Manuals / Nortel Networks / Computer Equipment / Network Router

Nortel Networks NN46120-104 Failed to allocate IP addr from empty pool, Client cert %d revoked

Models: NN46120-104

1 300

Download 300 pages 2.66 Kb

Page 207

INFO 207

This indicates possible badly configured default gateways on some

Secure Service Partitioning interface.

•Failed to allocate IP addr from empty pool

The IP address pool is empty and a login attempt was rejected due to not being able to allocate an IP address from the pool. Note that Net Direct clients also use IPs from the IP pool.

NOTICE

•Failed to decode client cert

A client sent a bad client certificate which could not decoded/parsed.

•Bad clicert, Can’t find issuer in clicert

A client sent a bad client certificate which did not contain an issuer.

•Error while decoding certificate DER Id

A client sent a certificate where the X509 Name portion could not be extracted from the certificate.

•Client cert %d revoked

The client certificate with serial number %d was revoked and thus login failed.

•Ike not started due: No license

If no licence can be found (such as on old ASA 310), IKE is not started.

INFO

•Using new IKE. IKE Profile %s received in Auth Reply. Received new IKE profile from AAA (received from RADIUS).

•ISAKMP SA Established with %s ISAKMP SA Established.

•IPSec SA Established with %s, IPComp %s, inbound CPI 0x%x IPsec SA Established.

•Closing earlier opened UDP Encap Socket for port : %d UDP Encap port number changed.

•Creating UDP Encap Socket for %d.%d.%d.%d/%d UDP Encap port number changed.

•Received Delete ISAKMP SA message from %s Received Delete ISAKMP SA message.

•Received Delete IPSEC SA message from %s Received Delete IPsec SA message.

•Client %s rejected IPSec SA Proposal, so deleting ISAKMP SA Client rejected the IPSec SA proposal.

Nortel VPN Gateway

User Guide

NN46120-104 02.01 Standard

14 April 2008

Copyright © 2007-2008 Nortel Networks

Image 207

Nortel Networks NN46120-104 manual Failed to allocate IP addr from empty pool, Failed to decode client cert

