Manuals / Avaya / Computer Equipment / Network Router

Avaya 3.7 manual Servers, Add servers

Models: 3.7

1 326

Download 326 pages 56.24 Kb

Page 210

Using advanced features

Servers

The Servers tab is used for adding backup directory servers to a specific security gateway. There is no practical limit on how many backups you can configure. Backup servers can be added at anytime, and they can be organized so that when one fails, a specific one can be used as a backup.

To install additional servers, see your iPlanet Directory Server documentation for instructions. The following procedure only establishes it as a backup server. The Directory Servers tab is shown in Figure 66.

Figure 66: The Directory Servers tab

Servers list presents a list of available directory servers. Three columns appear which include IP address or DNS Name, port, and SSL state.

Move Up/Down arrows are provided to change the position of the highlighted server.

Edit/Delete/Add buttons are provided at the bottom of the pane.

Add servers

Brings up a dialog box to add additional servers. Enter the new server’s IP address or DNS Name. The Locate This Server box contains three radio buttons used to place the new server:

●Beginning of List

●End of List (default)

●After Selected Item

210 Avaya VPNmanager Configuration Guide Release 3.7

Image 210

Avaya 3.7 manual Servers, Add servers

Contents

VPNmanager Confi guration Guide Copyright 2005, Avaya Inc All Rights Reserved Declarations of Conformity Page Contents Using VPNmanager Setting up the network Configuring IP Groups Configuring user groups 129 Establishing security 163 Using advanced features 199 Contents Monitoring your network 245 Glossary 313 Index 319 What Products are Covered VPNmanager OverviewIntranet and Extranet Support Secure VPN ConfigurationNetwork-wide Visibility and Control No Special Consoles RequiredHow This Book Is Organized Using VPNmanager HelpRelated Documentation Complementary to Snmp Management ToolsPreface Contacting Technical Support Preface Avaya VPNmanager Configuration Guide Release Components of the Avaya security solution Security gatewaysVPNremote Client software VPNmanager softwareOverview of the VPN management hierarchy Domain hierarchyPreparing to configure your network Security gatewayNetwork zones Media type SG5 and SG5X SG200 SG203 SG208 IP groups Remote users and user groupsStatic Routes Denial of Service Security policiesFirewall policies VoIP QoSAdditional features NATClient IP address pooling Sequence to configure your VPNSyslog SSL for Directory ServerSequence to configure your VPN Page About VPNmanager administrators Role Based ManagementTo add an administrator To configure an administrator to be an SNMPv3 adminLog into the VPNmanager console Add a policy serverNavigating the main window Open DomainFile menu VPNmanager console main windowFile MenuNew Object list New object Objects Description Edit menu View menuNew object Objects Description Toolbar Tools menuHelp menu Toolbar commands Description Commands Icons on toolbarNetwork Diagram View VPN view paneTiled View Tree ViewConfiguration Console window Alarm monitoring paneConfiguration Console Menu bar Configuration console windowPolicy Services NATToolbar Update DevicesContents pane Details panePreferences General tabDyna Policy Defaults User Dyna Policy Defaults GlobalDyna Policy Authentication Preferences, Dyna-Policy Global TabAdvanced Remote ClientAlarm/Monitoring TEP PolicyTunnel End Point Policy Page New VPN Domain To create a new domainSelect Level of security Configuring a security gateway Creating a new security gatewayTo create a new security gateway Setting up the network Using Device tabs to configure the security gateway Device tabs by release Tab All VPNos Releases Earlier LaterSnmp Device General tab Memo tab To create a memoDNS tab DNS tabDNS Relay Configuration area, click Add To add a DNS RelayTo add a DNS server address Configuring the DNS tab for VSU at VPNos 4.2 or earlierTo add a static DNS server To edit an existing server addressInterfaces tab To delete a DNS server addressInterface tab Network zones Media SG5 SG200 SG203 SG208 TypeEthernet2 Unused Public backup Private Semiprivate Using Device tabs to configure the security gateway Dhcp addressing Options for IP addressing for interface zonesStatic addressing Manage-ment Address assignedPoint-to-Point Protocol Over Ethernet PPPoE Client