Manuals / Avaya / Computer Equipment / Network Router

Avaya 3.7 manual Alarm/Monitoring, TEP Policy

Models: 3.7

1 326

Download 326 pages 56.24 Kb

Page 52

Using VPNmanager

Alarm/Monitoring

The Alarm/Monitoring tab is used to define high-level functions of the alarm console. See Monitoring alarms on page 268.

Figure 15: Preference, Alarm/Monitoring

Resolve IP Address to Device Name - Enable/Disable. When enabled, the IP address of the alarming security gateway is translated into the security gateway name for display in the Alarm Console. When disabled, only the alarming IP address is shown.

Functionally, all security gateways in all domains are scanned and a map file is created to cross reference the security gateway IP addresses to their respective security gateway names. Default is enabled.

Alarm When Device is Unreachable - Enable/Disable. When enabled, this function causes the VPNmanager to continuously send SNMP packets to all security gateways to verify that they are running. If a security gateway fails to respond, an error message is displayed in the Alarm Console.

TEP Policy

The Tunnel End Point (TEP) Policy tab lets you control the security policy applied to the traffic that flows between the end points of a tunnel. The default is off, that is, do not apply configured VPN policies to TEP traffic. See TEP Policy on page 209.

52 Avaya VPNmanager Configuration Guide Release 3.7

Image 52

Avaya 3.7 manual Alarm/Monitoring, TEP Policy

Contents

VPNmanager Confi guration Guide Copyright 2005, Avaya Inc All Rights Reserved Declarations of Conformity Page Contents Using VPNmanager Setting up the network Configuring IP Groups Configuring user groups 129 Establishing security 163 Using advanced features 199 Contents Monitoring your network 245 Glossary 313 Index 319 What Products are Covered VPNmanager OverviewSecure VPN Configuration Network-wide Visibility and ControlIntranet and Extranet Support No Special Consoles RequiredUsing VPNmanager Help Related DocumentationHow This Book Is Organized Complementary to Snmp Management ToolsPreface Contacting Technical Support Preface Avaya VPNmanager Configuration Guide Release Components of the Avaya security solution Security gatewaysVPNremote Client software VPNmanager softwareOverview of the VPN management hierarchy Domain hierarchyPreparing to configure your network Security gatewayNetwork zones Media type SG5 and SG5X SG200 SG203 SG208 Remote users and user groups IP groupsStatic Routes Security policies Denial of ServiceFirewall policies VoIP QoSAdditional features NATSequence to configure your VPN SyslogClient IP address pooling SSL for Directory ServerSequence to configure your VPN Page About VPNmanager administrators Role Based ManagementTo add an administrator To configure an administrator to be an SNMPv3 adminLog into the VPNmanager console Add a policy serverNavigating the main window Open DomainFile menu VPNmanager console main windowFile MenuNew Object list New object Objects Description View menu Edit menuNew object Objects Description Tools menu ToolbarHelp menu Toolbar commands Description Commands Icons on toolbarNetwork Diagram View VPN view paneTiled View Tree ViewConfiguration Console window Alarm monitoring paneConfiguration Console Menu bar Configuration console windowPolicy Services NATUpdate Devices Contents paneToolbar Details panePreferences General tabDyna Policy Defaults User Dyna Policy Defaults GlobalDyna Policy Authentication Preferences, Dyna-Policy Global TabAdvanced Remote ClientAlarm/Monitoring TEP PolicyTunnel End Point Policy Page New VPN Domain To create a new domainSelect Level of security Creating a new security gateway Configuring a security gatewayTo create a new security gateway Setting up the network Using Device tabs to configure the security gateway Device tabs by release Tab All VPNos Releases Earlier LaterSnmp Device General tab Memo tab To create a memoDNS tab DNS tabDNS Relay Configuration area, click Add To add a DNS RelayConfiguring the DNS tab for VSU at VPNos 4.2 or earlier To add a static DNS serverTo add a DNS server address To edit an existing server addressInterfaces tab To delete a DNS server addressInterface tab Network zones Media SG5 SG200 SG203 SG208 TypeEthernet2 Unused Public backup Private Semiprivate Using Device tabs to configure the security gateway Options for IP addressing for interface zones Static addressingDhcp addressing