Avaya 3.7 manual

VPNmanager® Confi guration Guide Release 3.7 670-10 0-600 Issue 4 May 20 05[...]

Copyrig ht 2005 , Avaya Inc. All Rights Reserved Notice Every effort was made to ensure th at the information in this d ocument was complete and accur ate at the time of release . However, information is subject to chan ge. War r a nt y Avaya Inc. pr ovides a limited wa rranty on this p roduct . Refer to yo ur sales agree ment to e stablish the ter[...]

Fede ral Co mmun icati ons C ommis sio n Statement Part 15: Canadi an Dep artme nt of Co mmunic at ions (DO C) Inte rferen ce Informat ion This Cl ass A di gital appara tus com plies wi th Cana dian ICE S-003. Cet apparei l numériq ue de la classe A est conform e à la norm e NMB-00 3 du Can ada. This eq uipmen t meets the a pplica ble Ind ustry C[...]

[...]

Issue 4 May 2005 5 Pref ace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 What Pr oducts are Cover ed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 VPNmanag er Overvie w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Network-wi de Visibility and Contro[...]

Contents 6 Avaya VPNmanager Configur ation Gui de Release 3.7 Chapter 2: Using VPNmanager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 About VP Nmanage r admini strators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3 Role Based M anagem ent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

Contents Issue 4 May 2005 7 Chapter 3: Setti ng up the network . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 New VPN Dom ain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Configur ing a secur ity gatew ay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 7 Creating a ne w secur[...]

Contents 8 Avaya VPNmanager Configur ation Gui de Release 3.7 Chapter 4: Configur ing IP Group s . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 About IP G roups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 7 Creating a Ne w IP Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

Contents Issue 4 May 2005 9 Information for VPNr emote Cli ent user s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 19 Using lo cal authe ntication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Using RA DIUS authent ication ( VPNos 3 .X and VP Nos 4.31) . . . . . . . . . . . . . . 120 Using LDA P authenti cat[...]

Contents 10 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Using the VPN tabs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 General tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 General tab wi th IKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

Contents Issue 4 May 2005 11 Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 Device Grou p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Denial of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3 V oi ce[...]

Contents 12 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Port for dy na-poli cy downloa d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 04 Port for S ecure Authe nticatio n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 04 Private IP Address (VPNos 3.x ) . . . . . . . . . . . . . . . . . . . . . . . [...]

Contents Issue 4 May 2005 13 Policy Ma nager - My Certific ates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 About VS U certific ates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 Creating and Installing a Signed Ce rtifica te. . . . . . . . . . . . . . . . . . . . . . . . 235 Switching c ertificat[...]

Contents 14 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Re-setup Dev ice. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1 Import Devi ce Configu ration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1 Ethernet S p eed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

Issue 4 May 2005 15 Preface This Av aya VPNmanager® Configurat ion Guide is written for indi viduals who have an underst anding of how computer networ ks are instal led, configured, and managed. It provides detai led informat ion about using the Ava ya VPNmanager soluti on to buil d small, medium, or large sc ale V irtual Pri vate Network s (VPNs)[...]

Preface 16 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Network-wide Visibility and Control The logi cal VPNmanager repres entati on of vi rtual pri vate network s simplifi es their instal lation and contr ol. From a single workst atio n, network managers ca n assign use rs anywhere o n the network t o one or mor e logical Gr oups and integ[...]

Related Documentation Issue 4 May 2005 17 Complementary to SNMP Management T ools The VPNmanager soft ware is designed speci fi cal ly for securel y defi ning, configuri ng, monitoring, and upgradin g VPNs. The VPNmanager soft ware is r equired to co nfigure and modify VPNs. Secure tr aff ic running bet ween VSUs or be tween VSUs and VPNre mote Cli[...]

Preface 18 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Chapter 1: Overview of implement ation , provi des an overv iew of how to use VPNmanger for centrali zed administr ation of your VPN and security gate way . It incl udes a checklist for implmeneti ng the network. Chapter 2: Using VPNmanager , expla ins how to log in to VPNmanager . It [...]

Contacting Technical Support Issue 4 May 2005 19 Cont acting T echni cal Support T echni cal Support i s available to suppo rt contract holders of Avay a VPN product s. Domestic su pport ● T oll free te lephone support: (866) 462 -8292 (2 4x7) ● Email: v pnsupport@avaya. com ● We b: http:// w ww .support .avaya.c om Internat ional Suppor t ?[...]

Preface 20 Avaya VPNmanag er Conf iguration G uide Releas e 3.7[...]

Issue 4 May 2005 21 Chapter 1: Over view of impl ement ation Planning how your virt ual private net work should be configur ed is cr it ical to the succes sful deployment of a s ecure virtual private net work.This chapter provi des an overv iew of th e major features t hat you wil l configur e. Note: Note: This chapter does not ex plain how to set [...]

Overview o f implem entation 22 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 VPNremote Client so f tware VPNremote Clie nt soft ware is a communicati ons applicati on that runs on remot e computers that use dial up, DSL and c able connecti on suppli ed by Inte rnet Service Providers (ISP), t o connect to the corporate VPN. When communicati [...]

Overview of the VPN management hierarchy Issue 4 May 2005 23 ● VPNmanager Enterprise Cli ent. Use t he Enterpri se Client ve rsion for managing an unlimited numbe r of secur i ty gateways and VPNremote Client s. ● VPNmanager Service Provider Cli ent. Use the Service Provide r Cli ent version to manage an unl imited number of securit y gateways [...]

Overview o f implem entation 24 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 An IP Group contai ns the IP addresses that belong to a speci f ic LAN. Any device connected to the LAN can use these addresses. A VPN can have many IP Groups so addresses can be consolidat ed to meet the needs of an organizatio n. The securi ty gateway is co nfigu[...]

Preparing to configur e your network Issue 4 May 2005 25 ● Public-backup zone . Public-backup zone is the backu p interface to the primary public interf ace for use when Failover is configur ed. ● Semiprivate zone . Semipri vat e zone is used for media such as wirel ess LAN, wher e the network is consider ed part o f the pr otec ted network, bu[...]

Overview o f implem entation 26 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 St atic Routes S tatic routes are specified when more than o ne rou ter exist s on a network to which the s ecurity gateway must forwar d eit her VPN traf fic or non-VPN tr aff ic . Y ou can build a st atic route tab le with up to 32 network addre ss/mask pa ir s. [...]

Preparing to configur e your network Issue 4 May 2005 27 Security policies VPNmanager securi ty poli cy management provi des the f ollowing s ecurity feat ures that can be configur ed: ● Firewa ll rul es ● Denial of Se rvice (DoS) categori es ● Quality of Servic e (QoS) rules ● Bandwidt h management In addit ion, encr yption sec urity opt i[...]

