Manuals / Nortel Networks / Computer Equipment / Network Router

Nortel Networks NN46120-104 manual Troubleshooting the NVG

Models: NN46120-104

1 300

Download 300 pages 2.66 Kb

Page 145

.

145

Troubleshooting the NVG

This chapter provides troubleshooting tips for the following problems:

•Cannot connect to the Nortel VPN Gateway (NVG) through Telnet or SSH, on “Cannot Connect to VPN Gateway through Telnet or SSH” (page 146).

•Cannot add the VPN Gateway to an existing cluster, on “Cannot Add an NVG to a Cluster” (page 148).

•Cannot contact the Management IP Address (MIP) on “Cannot Contact the MIP” (page 149).

•The VPN Gateway stops responding, on “The NVG Stops Responding” (page 151).

•A user password is lost, on .

•An ASA 310-FIPS does not process any SSL traffic, on “A User Password is Lost” (page 152).

•Resetting the HSM cards on the ASA 310-FIPS, on “An ASA 310-FIPS Stops Processing Traffic” (page 153).

•An NVG cluster configuration needs to be reconstructed onto new devices, on “AnASA 310-FIPS Cluster Must be Reconstructed onto New Devices” (page 158).

•User fails to connect to the VPN, on “A User Fails to Connect to the VPN” (page 163).

•User unable to connect to the VPN Gateway through the Net Direct client, on “User Unable to Connect to the VPN Gateway through the Net Direct Client” (page 168).

•Unable to download NetDirect from VPN server.

•Cannot download the NetDirect Zipped file from client PC.

The chapter also provides a section on performing system diagnostics, on “System Diagnostics” (page 172).