Local Dhcp ServerWins Static To change the media interface configurationDhcp Relay Changing network interfacesMedia interface configuration dialog To add an IP device to the security gatewayTo add an IP telephony device to the security gateway Private port tab Private port tab with VPNos 4.2 or VPNosAdding an IP Device Configuration IP Device Configuration with VPNos 4.2 or VPNosTo add an IP Device Device users tab NoneNetwork Object tab To add a device account userRouting Device Network Objects tabTo build a routing table using the default gateway Default Gateway for VPN Traffic VPNos Common Default Gateway for VPN Traffic topologyTo build a RIP table Policies tab, NAT services About NAT types for VPNosConfiguring NAT VPNos Priority of NAT typesTo add a NAT rule VPNos To edit a NAT ruleTo delete a NAT rule About NAT types for VPNos NAT applicationsAccessing the Internet from private networks Access the Internet from private NetworksSetting up VPN with overlapping private addresses Setting Up a VPN with Overlapping private Addresses Using NAT to support multiple gateway configurations Using NAT to Support Multiple Gateways Interface for VPNosTo configure a NAT rule Add NAT Rule VPNos 4.2 or earlierOriginal Tunnel NAT rules To add a tunnel NAT rule About IP Groups Creating a New IP GroupTo create a new IP Group New IP Group IP Group General tabIP Group General tab Add IP Group member Configuring an IP Group Configuring an IP Group that connects to an extranet To configure an IP Group that is associated with an extranetDelete Memo Configuring remote access users Default client configurationUsing dyna-policy User Dyna-Policy tabConfiguring a global dyna-policy Dyna-Policy Defaults User tabDyna-Policy Defaults Global tab VPN configuration files on remote user’s computerDisable split tunneling Dyna-Policy Authentication tab Ldap authentication Local authenticationRadius authentication Dynamic VPNs VPNosClient DNS resolution redirection Remote Client tabRemote Client inactivity connection time-out VPNos Send Syslog messagesConfigure a default CCD with global dyna-policy Creating new user object User General tab Default userAbout creating individual dynamic-policy To create a new user objectDyna-Policy tab User General tabReset User Directory Password. The user’s password is reset Actions tabConfiguring a remote user object User Advanced tabInformation for VPNremote Client users Using local authentication Using Policy Manager for user configurationClient IP address pool configuration Using Radius authentication VPNos 3.X and VPNosAdd Client IP address pool Add Client DNSAdd Client Wins Configuring client attributesTo configure the Client IP configuration Creating a messageEnforce brand name Policy Manager for client attributesRADIUS/ACE Services Enable RADIUS/ACESettings Radius conceptsAdd RADIUS/ACE server Authenticating secret passwordRadius protocol Radius server dataTo add a Radius server RADIUS/ACEConfiguring remote access users New user group To create a user groupUser Group General tab User Group Memo tabMove to the Configuration Console window Configuring a user groupTo configure a user group User Group Actions tabConfiguring user groups Types of VPN objects Skip VPNsIKE VPNs VPN packet processing modesDefault VPN policy Creating a new VPN object Creating a default VPNTo create a default VPN within a selected domain To create a new VPN objectCreating a designated VPN Create a new VPN Object, see Creating a new VPN object onUsing the VPN tabs General tab with IKEGeneral tab with Skip Members-Users tab Members-IP Groups tabSecurity IKE tab VPN, Members IP Groups TabSHA1 Field Description Security IPSec Pre-Shared SecretIPSec Proposals Authentication Add IPSec proposalField Description Encryption Field Description Lifetime VPN configuration ExportAdvanced VPN tab Rekey site-to-site VPNRekey Configuring a Skip VPN To configure a new Skip VPN objectConfiguring a Skip VPN Configuring an IKE VPN To configure a new IKE VPN ObjectConfiguring an IKE VPN Configuring VPN objects Configuring an IKE VPN Enabling CRL checking Enabling CRL checking Click Update Devices Exporting a VPN object to an extranetTo remove the CRL from the VSU VPN Object export checklist VPN Object Export Checklist TaskExport procedure To export a VPN ObjectOpen the Configuration Console window Importing a VPN object from an extranetTo import a VPN Object data file Rekeying