Manuals / Nortel Networks / Computer Equipment / Network Router

Nortel Networks NN46120-104 At the Software Management# prompt, enter, Software Management# cur

Models: NN46120-104

1 300

Download 300 pages 2.66 Kb

Page 76

76Upgrading the NVG Software

For minor and major releases, the software upgrade will take part synchronously among the set of VPN Gateways in a cluster. If one or more VPN Gateways are not operational when the software is upgraded, they will automatically pick up the new version when they are started.

Note: If more than one software upgrade has been performed to a cluster while a VPN Gateway has been out of operation, the VPN Gateway must be reinstalled with the software version currently in use in that cluster. For more information about how to perform a reinstall, see “Reinstalling the Software” (page 70).

When you have downloaded the software upgrade package, you can inspect its status with the /boot/software/cur command.

Step Action

1At the Software Management# prompt, enter the following command:

>> Software Management# cur

Version Name Status

------- ---- ------

7.0.1SSL unpacked

5.1.5SSL permanent

The downloaded software upgrade package is indicated with the status unpacked. The software versions can be marked with one out of four possible status values. The meaning of these status values are:

•unpacked means that the software upgrade package has been downloaded and automatically decompressed.

•permanent means that the software is operational and will survive a reboot of the system.

•old means the software version has been permanent but is not currently operational. If a software version marked old is available, it is possible to switch back to this version by activating it again.

•current means that a software version marked as old or unpacked has been activated. As soon as the system has performed the necessary health checks, the current status changes to permanent.

To activate the unpacked software upgrade package, use the activate command.

2At the Software Management# prompt, enter:

Nortel VPN Gateway

User Guide

NN46120-104 02.01 Standard

14 April 2008

Copyright © 2007-2008 Nortel Networks

Image 76

Nortel Networks NN46120-104 manual At the Software Management# prompt, enter, Software Management# cur