Nortel VPN Gateway

User Guide

NN46120-104 02.01 Standard

14 April 2008

Copyright © 2007-2008 Nortel Networks

Image 145

Nortel Networks NN46120-104 manual Troubleshooting the NVG

Contents

User Guide Licensing ExportContents Upgrading the NVG Software Snmp Agent 183 Copyright 2007-2008 Nortel Networks Preface Who Should Use This Book VPN Gateway 6.0 Application Guide for SSL Acceleration Related documentationProduct Names Users Guide How This Book Is OrganizedAppendices Adding User Preferences Attribute to Active Directory AaBbCc123 Typographic ConventionsHost# telnet IP Address Getting help from the Nortel Web site How to Get HelpVPN Introducing the VPN GatewaySSL Acceleration VPN Hardware Platforms Software Features Feature ListWeb Portal User Authentication Transparent Mode AccessUser Authorization Client Security Secure Service PartitioningAccounting and Auditing NetworkingPortal Guard Branch Office TunnelsSSL Acceleration Certificate and Key Management Scalability and RedundancyPublic Key Infrastructure Supported Handshake Protocols Supported Key and Certificate FormatsHash Algorithms Cipher SuitesSecure Portable Office SPO Client Virtual DesktopIntroducing the VPN Gateway Introducing the ASA 310-FIPS HSM Overview FIPS140-1 Level 3 Security Extended Mode vs. Fips ModeTypes of iKeys Concept of iKey AuthenticationWrap Keys for ASA 310-FIPS Clusters CODE-USER Available Operations and iKeys RequiredHSM-SO HSM-US Additional HSM Information Introducing the ASA 310-FIPS Initial Setup New and Join ClustersConﬁguration is Replicated among Master NVGs Clustering Over Multiple SubnetsIP Address Types Ports One-Armed Conﬁguration InterfacesTwo-Armed Conﬁguration Two-Armed Configuration without Application Switch Setup Menu Conﬁguration at Boot UpSetting Up a One-Armed Conﬁguration Installing an NVG in a New ClusterStep Action Choose new from the Setup menu Specify the port you want to use for network connectivityEnter network mask and Vlan tag ID Enter a default gateway addressEnter a Management IP address MIP Configure the management interface port number Setting Up a Two-Armed ConﬁgurationSpecify the host IP address for the current VPN Gateway Specify a new port number for the traffic interface Enter a default gateway address on the traffic interfaceSpecify a host IP address on the traffic public interface Interface gateway IP addressSelect Complete the New SetupPress Enter if correct Enter if correctWizard To acceptEnter to accept Create the accountEnter Network mask for the pool range Creating IP pool 10.10.20.99Settings Created by the VPN Quick Setup Wizard Default Network Basic VPN SetupDefault Services Joining a VPN Gateway to an Existing Cluster Enter the VPN Gateway ’s host IP address Specify the port to be used for network connectivityEnter the Management IP address MIP of the existing cluster Step Action Choose join from the Setup menuAccepts Enter the default gateway on the traffic interface Complete the Join SetupSpecify the VPN Gateway type Admin user Wait until the Setup utility has finishedAs slave Installing an ASA 310-FIPS in a New Cluster Installing an ASA 310-FIPSUse Fips or Extended Security Mode? fips/extended HSM-SO password HSM-SO password, or use the same HSM-SO password as for Card Press Enter to select new Adding an ASA 310-FIPS to an Existing Cluster Setup Menu Join Join an existing iSD cluster New Adding an ASA 310-FIPS to an Existing Cluster For this HSM card Re-enter to confirm HSM-SO iKey has been updatedCluster Verify that CODE-SO iKey black is inserted in cardThat you used in Step End Log in as user boot, password ForgetMe Reinstalling the SoftwareTag id or Enter Continue y/n? y Press Enter to continueIf correct Restarting system Alteon WebSystems,I nc C Booting Login Upgrading the NVG Software Main# boot/software/download Performing Minor/Major Release UpgradesEnter the host name or IP address of the server Activating the Software Upgrade PackageEnter hostname or IP address of server server host Name or IPSoftware Management# cur At the Software Management# prompt, enterMain# boot/software/cur Activate ok, reloginHere Upgrading the NVG Software Managing Users and Groups User Rights and Group Membership Access the User Menu Step Action Log in to the NVG cluster as the admin userAdding a New User Add the new user and designate a user nameUser# edit certadmin Define a login password for the userAssign the new user to a user group Verify and apply the group assignmentApply the changes Groups# /cfg/sys/user User# edit certadminUser# edit admin Remove the admin user from the certadmin groupVerify and apply the changes Adding Users through Radius Changing a Users Group Assignment Login certadminStep Action Log in to the NVG cluster User admin# groups/add Enter group name certadmin Changing Your Own Password Changing a Users PasswordType the passwd command to change your current