a VPN object To rekey a Skip VPN ObjectFirewall rules set up Levels of firewall policy managementFirewall rules Domain level firewall rulesTo create domain level firewall rules Device level firewall rules To create device level firewall rulesPriority of Firewall rules versus NAT rules Security Gateways and FTP Firewall templates To add a new firewall rule for FTP-control or passive FTPTo add a new firewall rule for active FTP Predefined templates User defined templatesTo create a user-defined firewall template Select Template, Device, or None Parameter Description Services Services propertyDenial of Service Device GroupTo create a device group object Denial of Service Using the IP Trunking Call Model Voice Over IPTo select or deselect DOS categories To enable VoIP and add IP Trunking Voice Over IP Using the Gatekeeper Routed Call Model Voice over IP tabAdd gatekeeper settings To enable VoIP and add gatekeeper settingsQoS policy and QoS mapping QoS PolicyQoS policy and QoS mapping To add a QoS policy QoS policyModify QoS bandwidth. burst and Dscp value screen Packet Filtering QoS mappingMapping QoS policies What can be filtered Packet Filtering and NATTraffic types that can be filtered Permit/Deny non-VPN traffic Radio Buttons Policy Manager, Packet Filtering/QoSAdd Packet Filtering Policy From/Where Locating this filtering policy To WhereFiltering Policy in progress Running the packet filtering policy wizardRunning the Policy Manager for packet filtering Starting and stopping filtering servicesTo start or stop filtering services Managing the ACLACL commands Command Description Configuring advanced filtering optionsTo configure advanced filtering options To edit, change the sequence, or delete a filtering policyMarking packets for differentiated services QoS Packet Filter rule-advanced options Option DescriptionAbout Differentiated Services How a VSU marks packetsTo create a packet marking rule How to create a packet marking ruleTypes of marking rules IP packet marking information DescriptionParameters used in a Packet Marking Rule Description Packet filtering firewall Policy Manager for firewallsTo add a firewall policy Add firewall policyTo use the firewall policy management Parameter DescriptionEstablishing security Using advanced features Device AdvancedARP Path MTU Discovery You would then want toTo configure the Path MTU Discovery Enter the Path MTU Timeout valueNAT Traversal Private IP Address VPNos Port for Secure AuthenticationPort for dyna-policy download To change the port numberTo add a private IP address Select the Enable Private IP Address check boxSend Device Names To select a VSU name distribution methodSuperUser Password VPNos Tunnel Persistence VSU Tunnel Persistence TEP Policy Servers Add serversAdd Directory Server Commands Description To create a backup serverTo edit, change the sequence, or delete a backup server Managing the server listServers list commands Command Description Resilient TunnelTunnel Switching Primary and Resilient TunnelsCreating a resilient tunnel Resilient Tunnel tab for a security gateway ObjectAdd resilient tunnel PrerequisitesTo create a resilient tunnel Managing the resilient tunnel list Secondary end-point service Stopping and starting resilient tunnel servicesPrimary end-point service Move to the Configuration Console window. Select DevicesFailover TEP Failover TEP tab for a security gateway objectConfiguring failover TEP To configure failover TEPAdvanced Action Switch Flash Reset passwordDisable Fips High Availability High AvailabilityVirtual addresses Advanced parametersSelect the Deny all non VPN traffic radio button Members Configuring high availability Creating a High Availability GroupUpdating a high availability group using Update Device To update HA VSUsDeleting a high availability group Failover Failover TabConfiguration is as follows To configure failoverFailover connectivity checks in 10-second intervals Set consecutive no responses To set up failover reconnect Failover reconnectConverged Network Analyzer Test Plug Select the CNA Test Plug Services interface Enter the test request port valueKeep Alive To configure keep alive Keep alive tabPolicy Manager My Certificates About VSU certificatesCreating and Installing a Signed Certificate Installing a Signed Certificate into a VSUTo install a signed certificate into a VSU Policy Manager for My CertificatesSwitching certificates