Manage-ment Address assignedPoint-to-Point Protocol Over Ethernet PPPoE Client Local Dhcp ServerWins To change the media interface configuration Dhcp RelayStatic Changing network interfacesMedia interface configuration dialog To add an IP device to the security gatewayTo add an IP telephony device to the security gateway Private port tab Private port tab with VPNos 4.2 or VPNosAdding an IP Device Configuration IP Device Configuration with VPNos 4.2 or VPNosTo add an IP Device Device users tab NoneNetwork Object tab To add a device account userRouting Device Network Objects tabTo build a routing table using the default gateway Default Gateway for VPN Traffic VPNos Common Default Gateway for VPN Traffic topologyTo build a RIP table Policies tab, NAT services About NAT types for VPNosConfiguring NAT VPNos Priority of NAT typesTo edit a NAT rule To add a NAT rule VPNosTo delete a NAT rule About NAT types for VPNos NAT applicationsAccessing the Internet from private networks Access the Internet from private NetworksSetting up VPN with overlapping private addresses Setting Up a VPN with Overlapping private Addresses Using NAT to support multiple gateway configurations Using NAT to Support Multiple Gateways Interface for VPNosAdd NAT Rule VPNos 4.2 or earlier To configure a NAT ruleOriginal Tunnel NAT rules To add a tunnel NAT rule Creating a New IP Group About IP GroupsTo create a new IP Group New IP Group IP Group General tabIP Group General tab Add IP Group member Configuring an IP Group Configuring an IP Group that connects to an extranet To configure an IP Group that is associated with an extranetDelete Memo Configuring remote access users Default client configurationUsing dyna-policy User Dyna-Policy tabConfiguring a global dyna-policy Dyna-Policy Defaults User tabVPN configuration files on remote user’s computer Dyna-Policy Defaults Global tabDisable split tunneling Dyna-Policy Authentication tab Local authentication Radius authenticationLdap authentication Dynamic VPNs VPNosClient DNS resolution redirection Remote Client tabRemote Client inactivity connection time-out VPNos Send Syslog messagesConfigure a default CCD with global dyna-policy Creating new user object Default user About creating individual dynamic-policyUser General tab To create a new user objectDyna-Policy tab User General tabReset User Directory Password. The user’s password is reset Actions tabConfiguring a remote user object User Advanced tabInformation for VPNremote Client users Using Policy Manager for user configuration Client IP address pool configurationUsing local authentication Using Radius authentication VPNos 3.X and VPNosAdd Client IP address pool Add Client DNSConfiguring client attributes To configure the Client IP configurationAdd Client Wins Creating a messageEnforce brand name Policy Manager for client attributesRADIUS/ACE Services Enable RADIUS/ACESettings Radius conceptsAuthenticating secret password Radius protocolAdd RADIUS/ACE server Radius server dataTo add a Radius server RADIUS/ACEConfiguring remote access users New user group To create a user groupUser Group General tab User Group Memo tabConfiguring a user group To configure a user groupMove to the Configuration Console window User Group Actions tabConfiguring user groups Types of VPN objects Skip VPNsIKE VPNs VPN packet processing modesDefault VPN policy Creating a default VPN To create a default VPN within a selected domainCreating a new VPN object To create a new VPN objectCreating a designated VPN Create a new VPN Object, see Creating a new VPN object onUsing the VPN tabs General tab with IKEGeneral tab with Skip Members-Users tab Members-IP Groups tabSecurity IKE tab VPN, Members IP Groups TabSHA1 Field Description Security IPSec Pre-Shared SecretIPSec Proposals Add IPSec proposal AuthenticationField Description Encryption Field Description Lifetime VPN configuration ExportRekey site-to-site VPN Advanced VPN tabRekey Configuring a Skip VPN To configure a new Skip VPN objectConfiguring a Skip VPN Configuring an IKE VPN To configure a new IKE VPN ObjectConfiguring an IKE VPN Configuring VPN objects Configuring an IKE VPN Enabling CRL checking Enabling CRL checking Exporting a VPN object to an extranet Click Update DevicesTo remove the CRL from the VSU VPN Object export checklist VPN Object Export Checklist TaskExport procedure To export a VPN ObjectImporting a VPN object from an extranet Open the Configuration Console