Contents

User Guide Licensing ExportContents Upgrading the NVG Software Snmp Agent 183 Copyright 2007-2008 Nortel Networks Preface Who Should Use This Book VPN Gateway 6.0 Application Guide for SSL Acceleration Related documentationProduct Names How This Book Is Organized Users GuideAppendices Adding User Preferences Attribute to Active Directory Typographic Conventions AaBbCc123Host# telnet IP Address Getting help from the Nortel Web site How to Get HelpVPN Introducing the VPN GatewaySSL Acceleration VPN Hardware Platforms Feature List Software FeaturesWeb Portal Transparent Mode Access User AuthenticationUser Authorization Networking Secure Service PartitioningClient Security Accounting and AuditingBranch Office Tunnels Portal GuardSSL Acceleration Scalability and Redundancy Certificate and Key ManagementPublic Key Infrastructure Cipher Suites Supported Key and Certificate FormatsSupported Handshake Protocols Hash AlgorithmsSecure Portable Office SPO Client Virtual DesktopIntroducing the VPN Gateway Introducing the ASA 310-FIPS HSM Overview FIPS140-1 Level 3 Security Extended Mode vs. Fips ModeConcept of iKey Authentication Types of iKeysWrap Keys for ASA 310-FIPS Clusters CODE-USER Available Operations and iKeys RequiredHSM-SO HSM-US Additional HSM Information Introducing the ASA 310-FIPS Initial Setup Clustering Over Multiple Subnets ClustersNew and Join Conﬁguration is Replicated among Master NVGsIP Address Types Ports Interfaces One-Armed ConﬁgurationTwo-Armed Conﬁguration Two-Armed Configuration without Application Switch Setup Menu Conﬁguration at Boot UpSpecify the port you want to use for network connectivity Installing an NVG in a New ClusterSetting Up a One-Armed Conﬁguration Step Action Choose new from the Setup menuEnter a default gateway address Enter network mask and Vlan tag IDEnter a Management IP address MIP Setting Up a Two-Armed Conﬁguration Configure the management interface port numberSpecify the host IP address for the current VPN Gateway Interface gateway IP address Enter a default gateway address on the traffic interfaceSpecify a new port number for the traffic interface Specify a host IP address on the traffic public interfaceEnter if correct Complete the New SetupSelect Press Enter if correctCreate the account To acceptWizard Enter to acceptEnter Network mask for the pool range Creating IP pool 10.10.20.99Settings Created by the VPN Quick Setup Wizard Default Network Basic VPN SetupDefault Services Joining a VPN Gateway to an Existing Cluster Enter the VPN Gateway ’s host IP address Specify the port to be used for network connectivityEnter the Management IP address MIP of the existing cluster Step Action Choose join from the Setup menuAccepts Complete the Join Setup Enter the default gateway on the traffic interfaceSpecify the VPN Gateway type Wait until the Setup utility has finished Admin userAs slave Installing an ASA 310-FIPS in a New Cluster Installing an ASA 310-FIPSUse Fips or Extended Security Mode? fips/extended HSM-SO password HSM-SO password, or use the same HSM-SO password as for Card Press Enter to select new Adding an ASA 310-FIPS to an Existing Cluster Setup Menu Join Join an existing iSD cluster New Adding an ASA 310-FIPS to an Existing Cluster For this HSM card Re-enter to confirm HSM-SO iKey has been updatedCluster Verify that CODE-SO iKey black is inserted in cardThat you used in Step End Log in as user boot, password ForgetMe Reinstalling the SoftwareContinue y/n? y Press Enter to continue Tag id or EnterIf correct Restarting system Alteon WebSystems,I nc C Booting Login Upgrading the NVG Software Main# boot/software/download Performing Minor/Major Release UpgradesName or IP Activating the Software Upgrade PackageEnter the host name or IP address of the server Enter hostname or IP address of server server hostSoftware Management# cur At the Software Management# prompt, enterActivate ok, relogin Main# boot/software/curHere Upgrading the NVG Software Managing Users and Groups User Rights and Group Membership Add the new user and designate a user name Step Action Log in to the NVG cluster as the admin userAccess the User Menu Adding a New UserVerify and apply the group assignment Define a login password for the userUser# edit certadmin Assign the new user to a user groupApply the changes Groups# /cfg/sys/user User# edit certadminRemove the admin user from the certadmin group User# edit adminVerify and apply the changes Adding Users through Radius Login certadmin Changing a Users Group AssignmentStep Action Log in to the NVG cluster User admin# groups/add Enter group name certadmin Changing a Users Password Changing Your Own PasswordType the passwd command to change your current password Type the password command to initialize the password change Changing Another Users PasswordApply the changes Deleting