used by VPNmanager Console To switch certificatesIssuer certificates About Issuer CertificatesInstalling an issuer certificate To install an Issuer Certificate into a VSU targetAn Example of an Issuer Certificate IKE Certificate UsageAbout Certificate Usage Exchange Assigning a Target for a CertificateTo assign a target for a certificate Click Add to open the Add IKE Certificate PolicyPolicy Manager My Certificates Page Using Snmp to monitor the device Monitoring your networkTo add Snmp trap targets Snmp Tab for a security gateway ObjectVPN active sessions Adding Admin Users for SNMPv3Configuring Snmp for a security gateway To delete Snmp trap targetsSyslog Services Policy Manager for Syslog ServicesTo run Syslog services Add Syslog PolicyUsing Monitor Enterprise MIBMonitoring wizard Using Monitor Log Group Parameters Description System Group ParametersActiveSessions Parameters Description Address Table Parameters Description IpRouteTable ParametersIpRouteTable Parameters Description IpRouteTable Parameters Description FilterStats Parameters FilterStats Parameters Description FilterStats Parameters Description FilterStats Parameters Description FilterStats Parameters Description FilterStats Parameters Description Filter Rules Parameters Active Ports Parameters Description Group Traffic Rate Table ParametersTraffic Rate Table Parameters Description Overview Statistics Table ParametersOverview Statistics Table Parameters Description Ethernet Statistics Table ParametersDefine Custom Ethernet Statistics Table Parameters DescriptionMonitoring alarms Monitoring wizard PresentationPresentation Alarm Types Alarm Descriptions Alarm TypeReport Wizard To create a report using the report wizard Generating the report Report SampleDevice diagnostics Diagnostic Reports Report Type DescriptionDiagnostic Reports Report Type Description Using the Management tab Setting Up SSH and TelnetChanging device administrator’s passwords To set up SSH or TelnetUsing the Connectivity tab To reset the passwordsCheck connectivity by ping Connectivity tab for a security gateway ObjectTo directly ping a specific security gateway Using the Device Actions tabCheck Connectivity by Proxy Ping To proxy ping a specific security gatewayUpdate Configuration Reset Device TimeReboot Device Re-setup Device Import Device ConfigurationTo import configuration data for a device Ethernet SpeedRedundancy Network Interface StatusImporting and exporting VPN configurations to a device SwitchingExport VPN Exporting Radius Device management Upgrading firmware and licenses Centralized firmware managementDevice Upgrade tab To upgrade a security gateway’s firmware Upgrading a security gateway’s firmwareSelect Save this file to disk. Click OK License Remote Access VSU-100 Only Encryption StrengthOpen Page When to Configure your VPNmanager for SSL Installing Certificates for Running SSLTo delete an installed issuer’s certificates To install a certificate in VPNmanager ConsoleTo view all the installed issuer’s certificates Windows NT and Windows 2000 ComputersInstalling the Issuer’s Certificate into a security gateway To install the issuer’s certificate into a security gatewaySolaris OS Computers Using SSL with Directory Server Appendix B Firewall rules template GeneralPublic zone firewall templates Public high and medium security firewall rules Telnet Ikein Public low security firewall rules Public VPN-only firewall rulesPrivate zone firewall templates Private high security firewall rules Private medium security firewall rulesSemi-private zone firewall templates Private low security firewall rulesSemi-private high security firewall rules PingSemi-private medium security firewall rules Semi-private low security firewall rules Semi-private VPN-only security firewall rulesDMZ zone firewall templates DMZ high and medium security firewall rulesDMZ low security firewall rules Management zone security Converged Network Anaylyzer templateManagement high, medium, and low security firewall rules Converged network analyzer firewall rules CNA-RTAggressive mode AlarmsCertificates Service DNSCertificate Authority CertificateEncapsulation Dynamic VPNsDyna Policy Extranet securityMIB Enterprise Lifetime, KeyMask Pairs Non-EnterprisePerfect Forward OakleyPacket Filter SecrecyTriple DES Smart CardSplit Tunneling User GroupsIndex DOS 254 55, 97, 115, 129 PAP Radius ToS, marking 193 Zone, public zone, public-backup