User Guide
Export
Licensing
Contents
Upgrading the NVG Software
Snmp Agent 183
Copyright 2007-2008 Nortel Networks
Preface
Who Should Use This Book
Related documentation
VPN Gateway 6.0 Application Guide for SSL Acceleration
Product Names
Users Guide
How This Book Is Organized
Appendices
Adding User Preferences Attribute to Active Directory
AaBbCc123
Typographic Conventions
Host# telnet IP Address
How to Get Help
Getting help from the Nortel Web site
Introducing the VPN Gateway
VPN
SSL Acceleration
VPN
Hardware Platforms
Software Features
Feature List
Web Portal
User Authentication
Transparent Mode Access
User Authorization
Secure Service Partitioning
Client Security
Accounting and Auditing
Networking
Portal Guard
Branch Office Tunnels
SSL Acceleration
Certificate and Key Management
Scalability and Redundancy
Public Key Infrastructure
Supported Key and Certificate Formats
Supported Handshake Protocols
Hash Algorithms
Cipher Suites
Virtual Desktop
Secure Portable Office SPO Client
Introducing the VPN Gateway
Introducing the ASA 310-FIPS
HSM Overview
Extended Mode vs. Fips Mode
FIPS140-1 Level 3 Security
Types of iKeys
Concept of iKey Authentication
Wrap Keys for ASA 310-FIPS Clusters
Available Operations and iKeys Required
CODE-USER
HSM-SO HSM-US
Additional HSM Information
Introducing the ASA 310-FIPS
Initial Setup
Clusters
New and Join
Configuration is Replicated among Master NVGs
Clustering Over Multiple Subnets
IP Address Types
Ports
One-Armed Configuration
Interfaces
Two-Armed Configuration
Two-Armed Configuration without Application Switch
Configuration at Boot Up
Setup Menu
Installing an NVG in a New Cluster
Setting Up a One-Armed Configuration
Step Action Choose new from the Setup menu
Specify the port you want to use for network connectivity
Enter network mask and Vlan tag ID
Enter a default gateway address
Enter a Management IP address MIP
Configure the management interface port number
Setting Up a Two-Armed Configuration
Specify the host IP address for the current VPN Gateway
Enter a default gateway address on the traffic interface
Specify a new port number for the traffic interface
Specify a host IP address on the traffic public interface
Interface gateway IP address
Complete the New Setup
Select
Press Enter if correct
Enter if correct
To accept
Wizard
Enter to accept
Create the account
10.10.20.99
Enter Network mask for the pool range Creating IP pool
Settings Created by the VPN Quick Setup Wizard
Basic VPN Setup
Default Network
Default Services
Joining a VPN Gateway to an Existing Cluster
Specify the port to be used for network connectivity
Enter the VPN Gateway ’s host IP address
Step Action Choose join from the Setup menu
Enter the Management IP address MIP of the existing cluster
Accepts
Enter the default gateway on the traffic interface
Complete the Join Setup
Specify the VPN Gateway type
Admin user
Wait until the Setup utility has finished
As slave
Installing an ASA 310-FIPS
Installing an ASA 310-FIPS in a New Cluster
Use Fips or Extended Security Mode? fips/extended
HSM-SO password
HSM-SO password, or use the same HSM-SO password as for Card
Press Enter to select new
Adding an ASA 310-FIPS to an Existing Cluster
Setup Menu Join Join an existing iSD cluster New
Adding an ASA 310-FIPS to an Existing Cluster
Re-enter to confirm HSM-SO iKey has been updated
For this HSM card
Verify that CODE-SO iKey black is inserted in card
Cluster
That you used in Step
End
Reinstalling the Software
Log in as user boot, password ForgetMe
Tag id or Enter
Continue y/n? y Press Enter to continue
If correct
Restarting system Alteon WebSystems,I nc C Booting Login
Upgrading the NVG Software
Performing Minor/Major Release Upgrades
Main# boot/software/download
Activating the Software Upgrade Package
Enter the host name or IP address of the server
Enter hostname or IP address of server server host
Name or IP
At the Software Management# prompt, enter
Software Management# cur
Main# boot/software/cur
Activate ok, relogin
Here
Upgrading the NVG Software
Managing Users and Groups
User Rights and Group Membership
