Cloud Services Getting Started Guide (2026-08-21)

Table of Contents

1. Introduction & Provisioning
2. Administrator Enrolment
3. User Directories
4. User Roles
4.1. Role Based Access Control (RBAC)
5. Setting Up Log Analytics
6. Setting Up Passwordless VPN
6.1. Passwordless VPN Using OIDC
6.2. Passwordless VPN Using RADIUS
7. InControl Server as a Cloud Service

Chapter 1: Introduction & Provisioning

[Note] Note: Single page version

It is also available in a framed HTML version.

Introduction

This document provides a comprehensive overview of Clavister Cloud Services, specifically designed to extend the capabilities of the on-premises solutions through analytics and strong authentication as a service. By integrating with Clavister NetWall, these services offer enhanced security and insightful data analytics, ensuring a seamless transition and operation within the Clavister ecosystem.

Provisioning

The process for initiating Clavister Cloud services begins with license acquisition through relevant instances such as through Clavister sales and partners. You need at least one valid license allowing the use of Cloud Services, this can be for example either a Clavister NetWall appliance with Basics or higher or a Cloud Services add-on license with Essentials or higher. The license(s) need to be registered on MyClavister. Details about the needed license are shown in the table below.

Subscription Cloud Logging Cloud User Directory Log Analytics CyberSecurity Score Network Security Dashboards Cloud Services Specific Dashboards Passwordless RADIUS Authentication
NetWall with CSS
 Included Included Included Included Included Included  
NetWall with Basic or higher Included Included Included Included Included Included  
NetShield with Essentials or higher Included Included Included Included Included Included  
Cloud Authentication addon with Essentials or higher   Included Included Included   Included Included

Figure 1.1. Subscriptions

Following purchase, users provision a new cloud instance via MyClavister by entering administrator contact information. This triggers the automatic deployment of the cloud instance, with the primary administrator receiving an email containing further instructions for enrolment and activation of the service.

  1. Cloud Instance Provisioning

    1. Log into MyClavister.

    2. Navigate to "Cloud Services".

    3. Click "Request Provisioning".

    4. Enter the required information (email and mobile phone number) for the primary administrator.

      1. These details will be used for activation and future communications.

        [Important] Important: The phone must be able to receive SMS

        If the phone is unable to receive SMS messages, the activation will fail.

  2. Activation

    1. The cloud instance will be automatically deployed.

    2. The primary administrator will receive an email notification with instructions for the next steps, including enrolment and instance activation.

Chapter 2: Administrator Enrolment

This chapter outlines the step-by-step process for administrator enrolment in Clavister Cloud Services.

  1. Initial Email Notification

    Upon cloud instance provisioning, the primary administrator receives an email. This email contains links for both downloading the Clavister OneID mobile authentication app and starting the enrolment wizard.

  2. Enrolment Wizard

    Clicking the enrolment link directs the administrator to an online wizard. The first step requires entering their username, which is the email address used during the instance provisioning.

    1. One-Time Password Verification

      After submitting the email address, a one-time password (OTP) is sent to that email. The administrator must enter this OTP in the wizard to proceed. Following email verification, a second OTP is sent to the mobile phone number provided during provisioning. This OTP must also be entered to continue.

      1. Creating a Profile With the Clavister OneID Mobile Authentication App

        The final step in the wizard prompts the administrator to scan a QR code with the Clavister OneID mobile authentication app. If the app has not been downloaded, an option to download it is provided within the wizard.

        Scanning the QR code with the app creates a profile linked to the cloud instance, completing the enrolment process.

        1. Completion of Enrolment

          Upon successful profile creation in the Clavister OneID mobile authentication app, the enrolment process is concluded. The administrator is now ready to access the cloud services and can proceed with further configuration and user invitations.

          Chapter 3: User Directories

          Clavister Cloud Services provides integration with external user directories as part of its identity and access management capabilities. Using this organizations can connect existing directory services and synchronize users and groups into a centralized cloud-based identity platform.

          This enables Clavister Cloud Services to act as a unified identity layer across multiple services, supporting modern authentication protocols such as OpenID Connect (OIDC) as well as traditional RADIUS-based authentication.