Overview o f implem entation 28 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Ping of Dea th. - The ping of death sends packe t s with invalid l ength s. When the receiving system attempt s to rebuild the p ackets, the syst em crashes because the p acket length exhaust s the available memory . IP S poofing. - This att ack s ends an I P pack [...]

Preparing to configur e your network Issue 4 May 2005 29 ● Allow voice- secur e communication wit h Avaya’ s IP Sof tphone and IP Offi ce Phone Manager Pro using VPNremote Cli ent ● Enable NA T traversal of H.323 V oIP traffic ● Optimize bandwidth for V oIP tr aff ic using th e securi ty gateway’ s Quali ty of Ser vice (QoS) policie s In [...]

Overview o f implem entation 30 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Syslog The securi ty gateway has a sysl og messaging f acility for logging system error mess ages. The message can be automatical ly sent to a destinat ion running a Syslog ser ver . Client IP address pooling Access control devices (ACD), such as fi rewal ls, guard[...]

Sequence to configure y our VPN Issue 4 May 2005 31 1 1. Configure firewall rules 12. Associ ate firewall rul es with the correct gateway and security zone 13. Configure ot her features such as QoS, V oIP gateway , DHCP , NA T , routing, etc.[...]

Overview o f implem entation 32 Avaya VPNmanag er Conf iguration G uide Releas e 3.7[...]

Issue 4 May 2005 33 Chapter 2: Using VPNmanager With A vaya VPNmanager y ou can defi ne, configure, and manage VPNs and firewal l polici es, upgrade fir mware, and manage remote user access polici es. The VPNmanager graphical interf ace is modularized by functi ons and t asks to make confi guri ng a VPN fast and easy . This chapter desc ri bes how [...]

Using VPN manager 34 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 4. Ad m in i st rat o r w ith fu ll acc e ss 5. An administra tor with full access can modify the configurati on for VPN domains, change their password, and be p art of multiple VPN domains. 6. VPNmanager allows full-access administrator to modify object s and devi ces that a[...]

Log into t he VPNmanager c onsole Issue 4 May 2005 35 Log into the VPNmanager console Y ou log in to the VPNmanager from your computer ’ s S tart menu, Programs>A vaya> VPNmanager>Console . Y ou use the super user name and passwor d that were configured when the VPNmanager soft ware was install ed. Figure 2: VPNmanager login screen The f[...]

Using VPN manager 36 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 3. Enter the IP add ress of t he Policy Server . 4. Enter the port. The defaul t is 4 43. 5. Clic k OK . The name or address is displayed on the login screen Y ou can edit or delete the polic y server informati on. Open Dom ain When you connect to the direc tor y serv er , an[...]

Navigating the main window Issue 4 May 2005 37 Figure 3: VPNmanager console mai n window The menu bar on the main VPNmanager screen in clu des the followin g commands File, Edit , V ie w , T ools, and Help. File m enu The File menu include s the fol lowing commands: ● Domain . Y ou can create a new domain, open, close, or del ete an existing doma[...]

Using VPN manager 38 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Note: Note: When you delete VPNs that include group s associat ed with RADIUS-enabled securit y gateways, the VPNremote Client conf iguration recor ds should be removed from the RADIUS database . See RADIUS/ACE Services on page 124. ● New Object . When New Object is sel ect[...]

Navigating the main window Issue 4 May 2005 39 Edit m enu From Edit, you can chose one of the foll owi ng commands: ● Delete Objec t . Select an object from the VPN diagram and then selec t Edit>Del ete Object . ● Modify Object . Sele ct an obj ect form the VPN diagram and then select Edit>M odify Object . ● Preferences . Edit>Pref e[...]

Using VPN manager 40 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 list of enterp rise MIB object s. Examples of r eady-to-use groups include an Att ack log, T raf fic l og, securit y gateway CPU u sage, and th roughput.Y ou sele ct a ty pe of group to monitor , or yo u can defi ne a customer group to monitor . See Using Monit or on page 250[...]

Navigating the main window Issue 4 May 2005 41 Figure 5: Icons on toolbar T able 3: T oolbar commands T oolbar commands Description New Objec t The New Object button i s a short cut to the File>New Obj ect command to create new object s within any of the categ ories list ed in T able 2 . When you select one of these commands, eith er a dialog or[...]

Using VPN manager 42 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 VPN view p a ne The VPN view pane is empty until you define your VPN. As devices are config ured and added to the VPN, they are displayed in the view p ane. The VPN view pan e automaticall y sel ects one of thr ee presentat ion types: network diag ram view , tiled view , or t[...]

Navigating the main window Issue 4 May 2005 43 Figure 6: VPNmanager Networ k Diagram V iew Til e d Vi ew When six or more secur ity gateway s are pres ent in t he selected VPN, the pr esentat ion automatical ly switches from the diagram vi ew to the tiled view . Figure 7: VPNmanager , Ti led Vi ew T ree V iew An alternative pr esentat ion style to [...]

Using VPN manager 44 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Figure 8: VPNmanager , T ree View Alar m monit oring p ane T o the right of t he VPN view pa ne is the alarm monitor pan e. The alarm monitor p ane cont ains summary alarm infor m ati on, including a time st amp, security gateway name, and alar m type. Alarm infor m ati on is[...]

Configuration Console window Issue 4 May 2005 45 Figure 9: Configurati on console window Configuratio n Console Men u bar The menu bar on the Configuration Consol e window includes the fo llowing commands File, Edit, V i ew , T ools, and Help. File m enu The File menu include s the fol lowing commands: ● New Object . Y ou can cre ate new o bjec t[...]

Using VPN manager 46 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Vi e w m e n u From the V iew menu, you can vi ew the conf igured object s, an d you can r efresh the screen. T ools menu The T ools menu consist s of functi ons used fo r normal VPN maintenance. These func tions include the f oll owing. ● Up date Devices . T o update the s[...]

Update Device s Issue 4 May 2005 47 To o l b a r The toolbar inc ludes the foll o wing shortcut buttons . ● New Object . Y ou can select one of the icons in the toolbar belo w New Object and then click New Obje ct to launch t he appropriat e conf iguratio n dialog, or you can clic k the arrow tip next to New Object and select one of the object t [...]

Using VPN manager 48 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 5. If the Up date Configurati on dialog appear s, do the followi ng. ● In the User Name text box, type in the superuser name you confi gur ed through the Console Quick Setup Menu when t he device was being ins tall ed. If th e device had a firmware upgr ade fr om 3.x, type [...]