password Type the password command to initialize the password change Changing Another Users PasswordApply the changes Deleting a User User# del certadminUser# list Oper Root Admin Certadmin User# apply Certiﬁcates and Client Authentication Generating and Submitting a CSR Using the CLI ~ ! @ # $ % * / \ ? Save the CSR to a file Apply your changesSave the private key to a file Open and copy the CSR KEY----- and -----END RSA Private KEYSubmit the CSR to Verisign, Entrust, or any other CA PEM NET DER Adding Certiﬁcates to the NVGCopy-and-Paste Certiﬁcates Copy the contents of your certificate fileCertificate 1# apply Changes applied successfully Paste the contents of the key file at the command prompt Copy the contents of your private key fileCopy-and-Paste Private Key Using TFTP/FTP/SCP/SFTP to add Certiﬁcates and Keys Name or IP address Enter the desired file nameAdd your private key if in a separate file End Create a New Certiﬁcate Update Existing CertiﬁcateStep Action Check the certificate numbers currently in use Add a certificate with a new certificate numberStep Action Conﬁgure a Virtual SSL Server to Require a Client CertiﬁcateMain# cfg/cur ssl Apply your settingsSSL# server RequireEnter for client certificate Generating client certiﬁcatesSpecify the validity period, key size, and serial number Key size 512/1024 Serial number of client certificate Main# cfg/ssl/server Com Export Client CertiﬁcateCert.pfx Transmit Private Key and Certiﬁcate to User Managing Revocation of Client Certiﬁcates Revoking Client Certiﬁcates Issued by an External CADownload and add a CRL from a TFTP/FTP/SCP/SFTP server Crl.der Crl.ascii Creating Your Own Certiﬁcate Revocation List Automatic CRL Retrieval Main /cfg/cert 1/revoke/automatic Http//10.42.128.30/server.crlInfo/certs command Client certiﬁcate support Enter the password in the Ndic login screen Click ConnectClick Connect Paste the CSR Signing CSRsMain# cfg/ssl/server #/adv/sslconnect/verify/cacer Step Action Specify an unused certificate number Generate Test CertiﬁcateProvide the requested information Automatic CRL Retrieval Show Certiﬁcate Information General CommandsShow Subject Information Check if Key and Certiﬁcate MatchShow Key Information Show Key SizeCertificates and Client Authentication Virtual Desktop Licensing vdesktop Running the Virtual Desktop on Client ComputersClick Save Launch Vdesktop from PortalVirtual Desktop Operations Command Line Interface Procedure Connecting to the VPN GatewayEstablishing a Console Connection RequirementsEstablishing a Telnet Connection Enabling and Restricting Telnet AccessRunning Telnet Enabling and Restricting SSH Access Establishing a Connection Using SSH Secure ShellRunning an SSH Client Telnet IP addressEstablishing a Connection Using SSH Secure Shell Accessing the NVG Cluster ForgetM User Access Level Description Default Account Group PasswoCLI vs. Setup Command Line History and Editing Idle Timeout Troubleshooting the NVG Check the Access List Enable Telnet or SSH AccessCannot Connect to VPN Gateway through Telnet or Verify the Current ConﬁgurationCheck the IP Address Conﬁguration Cannot Add an NVG to a Cluster # /cfg/sys/accesslist/add Add Interface 1 IP Addresses and MIP to Access ListCannot Contact the MIP Troubleshooting the NVG Telnet or SSH Connection to the Management IP Address NVG Stops RespondingConsole Connection Administrator User Password User Password is LostOperator User Password Root User PasswordAn ASA 310-FIPS Stops Processing Trafﬁc Password enter the admin user passwordPassword associated with the HSM-USER iKey for card Main# maint/hsm/login# /info/events/alarms Resetting HSM Cards on the ASA 310-FIPS Main# /boot/delete End Step Action Existing Enter the same secret passphrase as was used Former cluster Transfer the cluster wrap key to cardSame secret passphrase as was used in the former Cluster Wait for the setup of the added ASA 310-FIPS to finishMain# cfg/gtcfg Aaa User Fails to Connect to the VPNMain# maint/starttrace Ike DnsIppool IpsecSsl Smb UprefFtp Netdirectpacket NetdirectIs Net Direct enabled and configured correctly? Netdirectpacket End Cannot download the NetDirect Zipped ﬁle from client PC Installed Certiﬁcates and Virtual SSL Servers System DiagnosticsNetwork Diagnostics # /stats/dump # /cfg/sys/cur# /info/ethernet # ping IP address of virtual serverError Log Files Active Alarms and the Events Log File# /cfg/ssl/server #/trace/ssldump # /info/events/downloadUnable to download NetDirect from VPN server Troubleshooting the NVG Supported Ciphers Appendix Supported CiphersSupported Ciphers cont’d Cipher List Formats Modifying a Cipher List Cipher Strings and Meanings Supported Cipher Strings and MeaningsCipher Strings and Meanings cont’d Appendix Snmp Agent SNMPv2-MIB Supported MIBsSNMP-TARGET MIB SNMP-FRAMEWORK-MIBLimitations SNMP-USER-BASED-SM-MIBIP-MIB IANAifType-MIB ALTEON-ISD-PLATFORM-MIBFollowing