          By aggregating identities from sources such as Microsoft Entra ID™, Active Directory™, and Google Workspace™, organisations can harmonise multiple directories into a single, consistent view. This simplifies identity management while preserving existing investments in directory infrastructure.

          The synchronization process ensures that identities are continuously updated and consistently represented across all connected services. Administrators can define roles, enforce access policies, and manage authentication centrally—regardless of where users originate.

          As an OIDC provider, Clavister IdAuth Cloud enables secure, standardised authentication for Clavister services as well as third-party applications, while the built-in cloud RADIUS service supports legacy and network-based authentication use cases. This allows organizations to bridge modern and traditional authentication methods within a single platform.

          Use Case

          A common use case is to integrate multiple external directories into Clavister Cloud Services to create a centralised identity platform for all authentication needs. Users from different identity providers can be unified, managed consistently, and granted access to a wide range of services—such as web applications via OIDC and network access via RADIUS—using a single identity and policy framework.

          How-To / Setup Guides

          Links to how-to guides on how to setup Microsoft Entra ID™, Active Directory™, and Google Directory™ can be found below:

          Chapter 4: User Roles

          Clavister Cloud Services uses Role-Based Access Control (RBAC) to manage user access to cloud services and connected resources. Roles provide a way to group users according to their responsibilities or required access and can be assigned to individual users or to groups synchronized from an external user directory.

          Roles can be used to control access to services and resources based on the authenticated user's role membership. When integrated with services such as Clavister OneConnect and NetWall, role information can also be used to apply access policies and restrict users to the resources they are authorised to access.

          4.1. Role Based Access Control (RBAC)

          Role-Based Access Control (RBAC) provides a way to control access to resources based on the roles assigned to users. In Clavister Cloud Services, roles can be used together with connected services to enforce access restrictions according to the user's role.

          Roles can be used to restrict access to specific OneConnect VPN servers. A user can be assigned one or more roles in IdAuth Cloud, and the corresponding roles can then be configured on the OneConnect VPN interface in NetWall.

          Example of Using Role Based Access Control

          Consider an organisation with two OneConnect VPN servers. One server is intended for users in one part of the organisation, while the other is intended for a different group of users. Some users may need access to both servers. Roles can be used to enforce this separation.

          Figure 4.1. 

          In this example, two roles are created in IdAuth Cloud Services:

          • OneConnect_1 - Grants access to OneConnect VPN server 1

          • OneConnect_2 - Grants access to OneConnect VPN server 2

          The configuration consists of the following steps:

          1. Create the roles

            In IdAuth Cloud Services, navigate to Users > Roles and create the OneConnect_1 and OneConnect_2 roles.

          2. Assign roles to users

            Assign the appropriate role or roles to each user. A user who needs access to both VPN servers can be assigned both roles.

          3. Configure OIDC in NetWall

            Configure NetWall to use the IdAuth Cloud instance as an OIDC identity provider. This allows authenticated user and role information to be provided to NetWall during the authentication process.

          4. Configure the OneConnect VPN interfaces

            In NetWall, configure the OneConnect VPN interfaces for the respective servers. In each VPN interface configuration, add the corresponding role to the User Groups setting. Meaning only a user with the appropriate role will be able to connect to the designated server.

          Chapter 5: Setting Up Log Analytics

          This chapter outlines the steps to configure Log Analytics in Clavister Cloud Services for detailed network monitoring and analysis.

          Requirements

          • Clavister NetWall or NetShield with active subscription

          Procedure

          1. Log Into Your Cloud Services Instance

            Access your account by logging into the Clavister Cloud Services platform.

          2. Navigate to Add-ons

            Once logged in, find and click on the "Add-ons" section from the menu options.

          3. Select Log Ingestion

            Within the Add-ons section, look for and click on "Log Ingestion" to begin setting up your analytics.

          4. Activate Through Configuration Wizard

            Follow the instructions provided by the configuration wizard to activate log ingestion.

          5. Copy the Generated Secret

            During the setup process, a secret key (also known as Pre-Shared-Key) will be generated. Ensure you copy and securely store this secret as it will be necessary for configuring your NetWall.