Preferen ces Issue 4 May 2005 49 Figure 10: Preferences, General T ab Save Configur ation changes a utomatically - When this radio b utton is act ive, any changes made to an object are automatical ly saved upon moving to another object. Alert me b efore saving configuration cha nges - When this radio button i s acti ve, any changes made to an objec[...]

Using VPN manager 50 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Figure 1 1: Preferences, Dyna- Policy (Glo bal) T ab Dyna Policy Auth entication The Dyna Pol icy Authentic ating t ab of fers a selecti on of how use r authenticat ion and Cli ent Configurati on Download (CCD) are performed. Choices are Local (s ecurity gateway -based), RADI[...]

Preferen ces Issue 4 May 2005 51 Advanced The Advanced tab i s used to ei ther h ide or dis play t he LDAP director y conte xt fiel d that appear s in a number of places throughout the VPNmanager Consol e. Users familiar wit h the LDAP director y st ructure may prefer having this field dis played. Figure 13: Preferences, Advanced T ab Remote Client[...]

Using VPN manager 52 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Alarm/Monitorin g The Alarm/Monito ri ng tab is used to define high-level fun ctions of the alarm consol e. See Monitoring al arms on page 268. Figure 15: Preference, Alarm/Monitoring Resolve IP Address to Device Name - Enable/Disable. When e nabled, the IP address of the ala[...]

Preferen ces Issue 4 May 2005 53 Figure 16: T unnel End Point Poli cy[...]

Using VPN manager 54 Avaya VPNmanag er Conf iguration G uide Releas e 3.7[...]

Issue 4 May 2005 55 Chapt er 3: Setting up the ne t wo r k This chapter descr ibes the following fea t ures that are configur ed for the domain and the security gateway ● New VPN domain ● Security gateway inc luding: ● Domain name sys tem resolut ion ● Zone inte rfaces ● NA T po licies ● S tatic rout e table ● Routing informat ion pro[...]

Setting up the networ k 56 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 ● Use organization names (f or example, “W orldWideSales_ VPN” or “Applica tionsEngineerin g_VPN”) since VPNs usually repres ent functional organi zations within a corpor at ion. Note: Note: Once th e domain name i s created, you cannot change it. 3. In t he S[...]

Configuring a security gateway Issue 4 May 2005 57 Configuring a security gate way The New Object>Device function is used to create secur ity gateways and VPN Servic e Unit s (VSU) in a VPN environment. The securi ty gateway act s as the end- points of VPN tunnels. Note: Note: Beginning wit h VPNmanager 3 .4, t his c onfi gurati on gui de u ses [...]

Setting up the networ k 58 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 ● DNS Name, to e nter the name of the Domain Name Service o f the new security gateway . See DNS tab on page 63 . If the device i s alrea dy in the net work, sel ect th e Detect Devi ce checkbox. The def ault is sele cted . 3. In t he Private I P Configurat ion sectio[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 59 13. Clic k Finish to save the conf igurati on information to the directory serve, t o poll security gateway , and to exit t he Setup Wizard. When you want to send configurat ions to one or more security gat eway , clic k Up date Devi ces from the Configurat ion Console window [...]

Setting up the networ k 60 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 General tab The Device General ta b, Figure 17 , displa ys i nformation speci f ic to the security gateway highlighted in the Contents list. Fr om the General tab you can change the IP ad dress VPNmanager uses to communicate wit h the security gateway . All other infor [...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 61 Figure 17: Device General t ab Directory Name - The director y na me is the lo cation of the securi ty gateway in the dire ct ory tree st ructure.Th e security ga teway name is unique wit hin the VPN domain to whi ch it is assigned. VPN Mode - The VPN mode can either be VPN Ga[...]

Setting up the networ k 62 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Associated I P Group s area. - This area list s the names of t he IP group s associ ated with this securit y gateway . Y ou can select an IP group fr om the list a nd clic k Go to go to the I P Group tab to view the group information. For VSUs ru nning VPNos 4.0 or ear [...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 63 3. In t he Me mo text box, type in any i nfor mation about the secur it y gateway . 4. When finished, click Save . DNS t ab Use the DNS tab t o define whe re to fo rward the Domain Name Service ( DNS) name resol ution request s from the IP devices on the privat e si de of the [...]

Setting up the networ k 64 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 When a DNS server is selected to send the DNS query , and no response is received within a short t ime, another DNS server is selected by contin uing t he process as des cribed i n the previous p aragraph. But i f the previous server repl ies to the DNS query , another [...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 65 T o add a st atic DNS server 1. From the Configurati on Console Content s column , select the securi ty gateway to be configur ed. Click the DNS t ab to bring it to the fr ont . 2. In t he St atic DNS Servers area, cl ic k Add . Enter the IP address of the DNS server and enabl[...]

Setting up the networ k 66 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 7. Clic k Close to r eturn to the DNS tab. Clickin g close i gnores any c hanges made in the Add DNS Rule dialog box. 8. Clic k Save to s ave the change . 9. When you want to send the confi gur ation to one or more VSUs, clic k Up date Devices . T o delet e a DNS s er v[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 67 Figure 20: Interfac e t ab Config Media interfac es can be assigned to one of six diff erent net work uses, call ed zones . The number of zones that can be configur ed depends on the security gat eway model ( T able 6 ). Ethernet0 and Ethernet 1 are presen t in al l models an [...]

Setting up the networ k 68 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 The followi ng secti on describes the six networ k zones. Public. - The public ne twork int erface prov ides connect ion to the Interne t, usually by way of a wide area network (W AN). When VPNmanager is used, the security gateway must be configur ed with a st ati c IP [...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 69 T o set the amount of time del ay to swit ch from a secondary inte rface to the primar y int erface once the primary l ink has been detected, configure th e Hold Down Ti mer . This del ay provides the necessa ry time f or the p rimary in terface t o sta bilize. The Hold Down T[...]

Setting up the networ k 70 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Options for IP addressing for interface zones Y ou can confi gure each zone wi th dif ferent addressing opt ions and t he private port can be configur ed as a DHCP ser ver or DHCP rel ay used to obtai n IP address es from t he DHCP server ( T able 7 ). Th is secti on ex[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 71 Point-to-Point Protocol Over Ethernet (PPPoE) Client Use PPPoE Cli ent a ddres sin g as a co nveni ent way t o connect the publi c or public-backup zone of the security gat eway to the Internet, if your ISP support s PPPoE addressing. PPPoE Client addressing re quires user aut[...]

