensuring compatibility with the identity federation feature.
• An existing Identity Provider (IdP) such as Microsoft Azure Active Directory, Google Workspace, Okta, OneLogin, or any other SAML 2.0 compliant identity provider.
• Administrative access to your chosen Identity Provider to create applications, define attributes, and manage user assignments.
• A basic understanding of SAML 2.0 concepts (Service Provider, Identity Provider, Assertion Consumer Service URL, Entity ID, Attributes, Claims) is helpful but not strictly required, as this guide will explain the necessities.
• A dedicated test user account within your IdP to thoroughly verify the federation setup before rolling it out to your entire team.

Steps

1. Grasping the Power of Identity Federation

   Before diving into the configuration, it’s beneficial to understand what identity federation brings to your Zyxel Nebula environment. Identity federation, leveraging protocols like SAML 2.0 (Security Assertion Markup Language), allows you to centralize user authentication. Instead of creating and managing separate user accounts within Nebula, you can delegate authentication to your existing Identity Provider (IdP). This means your users can log into the Nebula Control Center using their familiar corporate credentials through a Single Sign-On (SSO) experience. The benefits are substantial: enhanced security through centralized policy enforcement (like MFA at the IdP level), simplified user management (onboarding and offboarding users in one place), and improved compliance. In this setup, Zyxel Nebula acts as the Service Provider (SP), relying on your IdP to verify user identities.

   

2. Navigating to Nebula’s Federation Configuration

   Your journey begins in the Zyxel Nebula Control Center. Log in to your NCC account with an administrator account that has organization-wide privileges. Once logged in, navigate to the left-hand menu. You’ll need to find the section for organization-wide settings. Specifically, click on Organization-wide, then expand the Configure submenu, and finally, select Identity Federation. This page is your central hub for all identity federation settings within Nebula. Initially, you’ll likely see that identity federation is disabled. This is where we’ll begin to enable and configure the integration with your chosen Identity Provider.

3. Enabling Federation and Gathering Nebula’s Service Provider Information

   On the Identity Federation page in Nebula, you’ll see an option to enable the feature. Click the Enable Identity Federation toggle or button. Once enabled, Nebula will automatically generate its Service Provider (SP) metadata, which is crucial for configuring your Identity Provider. You will see fields like Assertion Consumer Service (ACS) URL and SP Entity ID. These URLs and identifiers tell your IdP where to send authentication responses (the ACS URL) and how to uniquely identify Zyxel Nebula as the service it’s providing access to (the SP Entity ID). It is vital to accurately copy these values, as any mismatch will prevent successful authentication. Keep this Nebula page open or copy these details to a notepad, as you’ll need them for the next step.

4. Setting Up Your Identity Provider (e.g., Azure AD Application)

   Now, switch over to your Identity Provider’s administrative portal. While the exact steps vary slightly by IdP, the core process involves creating a new enterprise application and configuring it for SAML-based single sign-on. For example, if you’re using Azure Active Directory: navigate to the Azure portal, then to Azure Active Directory > Enterprise applications. Click New application and choose to Create your own application (or select “Non-gallery application”). Give it a descriptive name like “Zyxel Nebula.” Once created, go to the application’s overview and select Set up single sign-on, then choose SAML. Here, you’ll input the SP details you gathered from Nebula. Specifically, under Basic SAML Configuration, paste Nebula’s ACS URL into the Reply URL (Assertion Consumer Service URL) field and Nebula’s SP Entity ID into the Identifier (Entity ID) field. Save these settings.

5. Mapping User Attributes for Seamless Integration

   Still within your Identity Provider’s SAML configuration for the Nebula application, you need to define which user attributes (also known as claims) will be sent to Nebula during authentication. These attributes allow Nebula to identify the user and potentially assign roles. The most critical attribute is the user’s email address, as Nebula uses this to uniquely identify administrators. You’ll typically need to configure claims for: User.mail (or emailaddress), User.givenname (first name), and User.surname (last name). In Azure AD, this is done in the User Attributes & Claims section. You might also consider sending group memberships (e.g., User.groups) if you plan to dynamically assign roles in Nebula based on IdP group affiliations. Ensure the attribute names you configure in your IdP match what Nebula expects, or you’ll need to map them later in Nebula.