windowTo import a VPN Object data file Rekeying a VPN object To rekey a Skip VPN ObjectFirewall rules set up Levels of firewall policy managementFirewall rules Domain level firewall rulesTo create domain level firewall rules Device level firewall rules To create device level firewall rulesPriority of Firewall rules versus NAT rules Security Gateways and FTP To add a new firewall rule for FTP-control or passive FTP Firewall templatesTo add a new firewall rule for active FTP User defined templates Predefined templatesTo create a user-defined firewall template Select Template, Device, or None Parameter Description Services Services propertyDevice Group Denial of ServiceTo create a device group object Denial of Service Voice Over IP Using the IP Trunking Call ModelTo select or deselect DOS categories To enable VoIP and add IP Trunking Voice Over IP Using the Gatekeeper Routed Call Model Voice over IP tabAdd gatekeeper settings To enable VoIP and add gatekeeper settingsQoS policy and QoS mapping QoS PolicyQoS policy and QoS mapping To add a QoS policy QoS policyModify QoS bandwidth. burst and Dscp value screen QoS mapping Packet FilteringMapping QoS policies Packet Filtering and NAT What can be filteredTraffic types that can be filtered Permit/Deny non-VPN traffic Radio Buttons Policy Manager, Packet Filtering/QoSAdd Packet Filtering Policy From/Where To Where Filtering Policy in progressLocating this filtering policy Running the packet filtering policy wizardStarting and stopping filtering services To start or stop filtering servicesRunning the Policy Manager for packet filtering Managing the ACLConfiguring advanced filtering options To configure advanced filtering optionsACL commands Command Description To edit, change the sequence, or delete a filtering policyMarking packets for differentiated services QoS Packet Filter rule-advanced options Option DescriptionAbout Differentiated Services How a VSU marks packetsHow to create a packet marking rule Types of marking rulesTo create a packet marking rule IP packet marking information DescriptionParameters used in a Packet Marking Rule Description Packet filtering firewall Policy Manager for firewallsAdd firewall policy To use the firewall policy managementTo add a firewall policy Parameter DescriptionEstablishing security Using advanced features Device AdvancedARP Path MTU Discovery You would then want toTo configure the Path MTU Discovery Enter the Path MTU Timeout valueNAT Traversal Port for Secure Authentication Port for dyna-policy downloadPrivate IP Address VPNos To change the port numberSelect the Enable Private IP Address check box Send Device NamesTo add a private IP address To select a VSU name distribution methodSuperUser Password VPNos Tunnel Persistence VSU Tunnel Persistence TEP Policy Servers Add serversTo create a backup server To edit, change the sequence, or delete a backup serverAdd Directory Server Commands Description Managing the server listServers list commands Command Description Resilient TunnelTunnel Switching Primary and Resilient TunnelsCreating a resilient tunnel Resilient Tunnel tab for a security gateway ObjectPrerequisites Add resilient tunnelTo create a resilient tunnel Managing the resilient tunnel list Stopping and starting resilient tunnel services Primary end-point serviceSecondary end-point service Move to the Configuration Console window. Select DevicesFailover TEP Failover TEP tab for a security gateway objectTo configure failover TEP Configuring failover TEPAdvanced Action Reset password Switch FlashDisable Fips High Availability High AvailabilityAdvanced parameters Virtual addressesSelect the Deny all non VPN traffic radio button Members Configuring high availability Creating a High Availability GroupTo update HA VSUs Updating a high availability group using Update DeviceDeleting a high availability group Failover Failover TabTo configure failover Configuration is as followsFailover connectivity checks in 10-second intervals Set consecutive no responses To set up failover reconnect Failover reconnectConverged Network Analyzer Test Plug Select the CNA Test Plug Services interface Enter the test request port valueKeep Alive To configure keep alive Keep alive tabPolicy Manager My Certificates About VSU certificatesCreating and Installing a Signed Certificate Installing a Signed Certificate into a VSUTo install a signed certificate into a VSU Policy Manager for My CertificatesSwitching