          6. Wait for Activation or Return Later

            After completing the activation steps, you have two options:

            1. Wait for the Activation to Conclude

              If you opt to wait, stay on the deployment screen until the activation process is fully completed. This approach not only confirms that you can move forward with configuring your NetWall but also ensures you receive the configuration script. This script significantly simplifies the setup by automating the integration process, eliminating the need for manual configuration.

              It's important to note that this script is only available at the end of the deployment process and will not be offered if you navigate away and return to the page after deployment has finished.

            2. Come back later

              If you don't want to wait for activation, you can exit and go back to the Log Ingestion page any time you want. When you return, you can get the extra connection details needed to set up your NetWall.

              [Note] Note: Drawback of leaving

              If you leave the page, you won't get the automatic setup script that makes things easier. This script is only given out right after activation finishes, so you'll have to set up your NetWall by hand.

          7. Configure Your NetWall

            With the generated secret and connection information in hand, proceed to configure your NetWall. This can be done in two ways:

            1. Manually

              Enter the connection details into your NetWall configuration manually.

            2. Using the Provided Script

              If you stayed on the deployment screen until the deployment finished, a script would be offered. This script automates the configuration process, simplifying the integration of your NetWall with the log ingestion service.

          Optional: Details About the Provided Script

          The provided script performs the following operations in the cOS Core once loaded and activated.

          1. Creates a folder in the address book

          2. Creates three objects in the address folder:

            1. An FQDN object for the Remote Endpoint address of the IPsec tunnel. This object will be used by the IPSec tunnel to find the server to connect to.

            2. A single host IP address for the Local Network of the IPsec tunnel. This IP address will also be used by the Log Receiver as the source IP when generating logs.

            3. A single host IP address for the Remote Network of the IPsec tunnel. This IP address will also be used by the Log Receiver as the target IP to send generated logs to, see further down.

          3. Creates a key-ring entry for the generated secret (Pre-Shared-Key).

          4. Creates a new routing table.

          5. Creates an IPsec tunnel that uses the above created objects and make the IPsec tunnel a member of the newly created routing table (for traffic inside the tunnel).

          6. Creates a Log Receiver configured to send logs to Clavister Cloud Services using the IPsec tunnel. The logs will be sent to the IP address defined as the Remote Network prevously. The newly created routing table will be used.

          [Note] Note: Using a different routing table.

          To make sure that NetWall uses the newly created IPsec tunnel and to avoid potential conflicts with any existing configuration objects and routes, a new routing table is created and used in the script.

          Chapter 6: Setting Up Passwordless VPN

          Clavister Cloud Services supports two mechanisms for providing passwordless authentication for OneConnect VPN:

          • OpenID Connect (OIDC)

          • RADIUS

          OIDC is the recommeded authentication mechanism for passwordless VPN. It provides a modern, standards-based authentication method and allows OneConnect users to authenticate through Clavister IdAuth Cloud. RADIUS is provided as an alternative for environments where RADIUS-based authentication is required or preferred.

          The following sections describe how to configure passwordless VPN authentication using OIDC and RADIUS, respectively.

          Requirements

          • Clavister NetWall with active subscription.

          • Clavister Cloud Services OIDC identity Provider or Passwordless RADIUS license.

          6.1. Passwordless VPN Using OIDC

          OIDC is the recommended method for configuring passwordless authentication for OneConnect VPN. In this configuration, Clavister IdAuth Cloud acts as the identity provider and NetWall uses OIDC to authenticate OneConnect users.

          The configuration consists of two parts: configuring the OIDC provider in Cloud Services and configuring the corresponding OIDC provider in NetWall.

          Configure OIDC in Cloud Services

          1. Log in to Cloud Services as an administrator.

          2. Navigate to Add-ons > OpenID Connect Provider.

          3. Click Add new and select NetWall as the type.

          4. Enter a name for the Relying Party.

          5. Save the configuration.

          After the Relaying Party has been created, the information provided by Cloud Services is required when configuring the OIDC provider in NetWall.

          Configure OIDC in NetWall

          In NetWall, create an OIDC provider using the information from the OIDC Relaying Party created in Cloud Services.