Contents

User Guide Export LicensingContents Upgrading the NVG Software Snmp Agent 183 Copyright 2007-2008 Nortel Networks Preface Who Should Use This Book Related documentation VPN Gateway 6.0 Application Guide for SSL AccelerationProduct Names Users Guide How This Book Is OrganizedAppendices Adding User Preferences Attribute to Active Directory AaBbCc123 Typographic ConventionsHost# telnet IP Address How to Get Help Getting help from the Nortel Web siteIntroducing the VPN Gateway VPNSSL Acceleration VPN Hardware Platforms Software Features Feature ListWeb Portal User Authentication Transparent Mode AccessUser Authorization Secure Service Partitioning Client SecurityAccounting and Auditing NetworkingPortal Guard Branch Office TunnelsSSL Acceleration Certificate and Key Management Scalability and RedundancyPublic Key Infrastructure Supported Key and Certificate Formats Supported Handshake ProtocolsHash Algorithms Cipher SuitesVirtual Desktop Secure Portable Office SPO ClientIntroducing the VPN Gateway Introducing the ASA 310-FIPS HSM Overview Extended Mode vs. Fips Mode FIPS140-1 Level 3 SecurityTypes of iKeys Concept of iKey AuthenticationWrap Keys for ASA 310-FIPS Clusters Available Operations and iKeys Required CODE-USERHSM-SO HSM-US Additional HSM Information Introducing the ASA 310-FIPS Initial Setup Clusters New and JoinConﬁguration is Replicated among Master NVGs Clustering Over Multiple SubnetsIP Address Types Ports One-Armed Conﬁguration InterfacesTwo-Armed Conﬁguration Two-Armed Configuration without Application Switch Conﬁguration at Boot Up Setup MenuInstalling an NVG in a New Cluster Setting Up a One-Armed ConﬁgurationStep Action Choose new from the Setup menu Specify the port you want to use for network connectivityEnter network mask and Vlan tag ID Enter a default gateway addressEnter a Management IP address MIP Configure the management interface port number Setting Up a Two-Armed ConﬁgurationSpecify the host IP address for the current VPN Gateway Enter a default gateway address on the traffic interface Specify a new port number for the traffic interfaceSpecify a host IP address on the traffic public interface Interface gateway IP addressComplete the New Setup SelectPress Enter if correct Enter if correctTo accept WizardEnter to accept Create the account10.10.20.99 Enter Network mask for the pool range Creating IP poolSettings Created by the VPN Quick Setup Wizard Basic VPN Setup Default NetworkDefault Services Joining a VPN Gateway to an Existing Cluster Specify the port to be used for network connectivity Enter the VPN Gateway ’s host IP addressStep Action Choose join from the Setup menu Enter the Management IP address MIP of the existing clusterAccepts Enter the default gateway on the traffic interface Complete the Join SetupSpecify the VPN Gateway type Admin user Wait until the Setup utility has finishedAs slave Installing an ASA 310-FIPS Installing an ASA 310-FIPS in a New ClusterUse Fips or Extended Security Mode? fips/extended HSM-SO password HSM-SO password, or use the same HSM-SO password as for Card Press Enter to select new Adding an ASA 310-FIPS to an Existing Cluster Setup Menu Join Join an existing iSD cluster New Adding an ASA 310-FIPS to an Existing Cluster Re-enter to confirm HSM-SO iKey has been updated For this HSM cardVerify that CODE-SO iKey black is inserted in card ClusterThat you used in Step End Reinstalling the Software Log in as user boot, password ForgetMeTag id or Enter Continue y/n? y Press Enter to continueIf correct Restarting system Alteon WebSystems,I nc C Booting Login Upgrading the NVG Software Performing Minor/Major Release Upgrades Main# boot/software/downloadActivating the Software Upgrade Package Enter the host name or IP address of the serverEnter hostname or IP address of server server host Name or IPAt the Software Management# prompt, enter Software Management# curMain# boot/software/cur Activate ok, reloginHere Upgrading the NVG Software Managing Users and Groups User Rights and Group Membership Step Action Log in to the NVG cluster as the admin user Access the User MenuAdding a New User Add the new user and designate a user nameDefine a login password for the user User# edit certadminAssign the new user to a user group Verify and apply the group assignmentGroups# /cfg/sys/user User# edit certadmin Apply the changesUser# edit admin Remove the admin user from the certadmin groupVerify and apply the changes Adding Users through Radius Changing a Users Group Assignment Login certadminStep Action Log in to the NVG cluster User admin# groups/add Enter group name certadmin Changing Your Own Password Changing a Users PasswordType the passwd command to change your current password Changing Another Users Password Type the password command to initialize the password changeApply the changes User# del