Step Action Log in to the NVG cluster as the admin user
Access the User Menu
Adding a New User
Add the new user and designate a user name
Define a login password for the user
User# edit certadmin
Assign the new user to a user group
Verify and apply the group assignment
Groups# /cfg/sys/user User# edit certadmin
Apply the changes
User# edit admin
Remove the admin user from the certadmin group
Verify and apply the changes
Adding Users through Radius
Changing a Users Group Assignment
Login certadmin
Step Action Log in to the NVG cluster
User admin# groups/add Enter group name certadmin
Changing Your Own Password
Changing a Users Password
Type the passwd command to change your current password
Changing Another Users Password
Type the password command to initialize the password change
Apply the changes
User# del certadmin
Deleting a User
User# list Oper Root Admin Certadmin User# apply
Certificates and Client Authentication
Generating and Submitting a CSR Using the CLI
~ ! @ # $ % * / \ ?
Save the CSR to a file
Apply your changes
Save the private key to a file
KEY----- and -----END RSA Private KEY
Open and copy the CSR
Submit the CSR to Verisign, Entrust, or any other CA
Adding Certificates to the NVG
PEM NET DER
Copy the contents of your certificate file
Copy-and-Paste Certificates
Certificate 1# apply Changes applied successfully
Paste the contents of the key file at the command prompt
Copy the contents of your private key file
Copy-and-Paste Private Key
Using TFTP/FTP/SCP/SFTP to add Certificates and Keys
Enter the desired file name
Name or IP address
Add your private key if in a separate file
End
Update Existing Certificate
Create a New Certificate
Step Action Check the certificate numbers currently in use
Add a certificate with a new certificate number
Configure a Virtual SSL Server to Require a Client Certificate
Step Action
Apply your settings
Main# cfg/cur ssl
SSL# server
Require
Generating client certificates
Enter for client certificate
Specify the validity period, key size, and serial number
Key size 512/1024 Serial number of client certificate
Main# cfg/ssl/server
Com
Export Client Certificate
Cert.pfx
Transmit Private Key and Certificate to User
Managing Revocation of Client Certificates
Revoking Client Certificates Issued by an External CA
Download and add a CRL from a TFTP/FTP/SCP/SFTP server
Crl.der
Crl.ascii
Creating Your Own Certificate Revocation List
Automatic CRL Retrieval
Http//10.42.128.30/server.crl
Main /cfg/cert 1/revoke/automatic
Info/certs command
Client certificate support
Enter the password in the Ndic login screen Click Connect
Click Connect
Signing CSRs
Paste the CSR
Main# cfg/ssl/server #/adv/sslconnect/verify/cacer
Step Action Specify an unused certificate number
Generate Test Certificate
Provide the requested information
Automatic CRL Retrieval
General Commands
Show Certificate Information
Show Subject Information
Check if Key and Certificate Match
Show Key Size
Show Key Information
Certificates and Client Authentication
Virtual Desktop
Running the Virtual Desktop on Client Computers
Licensing vdesktop
Launch Vdesktop from Portal
Click Save
Virtual Desktop Operations
Command Line Interface
Connecting to the VPN Gateway
Procedure
Establishing a Console Connection
Requirements
Establishing a Telnet Connection
Enabling and Restricting Telnet Access
Running Telnet
Establishing a Connection Using SSH Secure Shell
Enabling and Restricting SSH Access
Running an SSH Client
Telnet IP address
Establishing a Connection Using SSH Secure Shell
Accessing the NVG Cluster
User Access Level Description Default Account Group Passwo
ForgetM
CLI vs. Setup
Command Line History and Editing
Idle Timeout
Troubleshooting the NVG
Enable Telnet or SSH Access
Check the Access List
Cannot Connect to VPN Gateway through Telnet or
Verify the Current Configuration
Check the IP Address Configuration
Cannot Add an NVG to a Cluster
# /cfg/sys/accesslist/add
Add Interface 1 IP Addresses and MIP to Access List
Cannot Contact the MIP
Troubleshooting the NVG
Telnet or SSH Connection to the Management IP Address
