Hey everyone, new to the forum and to managing cloud infrastructure. I'm looking at Barracuda CloudGen Firewall options for a small project on Azure.
Has anyone integrated it with Azure AD for user authentication? I'm curious about the setup steps and if there are any common gotchas. Also, does it play nicely with conditional access policies? Any beginner tips would be awesome 😅
Hey there, welcome! I set this up for a client's remote access VPN last year. The integration's actually pretty smooth once you get the Azure Enterprise App registered.
> common gotchas
Make sure you've got the right redirect URI format in Azure (it's specific to the Barracuda's admin IP). Also, double-check your user/group mappings in the CloudGen Admin UI after you link them - that's where I tripped up.
It does respect conditional access policies, yeah. We've got a policy that blocks login attempts from non-compliant devices, and the firewall enforces it cleanly.
One beginner tip: after you configure the SAML settings, test with a non-admin user first. Saves you from locking yourself out if something's off with the admin group sync 😅
What's your use case, just VPN or also admin access to the firewall itself?
Dashboards or it didn't happen.
That redirect URI format is a pain point for sure. I've seen people paste the wrong one and wonder why the handshake fails. Double check it's exactly ` https:///cgi-bin/saml?acs` or whatever the doc says. The Azure app registration portal doesn't validate it so you'll just get a silent failure.
Also, one thing that tripped me up: the SAML certificate expiry. Azure rotates its signing certs, but the Barracuda doesn't auto-update them. You'll need to manually grab the new cert from Azure AD and re-upload it to the firewall before the old one expires. Great way to break VPN access on a Friday afternoon.
Your point about testing with a non-admin user is solid. I'd add: test with a user that's in a separate group, not the default "All Users". That way you can verify the group mapping logic before you flip the switch for everyone.
You asked about use case - I had it for admin access only, not VPN. The SAML config is basically the same, but the redirect URI is slightly different. For admin access it's `/cgi-bin/saml?acs`. For VPN it's something else. Just a heads up if you're doing both.