Snmp traps are supported by the VPN Gateway Supported TrapsSnmp Agent Appendix Syslog Messages List of Syslog Messages Config filesystem corrupt beyond repairOperating System OS Messages Root filesystem corruptMissing files in config filesystem Config filesystem corruptSystem Control Process Messages System started isdssl-versionName singlemaster Name isddownName logopenfailed Name makesoftwarereleasepermanentfailedName license Name copysoftwarereleasefailed Sender IPName sslhwfail Name hsmnotloggedinName partitionednetwork Name softwareconfigurationchangedName ssimipishere Name licenseexpiresoonTrafﬁc Processing Messages Vbscript error reason for hostpath Javascript error reason for hostpathJscript.encode error reason Css error reasonSocks error reason Html error reasonBad Ipport data line in hc script Bad regexp expr in health checkProxy connect host name too long host Certificate CRL handling errorsTPS license limit limit exceeded Gzip error reasonLicense expired Certificate CRL handling warningsStartup Messages AAA Subsystem Messages Conﬁguration Reload MessagesLdap backends unreachable Vpn=\id\ AuthId=\authid\ Log functionalityHost host ip is up accounted for in the license pool IPsec Subsystem Messages Ignoring request to roam from %s to %s All credits are exhausted for IPSec SAPFS is required but not provided by %s Error while decoding certificate DER Id Bad clicert, Can’t find issuer in clicertFailed to allocate IP addr from empty pool Failed to decode client certRevocation byte length %d Deleting the QM replaced by new rekeyed QMLoaded ca certificate %s Loaded server cert %sSyslog Messages in Alphabetical Order Syslog Messages in Alphabetical OrderSyslog Messages in Alphabetical Order cont’d Config filesystem re-initialized Down AAA Html IPsec Isakmp SA Established Isddown Cfg/sys/cur command Gateway but /cfg/vpn # /ser Loaded server id *will not Processing Received Delete Isakmp SA Socks error reason System started isdssl-version VPN LoginFailed Vpn=id Appendix License Information OpenSSL License IssuesOriginal SSLeay License GNU General Public License GNU General Public LicenseTerms and Conditions for COPYING, Distribution Modification 227 License Information No Warranty Apache Software License, Version 231 License Information Scope Appendix HSM Security PolicyOverview Applicable DocumentsAlgorithm How it is used by the HSM module Used Fips Mode? CapabilitiesSHA-1 Module Interfaces Physical SecurityComponents Deﬁnition of Security Relevant Data Items HSM Security Policy Roles and Services User Creation ServicesYES Service FIPS140-1 Level 3 Mode EPK, DPK EPK MK, Sopin Key Generation Key ManagementKey Entry and Output Key StorageKey Distribution Modes Fips 140-1 ModeKey Destruction Key ArchivingSelf-Tests Non-FIPS 140-1 ModeRC4 KAT ConclusionAppendix Deﬁnition of Key Codes Allowed Special Characters Syntax DescriptionAllowed Special Characters Explanation Redeﬁnable KeysExample of a Key Code Deﬁnition File Appendix SSH host keys Methods for Protection VPN Gateway SSH host keys 261 Register the Schema Management dll Windows Server Install All Administrative Tools Windows 2000 ServerStep Action Click Start and select Run Add Standalone Snap-in window is displayed Create a Shortcut to the Console Window Under Snap-in, select Active Directory Schema and click AddRight-click Attributes, point to New and select Attribute Permit Write Operations to the Schema Windows 2000 ServerClick Continue Create the isdUserPrefs attribute as shown Click OK Create New ClassCreate the nortelSSLOffload class as shown Click Next Click Finish Add isdUserPrefs Attribute to nortelSSLOffload ClassAdd the nortelSSLOffload Class to the User Class Click OK Adding User Preferences Attribute to Active Directory Appendix Using the Port Forwarder API General =1&c=1 Creating a Port ForwarderDemo Application Content.zip file Example Creating a Port Forwarder AuthenticatorExample Using the Port Forwarder API Adding a Port Forwarder Logger Using the Port Forwarder API Example Connecting Through a Proxy Status Monitoring the Port ForwarderStatistics Using the Port Forwarder API CLI Command Line Interface Access RulesGlossary Base ProfileConsole Connection Cluster of VPN GatewaysCRL Certificate Revocation List CSR Certificate Signing RequestDPort Destination Port DIP Destination IP AddressDTE Data Terminal Equipment Extended ProfileIP Interface Http ProxyMaster MIB Management Information BaseNTP Network Time Protocol NslookupPassphrase PEM Privacy Enhanced MailPortal Setup UtilityPort Forwarder Real Server GroupSlave SIP Source IP AddressSnmp Simple Network Management Protocol SPort Source PortSSL VPN client SSL Secure Sockets Layer ProtocolSTP Spanning Tree Protocol TLS Transport Layer SecurityVirtual Router VIP Virtual Server IP AddressVirtual SSL Server Vlan Virtual Local Area Network509 Index HSM SSL 298 Page User Guide