Tcgid, Virtual Private Networking | SnapGear 2.0.1 specification

TCGID

[Siemens] Trust Center Global ID

The attribute/value pairs must be of the form attribute=value and be separated by commas. For example : C=US, ST=Illinois, L=Chicago, O=CyberGuard, OU=Sales, CN=SG550. It must match exactly the Distinguished Name of the remote party's local certificate to successfully authenticate the tunnel. This field appears when x.509 Certificates has been selected.

∙Generate an RSA key of pull down menu allows the length of the CyberGuard SG appliance generated RSA public/private key pair to be specified. The options include 512, 1024, 1536 and 2048 bits. The greater the key pair length, the longer the time required to generate the keys. It may take up to 20 minutes for a 2048 bit RSA key to be generated. This option appears when RSA Digital Key Signatures has been selected.

∙SPI Number field is the Security Parameters Index. However, this applies to the remote party. It is a hexadecimal value and must be unique. It is used to establish and uniquely identify the tunnel. It must be of the form 0xhex, where hex is one or more hexadecimal digits and be in the range of 0x100-0xfff. This field appears when Manual Keying has been selected.

∙Authentication Key field is the ESP Authentication Key. However, this applies to the remote party. It must be of the form 0xhex, where hex is one or more hexadecimal digits. The hex part must be exactly 32 characters long when using MD5 or 40 characters long when using SHA1 (excluding any underscore characters). It must use the same hash as the CyberGuard SG appliance's authentication key. This field appears when Manual Keying has been selected.

∙Encryption Key field is the ESP Encryption Key. However, this applies to the remote party. It must be of the form 0xhex, where hex is one or more hexadecimal digits. The hex part must be exactly 16 characters long when using DES or 48 characters long when using 3DES (excluding any underscore characters). It must use the same cipher as the CyberGuard SG appliance's encryption key. This field appears when Manual Keying has been selected.

∙Remote Network is the network behind the remote party. This field appears when Manual Keying has been selected.