Setting up the networ k 72 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 When DHCP server is configured, you can configure the IP Device and the IP T elepho ny settings . Click IP Devi ces to display a list of al l IP devices that the DHCP server curr ently support s. The MAC ad dress and IP address are listed , along wi th infor mation that[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 73 DHCP Relay This functi onal ity allows the DHCP Relay agent to bi nd to the devi ce’ s pri vate and semi-private interf ace zones and for ward only DHCP request s from the network behind t he devic e to the DHCP server(s) on the publ ic network. DHCP Relay server can res ide[...]

Setting up the networ k 74 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Figure 21: Media inte rface confi guration dia log Note: Note: The f ields displ ayed in t he screen ar e based on t he type of zone selec ted. 3. The media option choic es depend on the media type sele cted and th e capabili ties of the underlyi ng device ha rdware and[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 75 ● The IP addr ess. This IP address must be wit hin the same subnet as the DHCP s erver . A vaya re commends that you use an IP address for the devi ce that falls into the DHCP subnet, but not i n the DHCP range. 4. Clic k Add , and then click OK . T o add an IP t elephony de[...]

Setting up the networ k 76 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Private port t ab For SGs with VPNos 4.2 or VPNos 4.3, the Private Port tab is used to configure of the privat e IP address. In addi tion, you can confi gur e the device to act as a DHCP server on the priva te port or you c an configure a DHCP relay . Note: Note: For SG[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 77 Note: Note: Changing the DHCP Server IP address may result in lo sing con nectivity t o the securit y gateway , if the VPNmanager i s on the private side of t he securi ty gateway . Also all acti ve DHCP cli ent s may require rene wal through an OS utility (e.g., using winipcf[...]

Setting up the networ k 78 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 The A vaya DEFINI TY® series of IP telephones re quir e entries for all four fields (refer to your Definity document ation for furt her information). Non-A vaya IP telephon es require at a minimum, the TFTP ser ver IP ad dress. Note: Note: The followi ng IP telephone D[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 79 Note: Note: When the securi ty gat eway is acting as a DHCP Relay , the securi ty gateway cannot be a DHCP server at the same time. DHCP Relay and DHCP Server services ar e mutually exclusive. When the DHCP Relay agent receives DHCP client requ ests fr om th e priv ate port, t[...]

Setting up the networ k 80 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Figure 24: Device Users t ab T o add a device account user: 1. From the Configuration Cons ole Conten t s column, s elect the dev ice to be conf igured. Cl ic k the Device Users t ab to bring i t to the front. 2. Clic k on the Dev ice Account User drop-down menu to sele[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 81 Select a network obj ect and cli ck Add to configure a dditional I P addresses an d mask. Figure 25: Device Network Object s t ab Routing Routing i s specified when more than one rou ter exis ts on a network t o which t he securit y gateway must forward ei ther VPN or non -VPN[...]

Setting up the networ k 82 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 The Network/Mask Pair s for this Hop list indi cates the st atic rout e destinat ion address. Y ou can build a stat ic route tabl e with up to 32 net work address/ mask pa ris. This limit al lows for any combinatio n rangi ng from a si ngle rou ter wit h 32 network add [...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 83 13. Clic k Add to List to put the address/mask pair into the Current Net work /Ma sk P airs fo r this Hop list box, which als o associates the p air with the IP address of the next hop router . 14. Clic k Finished to return to the St atic Route tab . 15. Clic k Save . 16. When[...]

Setting up the networ k 84 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 If th e securit y gateway is i n a networ k with many routers (gat eways) to ot her TCP/IP networks, there can be mor e than one possibl e p ath t o a spec ific rout er . In tha t case, r out ers are pr obably building rout ing tabl es from the informat ion exchanged by[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 85 Policies t ab, NA T services Network Address T ranslation (NA T) is an Internet standard th at allows priva te (nonrout able) networks to connect to publ ic (rout abl e) networks. T o connect private networks and publ ic networks, addr ess mapping is performed on a security ga[...]

Setting up the networ k 86 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 Note: Note: If your network c ontains any nonrout able a ddresses, A vaya recommends that you enable the Share publi c address to reach the in ternet featur e. Any firewall rules that are in use can block translated t raff ic. Priority of NA T types NA T is a rule-ba se[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 87 T o add a NA T rule (VPNos 4.31) 1. From the Configurati on Consol e Contents column , sel ect the Policy tab to bring i t to the fron t. S e le c t NA T from th e li st . 2. Clic k GO . The NA T Rul es dialog is displayed and the select ed device’ s name shoul d be visible [...]

Setting up the networ k 88 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 About NA T types for VPN os 3.X For VPNos 3.X, you can set the following typ es of NA T mapping on the VSU. ● S t atic Mappi ng – Addresses f ro m one network ar e perman ently mapped t o addresse s on another networ k. S tat ic mapping works when traf fic is init i[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 89 ● Provide support for multi-gateway network configur ations . Address mappin g can be used to ensur e that request and r eply packet s enter and exit the networ k through th e same securit y gateway . Accessing the Internet from private networ ks Figure 28 shows an example o[...]

Setting up the networ k 90 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 In the example shown in Figure 28 , when client 10.1.2.1 01 initial ly sends a pa cket to a host on the public net work, the security gateway dynamic ally maps the client’ s private address 10.1.2.101 to a publ ic address selected from the N 1 .N 2 .N 3 .0/24 address [...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 91 changin g it from 1 0.1.1.1 7 to 172.16. 0.17. At this point, the pac ket’ s source and destination addresses a re: 172.16. 0.17 -> 172.16.1.20. The pac ket is then tunneled across the publi c net work to LA_VSU. Since the pac ket enters LA_VSU through a t unnel, the NA T[...]

Setting up the networ k 92 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 When the SF_VSU receives the reply p acket through the tu nnel, the tunnel NA T rule changes the p acket’ s des tination addr ess from 172 .16.0.17 t o 10.1.1 .17 and t he private i nterface NA T rule changes the p acket’ s source address from 172.16.1.20 to 10. 0.8[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 93 Figure 30: Using NA T to Support Multiple Gateways Interface for VPNos 4.2 The foll owing three i nterface choices ar e available f or device s with VPNos 4.2: ● Public – Pri ma ri ly used to allow clients on a priv ate network to access host s on the Internet and for tran[...]

Setting up the networ k 94 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 ● T unnel – This is a special i nterface used t o support t unneling between overlapping priva te networks while sti ll allowing connect i ons to the Internet . Group - If you select “U se existi ng group s,” the original address and masks are r eplaced wit h th[...]

