Manuals / Nortel Networks / Computer Equipment / Network Router

Nortel Networks NN46120-104 manual Main# cfg/gtcfg, Address

Models: NN46120-104

1 300

Download 300 pages 2.66 Kb

Page 162

162Troubleshooting the NVG

login: admin Password: Alteon iSD SSL Software version 7.1

>>Main# cfg/gtcfg

Select protocol (tftp/ftp/scp/sftp) [tftp]: ftp

Enter hostname or IP address of server: <server IP

address>

Enter name of file on server: <name of saved

configuration file>

FTP User (anonymous): <press ENTER if anonymous mode is

supported>

Password:

Received 4960 bytes in 0.1 seconds

Password for importing private keys in cfg: <password as defined when saving the configuration file to an FTP/TFTP/SCP/SFTP server>

Configuration loaded.

>> Configuration#

The configuration information is now automatically propagated and applied to all ASA 310-FIPS devices in the cluster. The information includes certificates and encrypted private keys.

--End--

Nortel VPN Gateway

User Guide

NN46120-104 02.01 Standard

14 April 2008

Copyright © 2007-2008 Nortel Networks

Image 162

Nortel Networks NN46120-104 manual Main# cfg/gtcfg, Address

Contents

User Guide Export LicensingContents Upgrading the NVG Software Snmp Agent 183 Copyright 2007-2008 Nortel Networks Preface Who Should Use This Book Related documentation VPN Gateway 6.0 Application Guide for SSL AccelerationProduct Names How This Book Is Organized Users GuideAppendices Adding User Preferences Attribute to Active Directory Typographic Conventions AaBbCc123Host# telnet IP Address How to Get Help Getting help from the Nortel Web siteIntroducing the VPN Gateway VPNSSL Acceleration VPN Hardware Platforms Feature List Software FeaturesWeb Portal Transparent Mode Access User AuthenticationUser Authorization Accounting and Auditing Secure Service PartitioningClient Security NetworkingBranch Office Tunnels Portal GuardSSL Acceleration Scalability and Redundancy Certificate and Key ManagementPublic Key Infrastructure Hash Algorithms Supported Key and Certificate FormatsSupported Handshake Protocols Cipher SuitesVirtual Desktop Secure Portable Office SPO ClientIntroducing the VPN Gateway Introducing the ASA 310-FIPS HSM Overview Extended Mode vs. Fips Mode FIPS140-1 Level 3 SecurityConcept of iKey Authentication Types of iKeysWrap Keys for ASA 310-FIPS Clusters Available Operations and iKeys Required CODE-USERHSM-SO HSM-US Additional HSM Information Introducing the ASA 310-FIPS Initial Setup Conﬁguration is Replicated among Master NVGs ClustersNew and Join Clustering Over Multiple SubnetsIP Address Types Ports Interfaces One-Armed ConﬁgurationTwo-Armed Conﬁguration Two-Armed Configuration without Application Switch Conﬁguration at Boot Up Setup MenuStep Action Choose new from the Setup menu Installing an NVG in a New ClusterSetting Up a One-Armed Conﬁguration Specify the port you want to use for network connectivityEnter a default gateway address Enter network mask and Vlan tag IDEnter a Management IP address MIP Setting Up a Two-Armed Conﬁguration Configure the management interface port numberSpecify the host IP address for the current VPN Gateway Specify a host IP address on the traffic public interface Enter a default gateway address on the traffic interfaceSpecify a new port number for the traffic interface Interface gateway IP addressPress Enter if correct Complete the New SetupSelect Enter if correctEnter to accept To acceptWizard Create the account10.10.20.99 Enter Network mask for the pool range Creating IP poolSettings Created by the VPN Quick Setup Wizard Basic VPN Setup Default NetworkDefault Services Joining a VPN Gateway to an Existing Cluster Specify the port to be used for network connectivity Enter the VPN Gateway ’s host IP addressStep Action Choose join from the Setup menu Enter the Management IP address MIP of the existing clusterAccepts Complete the Join Setup Enter the default