certificates used by VPNmanager Console To switch certificatesIssuer certificates About Issuer CertificatesInstalling an issuer certificate To install an Issuer Certificate into a VSU targetAn Example of an Issuer Certificate IKE Certificate UsageAbout Certificate Usage Exchange Assigning a Target for a CertificateTo assign a target for a certificate Click Add to open the Add IKE Certificate PolicyPolicy Manager My Certificates Page Using Snmp to monitor the device Monitoring your networkTo add Snmp trap targets Snmp Tab for a security gateway ObjectAdding Admin Users for SNMPv3 Configuring Snmp for a security gatewayVPN active sessions To delete Snmp trap targetsSyslog Services Policy Manager for Syslog ServicesTo run Syslog services Add Syslog PolicyEnterprise MIB Using MonitorMonitoring wizard Using Monitor Log Group Parameters Description System Group ParametersActiveSessions Parameters Description Address Table Parameters Description IpRouteTable ParametersIpRouteTable Parameters Description IpRouteTable Parameters Description FilterStats Parameters FilterStats Parameters Description FilterStats Parameters Description FilterStats Parameters Description FilterStats Parameters Description FilterStats Parameters Description Filter Rules Parameters Active Ports Parameters Description Group Traffic Rate Table ParametersTraffic Rate Table Parameters Description Overview Statistics Table ParametersOverview Statistics Table Parameters Description Ethernet Statistics Table ParametersDefine Custom Ethernet Statistics Table Parameters DescriptionMonitoring wizard Presentation Monitoring alarmsPresentation Alarm Types Alarm Descriptions Alarm TypeReport Wizard To create a report using the report wizard Generating the report Report SampleDevice diagnostics Diagnostic Reports Report Type DescriptionDiagnostic Reports Report Type Description Using the Management tab Setting Up SSH and TelnetChanging device administrator’s passwords To set up SSH or TelnetUsing the Connectivity tab To reset the passwordsCheck connectivity by ping Connectivity tab for a security gateway ObjectUsing the Device Actions tab Check Connectivity by Proxy PingTo directly ping a specific security gateway To proxy ping a specific security gatewayReset Device Time Update ConfigurationReboot Device Re-setup Device Import Device ConfigurationTo import configuration data for a device Ethernet SpeedRedundancy Network Interface StatusSwitching Importing and exporting VPN configurations to a deviceExport VPN Exporting Radius Device management Upgrading firmware and licenses Centralized firmware managementDevice Upgrade tab Upgrading a security gateway’s firmware To upgrade a security gateway’s firmwareSelect Save this file to disk. Click OK License Encryption Strength Remote Access VSU-100 OnlyOpen Page When to Configure your VPNmanager for SSL Installing Certificates for Running SSLTo install a certificate in VPNmanager Console To view all the installed issuer’s certificatesTo delete an installed issuer’s certificates Windows NT and Windows 2000 ComputersTo install the issuer’s certificate into a security gateway Installing the Issuer’s Certificate into a security gatewaySolaris OS Computers Using SSL with Directory Server Appendix B Firewall rules template GeneralPublic zone firewall templates Public high and medium security firewall rules Telnet Ikein Public low security firewall rules Public VPN-only firewall rulesPrivate zone firewall templates Private high security firewall rules Private medium security firewall rulesSemi-private zone firewall templates Private low security firewall rulesSemi-private high security firewall rules PingSemi-private medium security firewall rules Semi-private low security firewall rules Semi-private VPN-only security firewall rulesDMZ zone firewall templates DMZ high and medium security firewall rulesDMZ low security firewall rules Converged Network Anaylyzer template Management zone securityManagement high, medium, and low security firewall rules Converged network analyzer firewall rules CNA-RTAggressive mode AlarmsService DNS Certificate AuthorityCertificates CertificateDynamic VPNs Dyna PolicyEncapsulation Extranet securityLifetime, Key Mask PairsMIB Enterprise Non-EnterpriseOakley Packet FilterPerfect Forward SecrecySmart Card Split TunnelingTriple DES User GroupsIndex DOS 254 55, 97, 115, 129 PAP Radius ToS, marking 193 Zone, public zone, public-backup