Using Device tabs to configure the security ga teway Issue 4 May 2005 95 3. From the T ranslation T ype list, selec t a tra nslation type . 4. From the T ranslation will be appli ed on list, select which i nter face needs the NA T rule. 5. In t he Original Address and Ori gi nal Mask text bo xes, type in the or iginal address and mask. 6. Do one of[...]

Setting up the networ k 96 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 T o add a tunnel NA T rule: 1. From the Configuration Console>Dev ice Content s p ane, s elect the Policy t ab to bring it to the front. Select NA T from the list . Click GO . The NA T Rules dialog i s displayed. 2. Clic k the Add to open the Add NA T Rule dialog box[...]

Issue 4 May 2005 97 Chapter 4: Configuring IP Group s An IP Group is composed of a set of host s ( workst at ions and ser vers) that are locat ed behin d a common security gat eway. The hosts are defined by their IP addre ss and mask. The security gateway must exist pri or to cr eating IP Group s. V ir t ual private networks (VPNs) are ma de up of [...]

Configuring IP Groups 98 Avaya VPNmanag er Conf iguration G uide Releas e 3.7 5. Y our new IP Group appears in the Content s column. 6. Clic k Save . Aft er an IP Group is created, use the General and Memo tabs to r ecord notes about the IP group. New IP Group The New IP Group scre en is displ ayed when New>IP Group is sel ected, or when no I P [...]

IP Group - General tab Issue 4 May 2005 99 Figure 31: IP Group Gener al t ab One or more address/mask p airs can be created, a nd the group can be assoc iated with a specifi c secur ity gateway . Y our new group can even be associated wit h a securi ty gateway belonging to an extranet , a VPN outside your domain and belonging to anot her organizati[...]

Configuring IP Groups 100 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 IKE Identi fier . - Extranet security gateway using IKE key manage ment can be bas ed on the following IKE Ident ifier types: ● IP Address ● DNS Name ● Directory Na me ● Email Name When one of the above is selected , an ap propriate fi eld appears in which the in[...]

Add IP Group member Issue 4 May 2005 101 Configuring an I P Group T o configure an IP Group that co mmunicates within it s own VPN domain: 1. Select the IP Group to be conf igured. Click the General t ab to bri ng it t o the fr ont. 2. Clic k Add . The Add IP Group dialog is displayed. 128 ###.###.###.n (n = z ero or 128) ; e.g., 130.57.4. 128 255.[...]

Configuring IP Groups 102 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 3. Configure th e address/mask pai r . ● New IP Network . T ype in the network address f or a LAN. ● New IP Mask . T ype in a mask to defi ne the range of addresses that wil l become members of the IP Group. The larger the mask, the smaller and more focused th e addr[...]

Add IP Group member Issue 4 May 2005 103 4. Configure th e address/mask pai r . ● New IP Network . T ype in the network address f or a LAN. ● New IP Mask . T ype in a mask to defi ne the range of addresses that wil l become members of the IP Group. The larger the mask, the smaller and more focused th e address range will be. The method is just [...]

Configuring IP Groups 104 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Memo Memo can be used to record notes about the IP Group, such as change hi story , where the group is locat ed, et c. Inform ati on entered here is associat ed only with the securi ty gateway in focus. This information is stored only in the dat abase and not downloaded [...]

Issue 4 May 2005 105 Chapter 5: Configuri ng remote acce ss users VPNremote™ Clie nt user s who log in to the VPN through the securi ty gateway must have their user auth enticatio n configur ed on the s ecurity g ateway . Use r object s are used for c reating remote users. Those remote user s connect to the VPN through an ISP (Internet Service Pr[...]

Configuring remote access users 106 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Using dyna-policy The VPNremote c lient uses a Dyna-Policy when communicating with a VPN. The dyna-policy tells the VPNremote cli ent which authenticat ion and dyna-policy mu st be used and the topology of the VPN. A dyna-pol icy can be configured for eit her g[...]

Configuring a global dyna-policy Issue 4 May 2005 107 Configuring a global dyna-policy Y ou configure t he global CCD f rom the Pref erences propert y sheet . Y ou should set up the default global CCD befor e you confi gure user object s. The p arameters can be changed any time . Y ou configure the following Pre ferences propert y t abs to create a[...]

Configuring remote access users 108 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 VPN configuratio n files on rem ote user ’ s com puter ● None . The VPN session par ame ter information is stored loc all y on the remot e users computer . No p assword i s requir ed when VPNremote is subs equently launche d. ● Download confi guration whe[...]

Configuring a global dyna-policy Issue 4 May 2005 109 Figure 34: Preferences, Dyna-Policy (Global) t ab Dyna-Policy Authen tication t ab The Prefer ences Dyna- Policy Authentica tion tab is used to define how user authentica tion and Client Confi guration Downlo ad (CCD) are per formed. Choices are Local (security gateway-based) , RADI US, or LDAP [...]

Configuring remote access users 110 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Local authenticatio n Local authent ication is used in non- dynamic VPNs, that is VPNs that are not usin g RADIUS or a director y ser ver as the authentic ation dat abase. The user is authentica ted from the database stored i n the secu rity gat eway’s flash [...]

Configuring a global dyna-policy Issue 4 May 2005 111 Remote Client t ab The Prefer ences Remote Cli ent tab is used to est ablish a p ath (tunnel ) to a secure DNS server to resol ve clie nt DNS names (as opposed to using a publ ic DNS ser ver) and t o set th e remote client idle time- out period . Figure 36: Preferences, Remote Client T ab Client[...]

Configuring remote access users 112 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 T o conf igure Client DNS Resolution Redirection f or all VPNremote Client s: ● Enter a subdomain name in the Domain Name field (for exampl e, finance.my company .com). ● Enter th e IP add ress of the DNS server t hat will resolve DNS r equests for the corr[...]

Configure a default CCD with global dyna-policy Issue 4 May 2005 113 Configure a default CCD wi th global dy na-policy The followi ng proced ure describes how to configur e default dyna-pol icy par ameters. These commands control how CCD automatic ally deliv ers dyna-pol icies t o VPNremote Cli ent s. By default, all user adopt these set tings, but[...]

Configuring remote access users 114 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Note: Note: This is the only choice f or VPNos 4.31 ● Select Use RADIUS configurat ion to stor e the Dyna-Poli cies on a dedicated RADIUS server . ● Select Use LDAP for configur ation to store the Dyna-Poli cies on the Direct ory Server . ● (Only with VPN[...]

About creating indiv idual dynamic-policy Issue 4 May 2005 115 Default user The Default User fea ture is normally used in conjunct ion with the default dyna- pol icy to estab lish a common template by which a desir ed VPN poli cy type is delivered to the remote client s in the domain. Multiple default user s can exist in a domain, but only one def [...]