gateway on the traffic interfaceSpecify the VPN Gateway type Wait until the Setup utility has finished Admin userAs slave Installing an ASA 310-FIPS Installing an ASA 310-FIPS in a New ClusterUse Fips or Extended Security Mode? fips/extended HSM-SO password HSM-SO password, or use the same HSM-SO password as for Card Press Enter to select new Adding an ASA 310-FIPS to an Existing Cluster Setup Menu Join Join an existing iSD cluster New Adding an ASA 310-FIPS to an Existing Cluster Re-enter to confirm HSM-SO iKey has been updated For this HSM cardVerify that CODE-SO iKey black is inserted in card ClusterThat you used in Step End Reinstalling the Software Log in as user boot, password ForgetMeContinue y/n? y Press Enter to continue Tag id or EnterIf correct Restarting system Alteon WebSystems,I nc C Booting Login Upgrading the NVG Software Performing Minor/Major Release Upgrades Main# boot/software/downloadEnter hostname or IP address of server server host Activating the Software Upgrade PackageEnter the host name or IP address of the server Name or IPAt the Software Management# prompt, enter Software Management# curActivate ok, relogin Main# boot/software/curHere Upgrading the NVG Software Managing Users and Groups User Rights and Group Membership Adding a New User Step Action Log in to the NVG cluster as the admin userAccess the User Menu Add the new user and designate a user nameAssign the new user to a user group Define a login password for the userUser# edit certadmin Verify and apply the group assignmentGroups# /cfg/sys/user User# edit certadmin Apply the changesRemove the admin user from the certadmin group User# edit adminVerify and apply the changes Adding Users through Radius Login certadmin Changing a Users Group AssignmentStep Action Log in to the NVG cluster User admin# groups/add Enter group name certadmin Changing a Users Password Changing Your Own PasswordType the passwd command to change your current password Changing Another Users Password Type the password command to initialize the password changeApply the changes User# del certadmin Deleting a UserUser# list Oper Root Admin Certadmin User# apply Certiﬁcates and Client Authentication Generating and Submitting a CSR Using the CLI ~ ! @ # $ % * / \ ? Apply your changes Save the CSR to a fileSave the private key to a file KEY----- and -----END RSA Private KEY Open and copy the CSRSubmit the CSR to Verisign, Entrust, or any other CA Adding Certiﬁcates to the NVG PEM NET DERCopy the contents of your certificate file Copy-and-Paste CertiﬁcatesCertificate 1# apply Changes applied successfully Copy the contents of your private key file Paste the contents of the key file at the command promptCopy-and-Paste Private Key Using TFTP/FTP/SCP/SFTP to add Certiﬁcates and Keys Enter the desired file name Name or IP addressAdd your private key if in a separate file End Step Action Check the certificate numbers currently in use Update Existing CertiﬁcateCreate a New Certiﬁcate Add a certificate with a new certificate numberConﬁgure a Virtual SSL Server to Require a Client Certiﬁcate Step ActionSSL# server Apply your settingsMain# cfg/cur ssl RequireGenerating client certiﬁcates Enter for client certificateSpecify the validity period, key size, and serial number Key size 512/1024 Serial number of client certificate Main# cfg/ssl/server Export Client Certiﬁcate ComCert.pfx Transmit Private Key and Certiﬁcate to User Revoking Client Certiﬁcates Issued by an External CA Managing Revocation of Client CertiﬁcatesDownload and add a CRL from a TFTP/FTP/SCP/SFTP server Crl.der Crl.ascii Creating Your Own Certiﬁcate Revocation List Automatic CRL Retrieval Http//10.42.128.30/server.crl Main /cfg/cert 1/revoke/automaticInfo/certs command Enter the password in the Ndic login screen Click Connect Client certiﬁcate supportClick Connect Signing CSRs Paste the CSRMain# cfg/ssl/server #/adv/sslconnect/verify/cacer