certadmin Deleting a UserUser# list Oper Root Admin Certadmin User# apply Certiﬁcates and Client Authentication Generating and Submitting a CSR Using the CLI ~ ! @ # $ % * / \ ? Save the CSR to a file Apply your changesSave the private key to a file KEY----- and -----END RSA Private KEY Open and copy the CSRSubmit the CSR to Verisign, Entrust, or any other CA Adding Certiﬁcates to the NVG PEM NET DERCopy the contents of your certificate file Copy-and-Paste CertiﬁcatesCertificate 1# apply Changes applied successfully Paste the contents of the key file at the command prompt Copy the contents of your private key fileCopy-and-Paste Private Key Using TFTP/FTP/SCP/SFTP to add Certiﬁcates and Keys Enter the desired file name Name or IP addressAdd your private key if in a separate file End Update Existing Certiﬁcate Create a New CertiﬁcateStep Action Check the certificate numbers currently in use Add a certificate with a new certificate numberConﬁgure a Virtual SSL Server to Require a Client Certiﬁcate Step ActionApply your settings Main# cfg/cur sslSSL# server RequireGenerating client certiﬁcates Enter for client certificateSpecify the validity period, key size, and serial number Key size 512/1024 Serial number of client certificate Main# cfg/ssl/server Com Export Client CertiﬁcateCert.pfx Transmit Private Key and Certiﬁcate to User Managing Revocation of Client Certiﬁcates Revoking Client Certiﬁcates Issued by an External CADownload and add a CRL from a TFTP/FTP/SCP/SFTP server Crl.der Crl.ascii Creating Your Own Certiﬁcate Revocation List Automatic CRL Retrieval Http//10.42.128.30/server.crl Main /cfg/cert 1/revoke/automaticInfo/certs command Client certiﬁcate support Enter the password in the Ndic login screen Click ConnectClick Connect Signing CSRs Paste the CSRMain# cfg/ssl/server #/adv/sslconnect/verify/cacer Step Action Specify an unused certificate number Generate Test CertiﬁcateProvide the requested information Automatic CRL Retrieval General Commands Show Certiﬁcate InformationShow Subject Information Check if Key and Certiﬁcate MatchShow Key Size Show Key InformationCertificates and Client Authentication Virtual Desktop Running the Virtual Desktop on Client Computers Licensing vdesktopLaunch Vdesktop from Portal Click SaveVirtual Desktop Operations Command Line Interface Connecting to the VPN Gateway ProcedureEstablishing a Console Connection RequirementsEstablishing a Telnet Connection Enabling and Restricting Telnet AccessRunning Telnet Establishing a Connection Using SSH Secure Shell Enabling and Restricting SSH AccessRunning an SSH Client Telnet IP addressEstablishing a Connection Using SSH Secure Shell Accessing the NVG Cluster User Access Level Description Default Account Group Passwo ForgetMCLI vs. Setup Command Line History and Editing Idle Timeout Troubleshooting the NVG Enable Telnet or SSH Access Check the Access ListCannot Connect to VPN Gateway through Telnet or Verify the Current ConﬁgurationCheck the IP Address Conﬁguration Cannot Add an NVG to a Cluster # /cfg/sys/accesslist/add Add Interface 1 IP Addresses and MIP to Access ListCannot Contact the MIP Troubleshooting the NVG Telnet or SSH Connection to the Management IP Address NVG Stops RespondingConsole Connection User Password is Lost Administrator User PasswordOperator User Password Root User PasswordPassword enter the admin user password An ASA 310-FIPS Stops Processing TrafﬁcPassword associated with the HSM-USER iKey for card Main# maint/hsm/login# /info/events/alarms Resetting HSM Cards on the ASA 310-FIPS Main# /boot/delete End Step Action Existing Transfer the cluster wrap key to card Enter the same secret passphrase as was used Former clusterWait for the setup of the added ASA 310-FIPS to finish Same secret passphrase as was used in the former ClusterMain# cfg/gtcfg Aaa User Fails to Connect to the VPNMain# maint/starttrace Dns IkeIppool IpsecSsl Smb UprefFtp Netdirect NetdirectpacketIs Net Direct enabled and configured correctly? Netdirectpacket End Cannot download the NetDirect Zipped ﬁle from client PC Installed Certiﬁcates and Virtual SSL Servers System DiagnosticsNetwork Diagnostics # /cfg/sys/cur # /stats/dump# /info/ethernet # ping IP address of virtual serverActive Alarms and the Events Log File Error Log Files# /cfg/ssl/server #/trace/ssldump # /info/events/downloadUnable to download NetDirect from VPN server Troubleshooting the NVG Appendix Supported Ciphers Supported CiphersSupported Ciphers cont’d Cipher List Formats Modifying a Cipher List Supported Cipher Strings and Meanings Cipher Strings and MeaningsCipher Strings and Meanings cont’d Appendix Snmp Agent Supported MIBs SNMPv2-MIBSNMP-FRAMEWORK-MIB SNMP-TARGET MIBSNMP-USER-BASED-SM-MIB LimitationsIP-MIB ALTEON-ISD-PLATFORM-MIB IANAifType-MIBSupported Traps Following Snmp traps are supported by the