Configuring remote access users 116 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 37: User General t ab Directory Name. - This is the unique users name withi n the directory str uctu re. It is not duplicat ed anywhere within the VPN domain to which it is assi gned. Current VPN Members hip. - This secti on list s VPNs t o which th e cu[...]

About creating indiv idual dynamic-policy Issue 4 May 2005 117 Actions t ab The User Actions ta b is used for non-dyna-pol icy alter nati ves. Figure 38: User ’ s Action t ab Export My Configurati on. - Exports your dyna -pol icy to a file for convey ance to the remote user ’s machine. Enter a p assword an d retype t he pass word. Note: Note: I[...]

Configuring remote access users 118 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 39: User Advanced t ab Four types of ident ifiers can exist i n the certific ate generated for the remote user . ● Directory Na me ● IP Address ● DNS Name ● Email Name ( RFC 822) Configu r i ng a re mo te use r obj ect If you remote users use the[...]

Informatio n for VPNr emote Clien t users Issue 4 May 2005 119 5. Clic k the Dyna Poli cy tab to bring i t to t he front. If you do not want th e defaul t Dyna- Policy settings , select Do Not Use Default Dyna-Policy . Then configur e a customi zed method f or storing the VPN configurat ion for the user . ● Select None to store the VPN session pa[...]

Configuring remote access users 120 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Using local authentica tion If the securi ty gateway uses authentic ating remote users fo r CCD, deliver the fol l owing pair s to the respecti ve users. ● NAME: The name created in S tep 2 . ● P ASSWORD: The pass word cr eated in S tep 3 Using RADIUS authe[...]

Using Policy Manager for user configuration Issue 4 May 2005 121 A Client I P Address Pool is a r ange of source IP addresses that i s recogni zed by an ACD. The pool is stor ed in the security gat eway , so when it recognizes an inbound p acket from a VPNremote Client , it swaps the sou rce addr ess wit h one from the pool. When the security gatew[...]

Configuring remote access users 122 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Add Client WINS The Client WINS address ent ered her e is sent to the security gateway that is used for the VPNremote virtu al adapt er config urat io n. This inf o rmat ion is then sent to the VPNremote Client through CCD. T wo Client WINS address can be confi[...]

Using Policy Manager for user configuration Issue 4 May 2005 123 Figure 41: Policy Manager for cli ent at tributes Enable Client Legal Message. - The check box is used t o enable the Client legal messag e. The default is disabled. Require Accept ance. - Select Ye s to require the remote user to acc ept the message before log on is authenti cat ed. [...]

Configuring remote access users 124 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 RADIUS/ACE Services (VPNos 3.x and VPNos 4.31 only) Note: Note: If a RADI US server is used, the name assigned t o a VPNremote Client must be identic al to t he one used i n the RADIUS server . A popular tool f or managing authentication and acco unting for rem[...]

RADIUS/ACE S ervices Issue 4 May 2005 125 Settings RADIUS attempt s before assuming f ailure - Integ e r fr om 1 to 10 indicating the number of attempt s th e securit y gateway makes before ti ming out wi th a fa ilure. The default is 3. RADIUS time-out before assumi ng fail ure - T ime in seconds from 10 to 500. This value is the tot al number of [...]

Configuring remote access users 126 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 The RADIUS protocol The RADIUS protocol i s documented in an Inte rnet Engineeri ng T ask Force (IETF) Request for Comment (RFC), specif ic ally RFC 2058. ● Client/Ser ver Model – A Network Acces s Server (NAS) opera tes as a client of RADIUS. The client is[...]

RADIUS/ACE S ervices Issue 4 May 2005 127 Use this as my: - Select the rol e you wish this server to pe rform: Primary Ser ver , Secondary Serve r , or T ertiary Serv er . T o add a RAD IUS server: 1. From the Content s column, select the secur ity gateway you want to configur e. 2. Clic k the Policie s tab to br ing i t to the front. 3. From the d[...]

Configuring remote access users 128 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 14. From the Sett ings options, use the f oll owing to configure the connec tion expirat io n times for th e server . ● RADIUS Attempt s . The number of times a RADIUS server is cont acted befor e fai lure is assumed and t he next RADIUS server is used.The de[...]

Issue 4 May 2005 129 Chapter 6: Configuring user gro up s The User Gr oup function i s used to setup and mai ntain logical group s in which t he individual VPN users reside. User group s have a single-leve l hi erarchy - you cannot have a user grou p within another user group. A User Group Object is a meth od for si multane ously managing many user[...]

Configuring user groups 130 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 User Gr oup - Ge ne ral tab The User Gr oup General t ab is us ed to manage y our users a nd their respective user group assi gnm e nts. Figure 43: User Group, General t ab All existin g user groups are di splayed in the Content s list. The hig hlighted user gr oup is [...]

User Group - Actions tab Issue 4 May 2005 131 User Grou p - Actions t ab The Actions t ab i s used to control authenti cation for speci fi c user groups. Figure 44: User Group, Actions T ab User/Manager aut henticatio n - Rekey is used to change the key of the highlighted user group. Y ou should cha nge the key regularly to ensure maximum secu rity[...]

Configuring user groups 132 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 4. Use the General t ab to populate the group with speci fic users. ● From the A vailable Users colu mn, select one or more user s. T o select multi pl e users which are listed adj acent ly , hold the SHIFT key . T o select multiple users which are not adjacentl y li[...]

Issue 4 May 2005 133 Chapter 7: Configuring VPN object s A VPN object is the method used for link ing sec urity gateways, remote terminals, and LAN terminal s in a ful ly configure d virtual private ne twork. T o create a VPN, you name the VPN, select a key manage ment method, an d optionally , designate it as t he Default VPN. Afte r that you can [...]

Configuring VPN objects 134 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 IKE VPNs Note: Note: IKE VPNs are supported in VPNremote Cl ient 3.0 and later . An IKE VPN can run in c ertif icate or preshared secret authent ication mode . Als o, IKE VPNs always opera te in tunnel mode, which means the enti re origi nal packet ( header and p ayloa[...]

Default VPN policy Issue 4 May 2005 135 In tunnel mode (securit y gateways and VPNremote Client only) , IP packet s between members are secur ed by encrypt ing and aut henticating the entir e pa cket, incl uding the addressing header . The enc rypted and a uthenticat ed packet is th en used as t he payl oad of a n ew packet with a new addressing he[...]