a User User# del certadminUser# list Oper Root Admin Certadmin User# apply Certiﬁcates and Client Authentication Generating and Submitting a CSR Using the CLI ~ ! @ # $ % * / \ ? Apply your changes Save the CSR to a fileSave the private key to a file Open and copy the CSR KEY----- and -----END RSA Private KEYSubmit the CSR to Verisign, Entrust, or any other CA PEM NET DER Adding Certiﬁcates to the NVGCopy-and-Paste Certiﬁcates Copy the contents of your certificate fileCertificate 1# apply Changes applied successfully Copy the contents of your private key file Paste the contents of the key file at the command promptCopy-and-Paste Private Key Using TFTP/FTP/SCP/SFTP to add Certiﬁcates and Keys Name or IP address Enter the desired file nameAdd your private key if in a separate file End Add a certificate with a new certificate number Update Existing CertiﬁcateCreate a New Certiﬁcate Step Action Check the certificate numbers currently in useStep Action Conﬁgure a Virtual SSL Server to Require a Client CertiﬁcateRequire Apply your settingsMain# cfg/cur ssl SSL# serverEnter for client certificate Generating client certiﬁcatesSpecify the validity period, key size, and serial number Key size 512/1024 Serial number of client certificate Main# cfg/ssl/server Export Client Certiﬁcate ComCert.pfx Transmit Private Key and Certiﬁcate to User Revoking Client Certiﬁcates Issued by an External CA Managing Revocation of Client CertiﬁcatesDownload and add a CRL from a TFTP/FTP/SCP/SFTP server Crl.der Crl.ascii Creating Your Own Certiﬁcate Revocation List Automatic CRL Retrieval Main /cfg/cert 1/revoke/automatic Http//10.42.128.30/server.crlInfo/certs command Enter the password in the Ndic login screen Click Connect Client certiﬁcate supportClick Connect Paste the CSR Signing CSRsMain# cfg/ssl/server #/adv/sslconnect/verify/cacer Generate Test Certiﬁcate Step Action Specify an unused certificate numberProvide the requested information Automatic CRL Retrieval Check if Key and Certiﬁcate Match General CommandsShow Certiﬁcate Information Show Subject InformationShow Key Information Show Key SizeCertificates and Client Authentication Virtual Desktop Licensing vdesktop Running the Virtual Desktop on Client ComputersClick Save Launch Vdesktop from PortalVirtual Desktop Operations Command Line Interface Requirements Connecting to the VPN GatewayProcedure Establishing a Console ConnectionEnabling and Restricting Telnet Access Establishing a Telnet ConnectionRunning Telnet Telnet IP address Establishing a Connection Using SSH Secure ShellEnabling and Restricting SSH Access Running an SSH ClientEstablishing a Connection Using SSH Secure Shell Accessing the NVG Cluster ForgetM User Access Level Description Default Account Group PasswoCLI vs. Setup Command Line History and Editing Idle Timeout Troubleshooting the NVG Verify the Current Conﬁguration Enable Telnet or SSH AccessCheck the Access List Cannot Connect to VPN Gateway through Telnet orCheck the IP Address Conﬁguration Cannot Add an NVG to a Cluster Add Interface 1 IP Addresses and MIP to Access List # /cfg/sys/accesslist/addCannot Contact the MIP Troubleshooting the NVG NVG Stops Responding Telnet or SSH Connection to the Management IP AddressConsole Connection Root User Password User Password is LostAdministrator User Password Operator User PasswordAn ASA 310-FIPS Stops Processing Trafﬁc Password enter the admin user passwordMain# maint/hsm/login Password associated with the HSM-USER iKey for card# /info/events/alarms Resetting HSM Cards on the ASA 310-FIPS Main# /boot/delete End Step Action Existing Enter the same secret passphrase as was used Former cluster Transfer the cluster wrap key to cardSame secret passphrase as was used in the former Cluster Wait for the setup of the added ASA 310-FIPS to finishMain# cfg/gtcfg User Fails to Connect to the VPN AaaMain# maint/starttrace Ike DnsIpsec IppoolSsl Upref SmbFtp Netdirectpacket NetdirectIs Net Direct enabled and configured correctly? Netdirectpacket End Cannot download the NetDirect Zipped ﬁle from client PC System Diagnostics Installed Certiﬁcates and Virtual SSL ServersNetwork Diagnostics # ping IP address of virtual server # /cfg/sys/cur# /stats/dump # /info/ethernet# /info/events/download Active Alarms and the Events Log FileError Log Files # /cfg/ssl/server #/trace/ssldumpUnable to download NetDirect from VPN server Troubleshooting the NVG Supported Ciphers Appendix Supported CiphersSupported Ciphers cont’d Cipher List Formats Modifying a Cipher List Cipher Strings and Meanings Supported Cipher Strings and MeaningsCipher Strings and Meanings cont’d Appendix Snmp Agent SNMPv2-MIB Supported MIBsSNMP-TARGET MIB SNMP-FRAMEWORK-MIBLimitations SNMP-USER-BASED-SM-MIBIP-MIB IANAifType-MIB ALTEON-ISD-PLATFORM-MIBFollowing Snmp traps are supported by the VPN Gateway