VPN GatewaySnmp Agent Appendix Syslog Messages Config filesystem corrupt beyond repair List of Syslog MessagesOperating System OS Messages Root filesystem corruptConfig filesystem corrupt Missing files in config filesystemSystem Control Process Messages System started isdssl-versionName isddown Name singlemasterName logopenfailed Name makesoftwarereleasepermanentfailedName copysoftwarereleasefailed Sender IP Name licenseName sslhwfail Name hsmnotloggedinName softwareconfigurationchanged Name partitionednetworkName ssimipishere Name licenseexpiresoonTrafﬁc Processing Messages Javascript error reason for hostpath Vbscript error reason for hostpathJscript.encode error reason Css error reasonHtml error reason Socks error reasonBad Ipport data line in hc script Bad regexp expr in health checkCertificate CRL handling errors Proxy connect host name too long hostGzip error reason TPS license limit limit exceededLicense expired Certificate CRL handling warningsStartup Messages Conﬁguration Reload Messages AAA Subsystem MessagesLdap backends unreachable Vpn=\id\ AuthId=\authid\ Log functionalityHost host ip is up accounted for in the license pool IPsec Subsystem Messages Ignoring request to roam from %s to %s All credits are exhausted for IPSec SAPFS is required but not provided by %s Bad clicert, Can’t find issuer in clicert Error while decoding certificate DER IdFailed to allocate IP addr from empty pool Failed to decode client certDeleting the QM replaced by new rekeyed QM Revocation byte length %dLoaded ca certificate %s Loaded server cert %sSyslog Messages in Alphabetical Order Syslog Messages in Alphabetical OrderSyslog Messages in Alphabetical Order cont’d Config filesystem re-initialized Down AAA Html IPsec Isakmp SA Established Isddown Cfg/sys/cur command Gateway but /cfg/vpn # /ser Loaded server id *will not Processing Received Delete Isakmp SA Socks error reason System started isdssl-version VPN LoginFailed Vpn=id OpenSSL License Issues Appendix License InformationOriginal SSLeay License GNU General Public License GNU General Public LicenseTerms and Conditions for COPYING, Distribution Modification 227 License Information No Warranty Apache Software License, Version 231 License Information Appendix HSM Security Policy ScopeApplicable Documents OverviewCapabilities Algorithm How it is used by the HSM module Used Fips Mode?SHA-1 Physical Security Module InterfacesComponents Deﬁnition of Security Relevant Data Items HSM Security Policy Roles and Services Services User CreationYES Service FIPS140-1 Level 3 Mode EPK, DPK EPK MK, Sopin Key Management Key GenerationKey Entry and Output Key StorageKey Distribution Fips 140-1 Mode ModesKey Destruction Key ArchivingNon-FIPS 140-1 Mode Self-TestsConclusion RC4 KATAppendix Deﬁnition of Key Codes Syntax Description Allowed Special CharactersRedeﬁnable Keys Allowed Special Characters ExplanationExample of a Key Code Deﬁnition File Appendix SSH host keys Methods for Protection VPN Gateway SSH host keys 261 Register the Schema Management dll Windows Server Install All Administrative Tools Windows 2000 ServerStep Action Click Start and select Run Add Standalone Snap-in window is displayed Under Snap-in, select Active Directory Schema and click Add Create a Shortcut to the Console WindowRight-click Attributes, point to New and select Attribute Permit Write Operations to the Schema Windows 2000 ServerClick Continue Create the isdUserPrefs attribute as shown Click OK Create New ClassCreate the nortelSSLOffload class as shown Add isdUserPrefs Attribute to nortelSSLOffload Class Click Next Click FinishAdd the nortelSSLOffload Class to the User Class Click OK Adding User Preferences Attribute to Active Directory Appendix Using the Port Forwarder API General Creating a Port Forwarder =1&c=1Demo Application Content.zip file Creating a Port Forwarder Authenticator ExampleExample Using the Port Forwarder API Adding a Port Forwarder Logger Using the Port Forwarder API Example Connecting Through a Proxy Status Monitoring the Port ForwarderStatistics Using the Port Forwarder API Access Rules CLI Command Line InterfaceGlossary Base ProfileCluster of VPN Gateways Console ConnectionCRL Certificate Revocation List CSR Certificate Signing RequestDIP Destination IP Address DPort Destination PortDTE Data Terminal Equipment Extended ProfileHttp Proxy IP InterfaceMaster MIB Management Information BaseNslookup NTP Network Time ProtocolPassphrase PEM Privacy Enhanced MailSetup Utility PortalPort Forwarder Real Server GroupSIP Source IP Address SlaveSnmp Simple Network Management Protocol SPort Source PortSSL Secure Sockets Layer Protocol SSL VPN clientSTP Spanning Tree Protocol TLS Transport Layer SecurityVIP Virtual Server IP Address Virtual RouterVirtual SSL Server Vlan Virtual Local Area Network509 Index HSM SSL 298 Page User Guide