6. Granting Access: Assigning Users and Groups in Your IdP

   After configuring the SAML settings and attributes in your Identity Provider, you must explicitly grant access to the users or groups who will be permitted to log into Zyxel Nebula via federation. This is a crucial security step, preventing unauthorized individuals from attempting to access your Nebula organization. In Azure AD, for example, you would navigate to the Users and groups section of your Zyxel Nebula enterprise application. Click Add user/group and select the specific individuals or security groups that should have access. Only users assigned here will be able to complete the federated login process. Remember to include your test user account in this assignment to facilitate thorough testing.

7. Collecting Your Identity Provider’s Metadata

   Once your IdP application is fully configured, you need to retrieve its metadata to complete the setup in Zyxel Nebula. This metadata establishes the trust relationship between Nebula and your IdP. Most IdPs provide an option to download a Federation Metadata XML file. This is often the easiest method, as it contains all necessary information (SSO URL, Entity ID, and the signing certificate). Alternatively, you might need to manually extract three key pieces of information: the IdP Single Sign-On URL (also known as the Login URL), the IdP Entity ID (or Azure AD Identifier), and the IdP Signing Certificate (often provided as a Base64 encoded string). In Azure AD, these can be found under the SAML Signing Certificate section and the Set up Zyxel Nebula section of your enterprise application’s single sign-on configuration. Download the XML or copy these values carefully.

8. Integrating IdP Details into Nebula Control Center

   Return to the Zyxel Nebula Control Center, specifically to the Organization-wide > Configure > Identity Federation page. Here, you’ll input the IdP metadata you just collected. Nebula typically offers two methods: Upload IdP metadata XML or Manual Configuration. If you downloaded the XML file from your IdP, simply upload it. Nebula will parse the file and automatically populate the necessary fields. If you opted for manual retrieval, you’ll need to meticulously paste the IdP Single Sign-On URL, IdP Entity ID, and the IdP Signing Certificate (Base64 encoded) into their respective fields. Double-check every character to avoid typos, as even a small error can break the authentication flow. Once entered, save the configuration in Nebula.

9. Defining User Roles and Permissions in Nebula

   With the identity federation link established, the next crucial step is to define how federated users will be granted access and privileges within your Nebula organization. Nebula allows you to map federated users to existing or new administrative roles. On the Identity Federation page, or under Organization-wide > Configure > Administrators, you can configure role assignments. If your IdP sends group claims, you can leverage these to automatically assign specific Nebula roles to users belonging to certain IdP groups (e.g., users in the “Network Admins” IdP group could be mapped to “Organization Administrator” in Nebula). For individual users, they will typically appear in the administrator list after their first successful federated login, at which point you can manually assign their appropriate organizational or site-level roles. Plan your role mappings carefully to align with your security policies.

   

10. Verifying Your Identity Federation Configuration

    This is the moment of truth! Testing is paramount to ensure everything is configured correctly. Open a private or incognito browser window to avoid any caching issues from previous Nebula logins. Navigate directly to the Nebula login page: login.nebula.zyxel.com. Instead of entering Nebula-specific credentials, enter the email address of your test user account (the one you assigned in your IdP). Nebula should detect that this domain is federated and redirect you to your Identity Provider’s login page. Authenticate with your IdP credentials. Upon successful authentication, your IdP will send a SAML assertion back to Nebula, and you should be seamlessly redirected to the Nebula Control Center dashboard. Verify that your test user has the expected access and roles. If the login fails, pay close attention to any error Messages from either Nebula or your IdP, as they often provide clues for troubleshooting.