NVG Stops Responding
Console Connection
User Password is Lost
Administrator User Password
Operator User Password
Root User Password
Password enter the admin user password
An ASA 310-FIPS Stops Processing Traffic
Password associated with the HSM-USER iKey for card
Main# maint/hsm/login
# /info/events/alarms
Resetting HSM Cards on the ASA 310-FIPS
Main# /boot/delete
End
Step Action
Existing
Transfer the cluster wrap key to card
Enter the same secret passphrase as was used Former cluster
Wait for the setup of the added ASA 310-FIPS to finish
Same secret passphrase as was used in the former Cluster
Main# cfg/gtcfg
Aaa
User Fails to Connect to the VPN
Main# maint/starttrace
Dns
Ike
Ippool
Ipsec
Ssl
Smb
Upref
Ftp
Netdirect
Netdirectpacket
Is Net Direct enabled and configured correctly?
Netdirectpacket
End
Cannot download the NetDirect Zipped file from client PC
Installed Certificates and Virtual SSL Servers
System Diagnostics
Network Diagnostics
# /cfg/sys/cur
# /stats/dump
# /info/ethernet
# ping IP address of virtual server
Active Alarms and the Events Log File
Error Log Files
# /cfg/ssl/server #/trace/ssldump
# /info/events/download
Unable to download NetDirect from VPN server
Troubleshooting the NVG
Appendix Supported Ciphers
Supported Ciphers
Supported Ciphers cont’d
Cipher List Formats
Modifying a Cipher List
Supported Cipher Strings and Meanings
Cipher Strings and Meanings
Cipher Strings and Meanings cont’d
Appendix Snmp Agent
Supported MIBs
SNMPv2-MIB
SNMP-FRAMEWORK-MIB
SNMP-TARGET MIB
SNMP-USER-BASED-SM-MIB
Limitations
IP-MIB
ALTEON-ISD-PLATFORM-MIB
IANAifType-MIB
Supported Traps
Following Snmp traps are supported by the VPN Gateway
Snmp Agent
Appendix Syslog Messages
Config filesystem corrupt beyond repair
List of Syslog Messages
Operating System OS Messages
Root filesystem corrupt
Config filesystem corrupt
Missing files in config filesystem
System Control Process Messages
System started isdssl-version
Name isddown
Name singlemaster
Name logopenfailed
Name makesoftwarereleasepermanentfailed
Name copysoftwarereleasefailed Sender IP
Name license
Name sslhwfail
Name hsmnotloggedin
Name softwareconfigurationchanged
Name partitionednetwork
Name ssimipishere
Name licenseexpiresoon
Traffic Processing Messages
Javascript error reason for hostpath
Vbscript error reason for hostpath
Jscript.encode error reason
Css error reason
Html error reason
Socks error reason
Bad Ipport data line in hc script
Bad regexp expr in health check
Certificate CRL handling errors
Proxy connect host name too long host
Gzip error reason
TPS license limit limit exceeded
License expired
Certificate CRL handling warnings
Startup Messages
Configuration Reload Messages
AAA Subsystem Messages
Ldap backends unreachable Vpn=\id\ AuthId=\authid\
Log functionality
Host host ip is up accounted for in the license pool
IPsec Subsystem Messages
Ignoring request to roam from %s to %s
All credits are exhausted for IPSec SA
PFS is required but not provided by %s
Bad clicert, Can’t find issuer in clicert
Error while decoding certificate DER Id
Failed to allocate IP addr from empty pool
Failed to decode client cert
Deleting the QM replaced by new rekeyed QM
Revocation byte length %d
Loaded ca certificate %s
Loaded server cert %s
Syslog Messages in Alphabetical Order
Syslog Messages in Alphabetical Order
Syslog Messages in Alphabetical Order cont’d
Config filesystem re-initialized
Down
AAA
Html
IPsec Isakmp SA Established Isddown
Cfg/sys/cur command
Gateway but /cfg/vpn # /ser
Loaded server id *will not Processing
Received Delete Isakmp SA
Socks error reason
System started isdssl-version
VPN LoginFailed Vpn=id
OpenSSL License Issues
Appendix License Information
Original SSLeay License
GNU General Public License
GNU General Public License
Terms and Conditions for COPYING, Distribution Modification
227
License Information
No Warranty
Apache Software License, Version
231
License Information
Appendix HSM Security Policy
Scope
Applicable Documents
Overview
Capabilities
Algorithm How it is used by the HSM module Used Fips Mode?