Configuring VPN objects 136 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Creating a new VPN obj ect T o crea te a ne w V PN obje ct: 1. From the VPNmanager Console main wi ndow , click New Obje ct and sel ect VPN . The New VPN dialog is displayed. 2. In t he Name text box, type in a name for your new VPN Object. Any charact ers can be used,[...]

Cre ati ng a de sig nated VPN Issue 4 May 2005 137 9. On the LDAP server , a local server or an external server with a dif f erent context , add user . Enter the user cre dentials. 10. Log in to the secur it y gateway through the VPNremote clie nt usi ng the credential s enter ed in the RADIUS/LDAP server . The user should be authent icated success[...]

Configuring VPN objects 138 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Using the VPN t abs Aft er you have created a VPN object, you can use the VPN t abs to change the default sett ings or modify confi gurati on. The t ab s displ ayed are depen dent on the VPNos r ele ase for the dev ice . General tab The General t ab provides high-leve [...]

Using the VPN tabs Issue 4 May 2005 139 Enable VPN. - When this box is check ed and t he secur ity gat eway has been u pdated , t he VPN is active. Unchec kin g the box disabl es the VPN and is typically used during th e trou bleshooti ng process. Default VPN. - When this box i s checked, t his VPN is the defau lt VPN for the domai n. Only one VPN [...]

Configuring VPN objects 140 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Members-Users t ab The Members-Users t ab is used to establ ish the user membership of the VPN. A li st of cur rently assigned use rs appears in the Current VPN Members list. Use the right and lef t arrows to move the users to the desired col umn. Figure 46: VPN, Membe[...]

Using the VPN tabs Issue 4 May 2005 141 Figure 47: VPN, Members [I P Group s] T ab Security (IK E) t ab The Securi ty (IKE) tab is used for configur ing the en crypti on and authent ication algorith ms used at the end-point s of a VPN tunnel. The configur ation pr ocedure invo lves sett ing a li fetime f or public- keys, and a specific Diff ie- Hel[...]

Configuring VPN objects 142 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 In the ISAKMP (IKE) area you set up the key -exchange p arameters that you want us ed for t he VPN. Field Descript ion Encryption Algorit hm Select one of the fol lowing t ypes: ● DES. A common encryption algorithm that is not subject to export r egulations. ● 3DES[...]

Using the VPN tabs Issue 4 May 2005 143 Lifetime Payl oad key lifetime defi nes t he extent to which a single set of cryptogra phic keys is used when applyi ng VPN servic es to IP pa ckets. Li fetimes are either time based or based o n throughput. Time- based lifetimes are based on the amount of time that the keys are used without a key change. Thr[...]

Configuring VPN objects 144 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Pre-Shared Secret The Pre-Shar ed Secret area appears only when the VPN type is I KE with Pr eshared Secret selected. The preshared secret appears in the Secret field as either ASCII or hexadecimal. Select Modify Secret to change the preshared secret. Both the local an[...]

Using the VPN tabs Issue 4 May 2005 145 LZS. - This refer s to Lempel-Ziv-S tac hardwar e date compression techni que used prior to encrypti on. Y es/No enables or disables it s use. AH/ESP . - This is the Authenticat ion Header (AH)/ Encaps ulation Se curity Pay load (ESP). I KE VPNs authenticat e IP packet s using either an ESP trail er as define[...]

Configuring VPN objects 146 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Add IPSec propos al Y ou can add up to four IPSec proposals.Y ou determine the encryption method, the authentic ation methods , how long a single set singl e set of c ryptographi c keys is used when applying VPN servi ces to IP packet s and the order thi s proposal is [...]

Using the VPN tabs Issue 4 May 2005 147 Lifetime Payload key li fetime defines the extent to whic h a singl e set of cryptogr aphi c keys is used when applying VPN services to IP pa cket s. Lif etimes are either ti me based or based on throughput. Ti me-based lifeti mes are based on the amount of time that the keys are used without a key change. Th[...]

Configuring VPN objects 148 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Actions t ab The Action s tab is used t o export the VPN (wit hout keys) and to cha nge the VPN sec urity key (Rekey). Figure 49: VPN, Actions t ab VPN configuration Export Export s t he VPN to anot her VPN domain wit hout the keys . T ypic ally u sed t o create an ext[...]

Adva nced VP N ta b Issue 4 May 2005 149 Rekey site-to-site VPN Rekey Used to change t he preshare d secret key of a site -to-sit e VPN. This should be done regularl y to ensure maximum securi ty . Only SKIP a nd Preshared Sec ret IKE VPNs can be manually rekeyed. I n the case of SKIP , rekeying gener ates and distribute s a new master key to all s[...]

Configuring VPN objects 150 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 In the Exchange area, check Use Aggressive mode f or client s to enable the IKE Aggressi ve mode between a user an d then securit y gateway , which acc omplishes the s ame goals as Main mode, only faster . Note: Note: Aggressive mode must be us ed when Preshar ed Secre[...]

Configuring a SKIP VPN Issue 4 May 2005 151 7. If yo u want t o add User Object s or User Group Obje cts as members o f this VPN Object, do the follo wing. ● Click t he Members-Users t ab t o brin g it to the fro nt. ● From the A vailable list, sel ect specific User Objects and User Group Objects. User Group Object s are always lo cated at t he[...]

Configuring VPN objects 152 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Configuring an IKE VPN Note: Note: securi ty gateways at each en d of a t unnel must us e the same I KE setting s. T o configure a new IKE VPN Object: 1. Move to the Config uration Console window . 2. From t he Icon to olbar , click VPN to list all VPN Object s in the [...]

Configuring an IKE VPN Issue 4 May 2005 153 ● Select 3DES to divi de VPN traff ic i nto 64 bit blocks and encry pt each bl ock three times with three di f ferent keys. 12. Use the Authenticat ion Algorithm list to select a specific type of algori thm that each securit y gateway must use to authenticate each ot her . ● Select Any if you want the[...]

Configuring VPN objects 154 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 22. Perfect Forwar d Se crec y (PFS) is a key-creati on method used for assur ing that a new key is not relat ed to any previous keys. This is done by using key creation val ues which are independent of p ast values. ● Select Ye s to use PFS. ● Select No to not use[...]

Configuring an IKE VPN Issue 4 May 2005 155 ● From the Aut hentication drop-do wn list, select the type of auth enticatio n to use. ● None . Packet s are not authenticated. ● HMAC-MD5 . Packet s are au thenticate d using the Hash-base d Message Authentic ation Code (HMAC) couple d with t he Message Digest 5 (MD5) hash function. ● HMAC-SHA .[...]