11. Assigning Federated Users to Specific Nebula Sites (Optional)

    If your Zyxel Nebula organization manages multiple network sites, you might need to grant federated users access to specific sites with tailored permissions, rather than just organization-wide access. Once a federated user has successfully logged into Nebula for the first time (as verified in the previous step), their account will be recognized within your Nebula organization. To assign site-specific roles, navigate to Site-wide > Configure > Administrators for the relevant site. You should now be able to find and select your federated users from the list of available administrators and assign them the appropriate site-level roles (e.g., “Site Administrator,” “Guest Manager,” etc.). This granular control allows you to delegate management responsibilities effectively without granting unnecessary organization-wide privileges.

12. Maintaining and Monitoring Your Federated Access Environment

    Setting up identity federation is not a one-time task; it requires ongoing maintenance and monitoring to ensure continued security and functionality. Regularly review your IdP’s signing certificate expiry dates and update them in Nebula well in advance to prevent service disruptions. Monitor Nebula’s Organization-wide > Monitor > Event Log for any authentication failures or suspicious activities related to federated logins. To revoke a user’s access, simply remove them from the assigned application within your Identity Provider; this change will be effective immediately for future login attempts. Consider enforcing multi-factor authentication (MFA) at your IdP level, as this will automatically extend MFA protection to all federated Nebula logins, significantly boosting your network’s security posture.

Tips and common mistakes

• Case Sensitivity is Key: SAML attributes, URLs, and Entity IDs are often case-sensitive. Even a slight mismatch in capitalization can lead to authentication failures. Double-check every value you copy and paste.
• IdP Certificate Expiry: Identity Provider signing certificates have expiry dates. Mark your calendar and set reminders to update the certificate in Nebula before it expires to avoid sudden login disruptions.
• Metadata Mismatch: The most common error is a mismatch between the Service Provider (Nebula) and Identity Provider (your IdP) metadata. Ensure the ACS URL, SP Entity ID, IdP SSO URL, and IdP Entity ID are perfectly aligned.
• User Provisioning vs. Just-In-Time: Understand that Nebula doesn’t automatically provision user accounts until they successfully log in via federation for the first time. Their account appears in Nebula after their initial federated login.
• Role Mapping Strategy: Plan your IdP groups and how they will map to Nebula roles carefully. A well-thought-out strategy simplifies ongoing user management and access control.
• Always Use a Test User: Before rolling out to your entire team, always configure and test the federation with a dedicated test user account. This minimizes impact if issues arise.
• Browser Cache Issues: When testing, always use an incognito or private browser window. This prevents your browser’s cache from interfering with the new authentication flow.
• Firewall/Proxy Interference: Ensure no network firewalls, proxies, or security appliances are blocking SAML communication between your users, the IdP, and Nebula.
• Email Domain Alignment: For seamless federation, the email domain of the federated users in your IdP should ideally match the domain associated with your Nebula organization. This helps Nebula correctly identify the federation source.
• Document Everything: Keep detailed records of your IdP application configuration, attribute mappings, and Nebula federation settings. This documentation is invaluable for troubleshooting and future reference.
• Attribute Name Consistency: Ensure the attribute names (claims) you configure in your IdP (e.g., User.mail) are consistent with what Nebula expects or map them correctly within Nebula’s settings.

Final thoughts

Implementing identity federation in Zyxel Nebula 20.10 is a powerful step towards modernizing your network’s access management. You’ve now gained the ability to centralize authentication, leverage Single Sign-On for your administrators, and enhance overall security by integrating with your existing Identity Provider. This not only streamlines the user experience but also significantly reduces the administrative overhead associated with managing multiple sets of credentials.

As you continue to manage your network, remember to regularly review your federation settings and IdP certificates to ensure continuous, secure access. Zyxel Nebula’s commitment to integrating advanced enterprise features like identity federation truly empowers you to build a more robust, efficient, and secure network infrastructure. Embrace these capabilities to unlock the full potential of your Zyxel Nebula deployment.