128

Virtual Private Networking

Image 132

SnapGear 2.0.1 user manual Tcgid, Virtual Private Networking

Contents

Revision June 7 Contents Firewall 104 159 169170 177 Introduction CyberGuard SG Gateway AppliancesIntroduction CyberGuard SG PCI Appliances Bridged mode Secure by default Text like this highlights important issues Document Conventions Your CyberGuard SG Gateway Appliance Front panel LEDsSG300 model includes two blue straight through UTP cables Virtual Private Networking is enabled Rear panel CyberGuard SG Gateway Appliance Features Internet link featuresLAN link features DMZ link features SG570, SG575 only Your CyberGuard SG PCI Appliance LEDs CyberGuard SG PCI Appliance Features Network link featuresEnvironmental features Getting Started 192.168.0.1 255.255.255.0Page Right click on Local Area Connection and select Properties Set up the Password and LAN Connection Settings 192.168.0.100 Root Getting Started Getting Started Set up Internet Connection Settings Cable modemAnalog modem DSL modem Set up the PCs on your LAN to Access the Internet LAN with a Dhcp server LAN with no Dhcp server To manually set up each Windows PC on your network Select Dhcp Server from the Networking menu Getting Started Install the Network Driver on your PC Set up your PC to Connect to the Web Management Console Select Internet Protocol TCP/IP and click Properties Select Use the following DNS server addresses and enter Set up the Password and Network Connection Settings Network Setup Connections page will display Click Apply and Reboot Ensure Dhcp assigned is unchecked Getting Started Click Apply and Reboot Getting Started Page Network Connections ConnectionsNetwork Connections LAN Bridging Internet Internet Connection Methods Physically connect modem deviceCable Direct Internet Bridged Internet COM/Modem Failover Direct/Cable/ADSL InternetDialout Internet ISP. The Password and Confirm Password fields must Field DescriptionOptional Dialin access Direct DMZBridged DMZ Services on the DMZ Network Direct LANBridged LAN DMZ as a second Internet connection DMZ as a backup/failover Internet connection Load BalancingInternet Failover Enable the primary connection for failover Set up a secondary backup Internet connection Network Connections Routes Additional routesRoute management Advanced HostnameDNS Proxy Network Address Translation NAT/masquerading Dynamic DNS Interface aliases QoS Traffic Shaping Change MAC address Dialin Setup Dialin Setup Dialin Setup Following table describes the fields on the Dial-In Setup Dialin User Accounts Account list Page Remote User Configuration Windows 95/98/Me Dialin Setup Windows 2000/XP Dialin Setup Page Dhcp Server Configuration Dhcp ServerDhcp Server Dhcp Server Enable/Disable Subnet ListInterface Subnet Dhcp Server Dhcp Proxy Incoming Access FirewallFirewall Administration services CyberGuard SG Administrative Web Server SSL/HTTPS Secure Http SSL Certificate Setup Add Local and Private Certificates Packet Filtering Incoming InterfaceOutgoing Interface Action Addresses Service groups Rules Enable Destination NAT/port forwardingDescriptive Name Destination Services Source NATSource Address Destination Address To-1 NAT Rules Access Control and Content Filtering User authenticationPage Browser setup Click Advanced IP lists Web lists Content Reports Categories ZoneAlarm Intrusion Detection Intrusion Detection Benefits of using an IDS Basic Intrusion Detection and Blocking Page Advanced Intrusion Detection Advanced Intrusion Detection configuration Intrusion Detection Setting up the analysis server Page Web Cache Web cache is only available on SG575 modelsWeb Cache Web Cache Setup Cache size Network Shares Create a new user account100 Web Cache Create the network share 101 Web Cache Set the CyberGuard SG appliance to use the network share 102 Web Cache Set up LAN PCs to Use the Web Cache Peers103 Web Cache Virtual Private Networking 104 Virtual Private Networking Pptp Client Setup 106 Virtual Private Networking Pptp Server Setup 107 Virtual Private Networking Enable and configure the Pptp VPN server 108 Virtual Private Networking Data private as well as providing secure authentication Encryption is strongly recommended. This keeps your109 Virtual Private Networking Configuring user accounts for VPN server 111 Virtual Private Networking Configuring the remote VPN client 112 Virtual Private Networking Windows 95, Windows 98 and Windows Me Windows 114 Virtual Private Networking 115 Virtual Private Networking Windows XP 116 Virtual Private Networking Connecting the remote VPN client 117 Virtual Private Networking IPSec Setup Set up the Branch OfficeCyberGuard SG appliance to CyberGuard SG appliance Enabling IPSec 119 Virtual Private Networking Configure a tunnel to connect to the headquarters office Tunnel settings120 Virtual Private Networking 121 Virtual Private Networking 122 Virtual Private Networking Local endpoint settings 123 Virtual Private Networking 124 Virtual Private Networking Other options 125 Virtual Private Networking 126 Virtual Private Networking 127 Virtual Private Networking Tcgid 128 Virtual Private Networking Phase 1 settings Kept confidential129 Virtual Private Networking 130 Virtual Private Networking Phase 2 settings 131 Virtual Private Networking Configuring the Headquarters 132 Virtual Private Networking 133 Virtual Private Networking Remote endpoint settings Leave the Enable IP Payload Compression checkbox unchecked134 Virtual Private Networking 135 Virtual Private Networking Tunnel List ConnectionRemote party 136 Virtual Private Networking Status 137 Virtual Private Networking 138 Virtual Private Networking 139 Virtual Private Networking NAT Traversal Support Dynamic DNS Support140 Virtual Private Networking Certificate Management Extracting certificates141 Virtual Private Networking Creating certificates 142 Virtual Private Networking Create the self-signed root CA certificate 143 Virtual Private Networking Adding certificates 144 Virtual Private Networking Adding a CA or CRL certificate 145 Virtual Private Networking Adding a local certificate 146 Virtual Private Networking Troubleshooting 147 Virtual Private Networking 148 Virtual Private Networking 149 Virtual Private Networking 150 Virtual Private Networking Setting up a GRE tunnel CyberGuard SG appliance in Brisbane Internet addressLAN address CyberGuard SG appliance in Slough Internet address Remote subnet/netmask 10.1.0.0 GRE over IPSec 154 Virtual Private Networking Local Internal Address Place on Ethernet Bridge 155 Virtual Private Networking Troubleshooting 156 Virtual Private Networking L2TP VPN client 157 Virtual Private Networking L2TP server 158 Virtual Private Networking System Date and TimeSet date and time NTP time server Locality 160 System Users 161 System Administration DiagnosticEncrypted save/restore all User settings Diagnostics Internet access via access controlsPassword Diagnostics Network tests 164 System Configuration files System log165 System Flash upgrade Reboot Reset button Technical Support Appendix a IP Address Ranges B.c.d B.c.d-e B.c.d-e.f.g.h B.c.d/e169 Appendix a IP Address Ranges Appendix B Terminology Term Meaning170 Appendix B Terminology DNS 171 Appendix B Terminology IDB 172 Appendix B Terminology Isakmp 173 Appendix B Terminology NTP 174 Appendix B Terminology SHA 175 Appendix B Terminology 176 Access Logging Appendix C System Log Default Deny Eth0Eth1 Ppp Creating Custom Log Rules 179 Appendix C System Log 180 Appendix C System Log Iptables -I Forward -j LOG -i eth0 -p tcp 181 Appendix C System Log Rate Limiting 182 Appendix C System Log Administrative Access Logging Boot Log Messages183 Appendix C System Log Appendix D Firmware Upgrade Practices and Precautions 184 Appendix D Firmware Upgrade Practices and Precaut ions