Generate Test Certiﬁcate Step Action Specify an unused certificate numberProvide the requested information Automatic CRL Retrieval Show Subject Information General CommandsShow Certiﬁcate Information Check if Key and Certiﬁcate MatchShow Key Size Show Key InformationCertificates and Client Authentication Virtual Desktop Running the Virtual Desktop on Client Computers Licensing vdesktopLaunch Vdesktop from Portal Click SaveVirtual Desktop Operations Command Line Interface Establishing a Console Connection Connecting to the VPN GatewayProcedure RequirementsEnabling and Restricting Telnet Access Establishing a Telnet ConnectionRunning Telnet Running an SSH Client Establishing a Connection Using SSH Secure ShellEnabling and Restricting SSH Access Telnet IP addressEstablishing a Connection Using SSH Secure Shell Accessing the NVG Cluster User Access Level Description Default Account Group Passwo ForgetMCLI vs. Setup Command Line History and Editing Idle Timeout Troubleshooting the NVG Cannot Connect to VPN Gateway through Telnet or Enable Telnet or SSH AccessCheck the Access List Verify the Current ConﬁgurationCheck the IP Address Conﬁguration Cannot Add an NVG to a Cluster Add Interface 1 IP Addresses and MIP to Access List # /cfg/sys/accesslist/addCannot Contact the MIP Troubleshooting the NVG NVG Stops Responding Telnet or SSH Connection to the Management IP AddressConsole Connection Operator User Password User Password is LostAdministrator User Password Root User PasswordPassword enter the admin user password An ASA 310-FIPS Stops Processing TrafﬁcMain# maint/hsm/login Password associated with the HSM-USER iKey for card# /info/events/alarms Resetting HSM Cards on the ASA 310-FIPS Main# /boot/delete End Step Action Existing Transfer the cluster wrap key to card Enter the same secret passphrase as was used Former clusterWait for the setup of the added ASA 310-FIPS to finish Same secret passphrase as was used in the former ClusterMain# cfg/gtcfg User Fails to Connect to the VPN AaaMain# maint/starttrace Dns IkeIpsec IppoolSsl Upref SmbFtp Netdirect NetdirectpacketIs Net Direct enabled and configured correctly? Netdirectpacket End Cannot download the NetDirect Zipped ﬁle from client PC System Diagnostics Installed Certiﬁcates and Virtual SSL ServersNetwork Diagnostics # /info/ethernet # /cfg/sys/cur# /stats/dump # ping IP address of virtual server# /cfg/ssl/server #/trace/ssldump Active Alarms and the Events Log FileError Log Files # /info/events/downloadUnable to download NetDirect from VPN server Troubleshooting the NVG Appendix Supported Ciphers Supported CiphersSupported Ciphers cont’d Cipher List Formats Modifying a Cipher List Supported Cipher Strings and Meanings Cipher Strings and MeaningsCipher Strings and Meanings cont’d Appendix Snmp Agent Supported MIBs SNMPv2-MIBSNMP-FRAMEWORK-MIB SNMP-TARGET MIBSNMP-USER-BASED-SM-MIB LimitationsIP-MIB ALTEON-ISD-PLATFORM-MIB IANAifType-MIBSupported Traps Following Snmp traps are supported by the VPN GatewaySnmp Agent Appendix Syslog Messages Operating System OS Messages Config filesystem corrupt beyond repairList of Syslog Messages Root filesystem corruptSystem Control Process Messages Config filesystem corruptMissing files in config filesystem System started isdssl-versionName logopenfailed Name isddownName singlemaster Name makesoftwarereleasepermanentfailedName sslhwfail Name copysoftwarereleasefailed Sender IPName license Name hsmnotloggedinName ssimipishere Name softwareconfigurationchangedName partitionednetwork Name licenseexpiresoonTrafﬁc Processing Messages Jscript.encode error reason Javascript error reason for hostpathVbscript error reason for hostpath Css error reasonBad Ipport data line in hc script Html error reasonSocks error reason Bad regexp expr in health checkCertificate CRL handling errors Proxy connect host name too long hostLicense expired Gzip error reasonTPS license limit limit