Casio ACS V6000 Security, Authentication, VPN based on IPSec with NAT traversal, Packet filtering

Chapter 1: Introduction 3

administrator can assign to custom user groups. For more information, see Users Accounts and User Groups on page 38.

Security

Security profiles determine which network services are enabled on the virtual console server. Administrators can either allow all users to access enabled ports or allow the configuration of group authorizations to restrict access. You can also select a security profile, which defines which services (FTP, ICMP, IPSec and Telnet) are enabled and SSH and HTTP/HTTPS access. The administrator can select either a preconfigured security profile or create a custom profile. See Security profiles on page 16.

Authentication

Authentication can be performed locally, with One Time Passwords (OTP), a remote Kerberos, LDAP, NIS, RADIUS, TACACS+ authentication server or a DSView 3 server. The virtual console server also supports remote group authorizations for the LDAP, RADIUS and TACACS+ authentication methods. Fallback mechanisms are also available.

Any authentication method configured for the console server or the ports is used for authentication of any user who attempts to log in through Telnet, SSH or the web manager.

VPN based on IPSec with NAT traversal

If IPSec is enabled in the selected security profile, an administrator can use the VPN feature to enable secure connections. IPSec encryption with optional NAT traversal (which is configured by default) creates a secure tunnel for dedicated communications between the virtual console server and other computers that have IPSec installed. ESP and AH authentication protocols, RSA Public Keys and Shared Secret are supported.

Packet filtering

An administrator can configure a virtual console server to filter packets like a firewall. Packet filtering is controlled by chains, which are named profiles with user-defined rules. The virtual console server filter table contains a number of built-in chains that can be modified but not deleted. An administrator can also create and configure new chains.

SNMP

If SNMP is enabled in the selected security profile, an administrator can configure the Simple Network Management Protocol (SNMP) agent on the virtual console server to send notifications or traps to an SNMP management application.

The virtual console server SNMP agent supports SNMP v1/v2 and v3, MIB-II and Enterprise MIB.