SHA-1
Physical Security
Module Interfaces
Components
Definition of Security Relevant Data Items
HSM Security Policy
Roles and Services
Services
User Creation
YES
Service FIPS140-1 Level 3 Mode
EPK, DPK
EPK
MK, Sopin
Key Management
Key Generation
Key Entry and Output
Key Storage
Key Distribution
Fips 140-1 Mode
Modes
Key Destruction
Key Archiving
Non-FIPS 140-1 Mode
Self-Tests
Conclusion
RC4 KAT
Appendix Definition of Key Codes
Syntax Description
Allowed Special Characters
Redefinable Keys
Allowed Special Characters Explanation
Example of a Key Code Definition File
Appendix SSH host keys
Methods for Protection
VPN Gateway
SSH host keys
261
Register the Schema Management dll Windows Server
Install All Administrative Tools Windows 2000 Server
Step Action Click Start and select Run
Add Standalone Snap-in window is displayed
Under Snap-in, select Active Directory Schema and click Add
Create a Shortcut to the Console Window
Right-click Attributes, point to New and select Attribute
Permit Write Operations to the Schema Windows 2000 Server
Click Continue
Create the isdUserPrefs attribute as shown Click OK
Create New Class
Create the nortelSSLOffload class as shown
Add isdUserPrefs Attribute to nortelSSLOffload Class
Click Next Click Finish
Add the nortelSSLOffload Class to the User Class
Click OK
Adding User Preferences Attribute to Active Directory
Appendix Using the Port Forwarder API
General
Creating a Port Forwarder
=1&c=1
Demo Application
Content.zip file
Creating a Port Forwarder Authenticator
Example
Example
Using the Port Forwarder API
Adding a Port Forwarder Logger
Using the Port Forwarder API
Example
Connecting Through a Proxy
Status
Monitoring the Port Forwarder
Statistics
Using the Port Forwarder API
Access Rules
CLI Command Line Interface
Glossary
Base Profile
Cluster of VPN Gateways
Console Connection
CRL Certificate Revocation List
CSR Certificate Signing Request
DIP Destination IP Address
DPort Destination Port
DTE Data Terminal Equipment
Extended Profile
Http Proxy
IP Interface
Master
MIB Management Information Base
Nslookup
NTP Network Time Protocol
Passphrase
PEM Privacy Enhanced Mail
Setup Utility
Portal
Port Forwarder
Real Server Group
SIP Source IP Address
Slave
Snmp Simple Network Management Protocol
SPort Source Port
SSL Secure Sockets Layer Protocol
SSL VPN client
STP Spanning Tree Protocol
TLS Transport Layer Security
VIP Virtual Server IP Address
Virtual Router
Virtual SSL Server
Vlan Virtual Local Area Network
509
Index
HSM
SSL
298
Page
User Guide