Supported TrapsSnmp Agent Appendix Syslog Messages Root filesystem corrupt Config filesystem corrupt beyond repairList of Syslog Messages Operating System OS MessagesSystem started isdssl-version Config filesystem corruptMissing files in config filesystem System Control Process MessagesName makesoftwarereleasepermanentfailed Name isddownName singlemaster Name logopenfailedName hsmnotloggedin Name copysoftwarereleasefailed Sender IPName license Name sslhwfailName licenseexpiresoon Name softwareconfigurationchangedName partitionednetwork Name ssimipishereTrafﬁc Processing Messages Css error reason Javascript error reason for hostpathVbscript error reason for hostpath Jscript.encode error reasonBad regexp expr in health check Html error reasonSocks error reason Bad Ipport data line in hc scriptProxy connect host name too long host Certificate CRL handling errorsCertificate CRL handling warnings Gzip error reasonTPS license limit limit exceeded License expiredStartup Messages AAA Subsystem Messages Conﬁguration Reload MessagesLog functionality Ldap backends unreachable Vpn=\id\ AuthId=\authid\Host host ip is up accounted for in the license pool IPsec Subsystem Messages All credits are exhausted for IPSec SA Ignoring request to roam from %s to %sPFS is required but not provided by %s Failed to decode client cert Bad clicert, Can’t find issuer in clicertError while decoding certificate DER Id Failed to allocate IP addr from empty poolLoaded server cert %s Deleting the QM replaced by new rekeyed QMRevocation byte length %d Loaded ca certificate %sSyslog Messages in Alphabetical Order Syslog Messages in Alphabetical OrderSyslog Messages in Alphabetical Order cont’d Config filesystem re-initialized Down AAA Html IPsec Isakmp SA Established Isddown Cfg/sys/cur command Gateway but /cfg/vpn # /ser Loaded server id *will not Processing Received Delete Isakmp SA Socks error reason System started isdssl-version VPN LoginFailed Vpn=id Appendix License Information OpenSSL License IssuesOriginal SSLeay License GNU General Public License GNU General Public LicenseTerms and Conditions for COPYING, Distribution Modification 227 License Information No Warranty Apache Software License, Version 231 License Information Scope Appendix HSM Security PolicyOverview Applicable DocumentsAlgorithm How it is used by the HSM module Used Fips Mode? CapabilitiesSHA-1 Module Interfaces Physical SecurityComponents Deﬁnition of Security Relevant Data Items HSM Security Policy Roles and Services User Creation ServicesYES Service FIPS140-1 Level 3 Mode EPK, DPK EPK MK, Sopin Key Generation Key ManagementKey Storage Key Entry and OutputKey Distribution Key Archiving Fips 140-1 ModeModes Key DestructionSelf-Tests Non-FIPS 140-1 ModeRC4 KAT ConclusionAppendix Deﬁnition of Key Codes Allowed Special Characters Syntax DescriptionAllowed Special Characters Explanation Redeﬁnable KeysExample of a Key Code Deﬁnition File Appendix SSH host keys Methods for Protection VPN Gateway SSH host keys 261 Install All Administrative Tools Windows 2000 Server Register the Schema Management dll Windows ServerStep Action Click Start and select Run Add Standalone Snap-in window is displayed Create a Shortcut to the Console Window Under Snap-in, select Active Directory Schema and click AddPermit Write Operations to the Schema Windows 2000 Server Right-click Attributes, point to New and select AttributeClick Continue Create New Class Create the isdUserPrefs attribute as shown Click OKCreate the nortelSSLOffload class as shown Click Next Click Finish Add isdUserPrefs Attribute to nortelSSLOffload ClassAdd the nortelSSLOffload Class to the User Class Click OK Adding User Preferences Attribute to Active Directory Appendix Using the Port Forwarder API General =1&c=1 Creating a Port ForwarderDemo Application Content.zip file Example Creating a Port Forwarder AuthenticatorExample Using the Port Forwarder API Adding a Port Forwarder Logger Using the Port Forwarder API Example Connecting Through a Proxy Monitoring the Port Forwarder StatusStatistics Using the Port Forwarder API Base Profile Access RulesCLI Command Line Interface GlossaryCSR Certificate Signing Request Cluster of VPN GatewaysConsole Connection CRL Certificate Revocation ListExtended Profile DIP Destination IP AddressDPort Destination Port DTE Data Terminal EquipmentMIB Management Information Base Http ProxyIP Interface MasterPEM Privacy Enhanced Mail NslookupNTP Network Time Protocol PassphraseReal Server Group Setup UtilityPortal Port ForwarderSPort Source Port SIP Source IP AddressSlave Snmp Simple Network Management ProtocolTLS Transport Layer Security SSL Secure Sockets Layer ProtocolSSL VPN client STP Spanning Tree ProtocolVlan Virtual Local Area Network VIP Virtual Server IP AddressVirtual Router Virtual SSL Server509 Index HSM SSL 298 Page User Guide