 12
direction.Theadministratormayuseanyofthepre-definedRulesorcreate
customRulestobeincludedineachFilter.
• StatusFunctions:toviewtheswitchconfiguration,routingtables,active
sessions,useGetstoviewSimpleNetworkManagementProtocol(SNMP)
ManagementInformationBase(MIB)IIstatistics,usagegraphs,health,
temperature,memorystatus,voltage,packetstatistics,andreviewaccounting
logs.
• ManagetheSwitch:tologoffusers,shutdownorresettheswitch,disable
orenableaudiblealarms,manuallybackupswitchconfigurations,restore
switchconfigurations,createarecoverydiskette,etc.
Acompletedescriptionofallthemanagementandconfigurationcapabilitiesofthe
ContivityExtranetswitchcanbefoundintheContivityExtranetSwitchAdministrator’s
Guideandintheonlinehelpfortheswitch.
2.4.2 UserServices
Anadministrator(whohasmanageusersrights)assignseachUseranameandaUser
Group.TheUserGroupdefinesaccesslimitationsandservicesthattheUsermay
exercise,includingaccesshours,calladmissionpriority,forwardingpriority,numberof
simultaneouslogins,maximumpasswordage,minimumpasswordlength,whether
passwordsmaycontainonlyalphabeticcharacters,whetherstaticInternetProtocol(IP)
addressesareassigned,idletimeout,forcedlogofffortimeout,filters,whether
InternetworkPacketExchange(IPX)isallowed.
TheadministratoralsoassignseachUserseparateUserIDsandpasswordsforthe
followingservices:IPSec,PPTP,L2TP,andL2Ftunnels.(AfifthIDandpasswordmay
beassignedforAdministrationoftheswitchasdescribedin2.4.1.)TheUsermaythen
authenticateasnecessarytoinitiatesecuretunnelsusinganyoftheseservices.
• IPSec:RequiresauthenticationthroughUserNameandPassword
(checkedagainstaLightweightDirectoryAccessProtocol(LDAP)
directoryorusingAXENToraSecureIDtoken).Thisauthenticates
theUsertotheswitchandisprotectedusingInternetSecurity
AssociationandKeyManagementProtocol(ISAKMP).TheSwitch
maybeconfiguredtoadditionallyrequireauthenticationthrough
RADIUSwithaGroupNameandPassword.Securityoptionsfor
IPSecincludeusinganEncapsulatedSecurityPayload(ESP)with
Triple-DES,DataEncryptionStandard(DES),or“40-bitDES”,andan
AuthenticationHeader(AH)withMessageAuthenticationCode
SecureHashAlgorithm(HMAC-SHA)orHMAC-MD5.When
operatingthedeviceinaFIPS140-1compliantmanner,onlythe
TripleDESESP,DESESP,andHMAC-SHAAHmaybeenabled.
• PPTP:RequiresauthenticationusingtheMicrosoftChallenge
HandshakeAuthenticationProtocol(MS-CHAP),Challenge
HandshakeAuthenticationProtocol(CHAP),orPassword