          1. Navigate to Policies > User Authentication > User Directories > OIDC.

          2. Add a new OIDC provider object.

          3. Enter the OIDC Discovery Endpoint provided by Cloud Services.

          4. Enter the OIDC Client ID provided by Cloud Services.

          5. Save the configuration.

          The OIDC provider can now be selected as the Authentication Source for the OneConnect server. For more information about OIDC and OneConnect in NetWall see:

          https://docs.clavister.com/

          6.2. Passwordless VPN Using RADIUS

          RADIUS provides an alternative method for configuring passwordless authentication for OneConnect VPN. In this configuration, Cloud Services provides the Passwordless RADIUS Authentication service, while NetWall forwards authentication requests from OneConnect to the service.

          The configuration consists of two parts: activating the Passwordless RADIUS Authentication add-on in Cloud Services and configuring NetWall to communicate with the RADIUS service.

          Configure Passwordless RADIUS in Cloud Services

          1. Log in to Cloud Services as an administrator.

          2. Navigate to Add-ons > Passwordless RADIUS Authentication.

          3. Click Start configuration to start the configuration wizard.

          4. Click Generate key to generate the IPsec and RADIUS pre-shared keys.

          5. Save the generated keys securely, as they are required when configuring NetWall.

          6. Click Activate to start the deployment of the Passwordless RADIUS service.

          7. Wait for the deployment to complete. The service connection information required for configuring NetWall is displayed after deployment.

          [Warning] Warning: Make Sure To Save the Connection Information After Deployment

          Make sure to save the deployment information when the process is completed as it will otherwise be lost and the process has to be re-created.

          Configure Passwordless RADIUS in NetWall

          Configure NetWall to forward authentication requests from the OneConnect server to the Passwordless RADIUS service. The configuration uses an IPsec tunnel to securely connect NetWall to the RADIUS service.

          1. Obtain the service connection information and pre-shared keys generated when the Passwordless RADIUS service was activated in Cloud Services.

          2. Configure the IPsec tunnel between NetWall and the Passwordless RADIUS service using the provided service FQDN, IP address, and IPsec pre-shared key.

          3. Create a RADIUS user directory in NetWall using the provided RADIUS service IP address and RADIUS pre-shared key. Use port 1812 for RADIUS authentication.

          4. Configure the OneConnect server to use RADIUS as the Authentication Source and select the configured RADIUS server.

          5. Save and activate the NetWall configuration.

          The Passwordless RADIUS service can now be used to authenticate users connecting through OneConnect.

          For a more detailed guide on how to configure NetWall with Passwordless RADIUS, see the following KB article:

          https://kb.clavister.com/346362589

          Chapter 7: InControl Server as a Cloud Service

          InControl Server as a Cloud Service provides a hosted InControl Server instance for centrally managing, configuring, and monitoring Clavister NetWall and NetShield firewalls. The service provides the capabilities of InControl without requiring an InControl Server to be deployed and maintained in the organisation's own environment.

          An InControl Cloud Services license is required to provision an InControl Server instance. Once the instance has been provisioned, the FQDN address and port used to access the server are provided together with a download link for the InControl client.

          Clavister maintains and updates the hosted InControl Server, reducing the operational effort required from the organisation. This includes maintaining the server environment and keeping the InControl software up to date, while providing secure remote access to the centralised management system.

          Access to the InControl Server is managed through Cloud Services authentication. Users with the Auditor or Administrator role can log in using their Cloud Services credentials and authentication method, such as a username and the Clavister OneID mobile authentication app.

          Figure 7.1. 

          Steps to Access InControl as a Cloud Service

          1. Obtain an InControl Cloud Services license
            Ensure that an InControl Cloud Services license is registered in MyClavister.

          2. Request InControl provisioning
            In MyClavister, request provisioning of an InControl Server. Once the provisioning is complete, the FQDN/DNS address and port for the InControl Server are provided.

          3. Install the InControl client
            Download and install the InControl client using the download link provided after provisioning.

          4. Log in to InControl
            Start the InControl client and connect to the provisioned InControl Server using the provided FQDN/DNS address and port. Log in using a Cloud Services user with the Auditor or Administrator role and authenticate using the configured authentication method, such as Clavister OneID.

          5. Add a firewall
            Add the Clavister NetWall or NetShield firewall to InControl. The firewall must have a publicly accessible IP address so that it can communicate with the InControl Server.

          For more information and details on how to use InControl, see

          https://docs.clavister.com