exceeded Certificate CRL handling warningsStartup Messages Conﬁguration Reload Messages AAA Subsystem MessagesLog functionality Ldap backends unreachable Vpn=\id\ AuthId=\authid\Host host ip is up accounted for in the license pool IPsec Subsystem Messages All credits are exhausted for IPSec SA Ignoring request to roam from %s to %sPFS is required but not provided by %s Failed to allocate IP addr from empty pool Bad clicert, Can’t find issuer in clicertError while decoding certificate DER Id Failed to decode client certLoaded ca certificate %s Deleting the QM replaced by new rekeyed QMRevocation byte length %d Loaded server cert %sSyslog Messages in Alphabetical Order Syslog Messages in Alphabetical OrderSyslog Messages in Alphabetical Order cont’d Config filesystem re-initialized Down AAA Html IPsec Isakmp SA Established Isddown Cfg/sys/cur command Gateway but /cfg/vpn # /ser Loaded server id *will not Processing Received Delete Isakmp SA Socks error reason System started isdssl-version VPN LoginFailed Vpn=id OpenSSL License Issues Appendix License InformationOriginal SSLeay License GNU General Public License GNU General Public LicenseTerms and Conditions for COPYING, Distribution Modification 227 License Information No Warranty Apache Software License, Version 231 License Information Appendix HSM Security Policy ScopeApplicable Documents OverviewCapabilities Algorithm How it is used by the HSM module Used Fips Mode?SHA-1 Physical Security Module InterfacesComponents Deﬁnition of Security Relevant Data Items HSM Security Policy Roles and Services Services User CreationYES Service FIPS140-1 Level 3 Mode EPK, DPK EPK MK, Sopin Key Management Key GenerationKey Storage Key Entry and OutputKey Distribution Key Destruction Fips 140-1 ModeModes Key ArchivingNon-FIPS 140-1 Mode Self-TestsConclusion RC4 KATAppendix Deﬁnition of Key Codes Syntax Description Allowed Special CharactersRedeﬁnable Keys Allowed Special Characters ExplanationExample of a Key Code Deﬁnition File Appendix SSH host keys Methods for Protection VPN Gateway SSH host keys 261 Install All Administrative Tools Windows 2000 Server Register the Schema Management dll Windows ServerStep Action Click Start and select Run Add Standalone Snap-in window is displayed Under Snap-in, select Active Directory Schema and click Add Create a Shortcut to the Console WindowPermit Write Operations to the Schema Windows 2000 Server Right-click Attributes, point to New and select AttributeClick Continue Create New Class Create the isdUserPrefs attribute as shown Click OKCreate the nortelSSLOffload class as shown Add isdUserPrefs Attribute to nortelSSLOffload Class Click Next Click FinishAdd the nortelSSLOffload Class to the User Class Click OK Adding User Preferences Attribute to Active Directory Appendix Using the Port Forwarder API General Creating a Port Forwarder =1&c=1Demo Application Content.zip file Creating a Port Forwarder Authenticator ExampleExample Using the Port Forwarder API Adding a Port Forwarder Logger Using the Port Forwarder API Example Connecting Through a Proxy Monitoring the Port Forwarder StatusStatistics Using the Port Forwarder API Glossary Access RulesCLI Command Line Interface Base ProfileCRL Certificate Revocation List Cluster of VPN GatewaysConsole Connection CSR Certificate Signing RequestDTE Data Terminal Equipment DIP Destination IP AddressDPort Destination Port Extended ProfileMaster Http ProxyIP Interface MIB Management Information BasePassphrase NslookupNTP Network Time Protocol PEM Privacy Enhanced MailPort Forwarder Setup UtilityPortal Real Server GroupSnmp Simple Network Management Protocol SIP Source IP AddressSlave SPort Source PortSTP Spanning Tree Protocol SSL Secure Sockets Layer ProtocolSSL VPN client TLS Transport Layer SecurityVirtual SSL Server VIP Virtual Server IP AddressVirtual Router Vlan Virtual Local Area Network509 Index HSM SSL 298 Page User Guide