Configuring VPN objects 156 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Enablin g CRL check ing For cert ificat e-based VPNs using IKE negotiat ion, a s ecurity gateway must ve rify t he other certif icate of the VSU. When Certif i cation Revocati on List (CRL) Checking is enabl ed, the VSU validat es the certificate revoc ation list downl[...]

Enablin g CRL checking Issue 4 May 2005 157 1 1. Import the crl.ld if file by opening the Net scape Console l ogin dialog box. ● Solaris OS: In th e server root, enter ./ st artconsole . ● Windows NT : From the windows T askbar , click St art/ Programs/Net scape Server Family/Net scape Console . 12. In t he User ID text box, type in the Adminis[...]

Configuring VPN objects 158 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 If th e Directory Ser ver has be en updated usi ng a new CRL, the ca ched CRL must be manually removed from the VSU console. T o remove the CRL from the VSU: 1. From the VSU Console, ent er 3 for the Utili t ies menu. 2. From the Utiliti es menu, en ter 18 to Show CRL [...]

Exporti ng a VPN obj ect to an extranet Issue 4 May 2005 159 Figure 51: Exporting a VPN Object t o an Extranet VPN Object export checklist Ta b l e 9 list s what to do befo re you export a VPN Object. The terms use d by Figure 5 1 are used for orient ati on. IP Group Object A Domain A IP Gr oup Obje ct B VPN O bjec t A Device Objec t A Extrane t De[...]

Configuring VPN objects 160 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Export pro cedure Exporting a VPN Object i nvolves copying the object da t a to a file, then sendi ng the file to the extranet admi nistrator , who will import the file into their VPN Domain. T o export a VPN Object: 1. Move to the Config uration Console window . 2. Fr[...]

Importing a VPN ob ject from an extran et Issue 4 May 2005 161 10. Clic k OK to open the Save dialog. 1 1. Use the controls in the Save dialog to selec t a locati on for the VPN Object data file . 12. In the File name text box, type in a name for the file, and use VPN as the file name extension. 13. Clic k Save to c reate the file. Y ou can now del[...]

Configuring VPN objects 162 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Rekeying a VPN object Use the Rekey command to cr eate a new k ey that SKI P VPN tunnel end point s (securi ty gateways and VPNremote Clie nt s) must use for encr yption t asks. T o rekey a SKIP V PN Object: 1. Open the Configurati on Console window . 2. From t he Icon[...]

Issue 4 May 2005 163 Chapter 8: Est ablishing security This chapter desc ribes the VPNmanager security measures you can configure to est ablish a secure domain. In cluded in this chapt er is how to set up the following : ● Firewa ll rules set up (4. 2 and lat er) ● Denial of Se rvice (4. X) ● Services ● V oice Over IP controls ( 4.X only) ?[...]

Establishing security 164 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 52: Firewall t ab At the domain level , fi re wall poli cy management allows the network administ rator to set rules across the domain. These rules are refer red to as domai n level firewall rul es. These rules can be applied to all, or some of the devices in th e[...]

Firewall r ules set up Issue 4 May 2005 165 Y o u se l ect Vi ew>Firewall to add domain firewal l rul es. Y ou can apply common rules to all or some of the dev ic es withi n t he domain when f irewal l rul es are add ed at the domain lev el. When firewall r ules are applied at t he domain level, they c an be applied to several devices at the sam[...]

Establishing security 166 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Note: Note: Altho ugh UDP is con necti onless, if a pa cket is firs t sent out from a given port, a reply i s expected in the r everse dir ection on t he same por t. Keep St ate “remembers” th e port and ensur es that the replying p acket enters i n the same port. 14[...]

Firewall r ules set up Issue 4 May 2005 167 12. If the fil t er rule set for the intended traf fic is also to be applied to the reply p acket s, select Keep St ate . This function can be applied to TCP , UDP , and ICMP packet s. 13. If you want to change the defa ult time-out se tt ings for the TCP st ate, UDP state, or ICMP stat e, click Advanced [...]

Establishing security 168 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Active-FT P is beneficial to the FTP server admini strator , but detriment al to the cli ent side adman. If the FTP server attempt s to make connections to ra ndom high ports on the cl i ent, these p acket s would al most cert ainly b e blocked b y a fi rewall on t he cl[...]

Firewall r ules set up Issue 4 May 2005 169 FTP-Proxy doe s have some issues when operating wit hin a NA T gateway . A protected FTP server must have a r outabl e address, and the rou ter on t he unprotect ed side of the gateway must have st ati c route to it the securi ty gateway i nterface address i s the rout e. Because t his is a proxy appl ica[...]

Establishing security 170 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Predefined te mplates The predefi ned templat es can be us ed as a basi s for u ser-defined templates, however; t he predefine d templates cannot be modified. For det ailed informati on regardin g the predefi ned templates, see Firewa ll r ules temp late on page 2 97 . F[...]

Firewall r ules set up Issue 4 May 2005 171 5. Select T emplate , Device , or None . 6. Clic k Apply . 7. T o creat e a user-defined firewal l template, type in a name for your new firewal l template, otherwise cli ck Cancel . 8. Confirm t hat the c orrect use r-defined fi rewall template i s selected in the Contents column. 9. Clic k Add to open t[...]

Establishing security 172 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 22. For maximum f lexibil ity and capabil ity , t he firewal l rules c an be spe cified on each inte rface: Public, Privat e, or T unnel. The p acket s are checked against the fi r ewall rules at th e interf ace where they are defined. 23. Select t he Directi on fro m th[...]

Devic e Group Issue 4 May 2005 173 The predefin ed services can be use d as a general se rvi ce set or as a st arting po int for creati ng a customized servi ce, or user-def ined service, that is required for use in the firewall d efi nition. The service t ypes IP , TCP , UDP , and ICMP are provided and p arameters for eac h of these types can be s[...]

Establishing security 174 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 The security gateway object s Denial of Service tab is used to change the set tings for speci fi c devices. Changing the setti ngs here overr ides the domain level s etti ngs for that category . When devices ar e updated, the DOS cat egories at the device level an d the [...]

Voice Ove r IP Issue 4 May 2005 175 WinNuke Att ack. - This att ack attempt s to compl etely disable networ king on computers that are runnin g Windows 95 or Windows NT . This att ack can be swif t and cri ppl ing because i t us es common Microsof t NetBIOS serv ice s. WinNuke att acks ports 135 to port 139 on platf orms tha t are based on Windows [...]

Establishing security 176 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 When using t he IP T runking Call Model, configure t he following: ● Service Port . The port to which the gatekeeper sends call -signaling messages. ● Source T runk Zone. The zone where the gatekeeper is located with r espect to the SG (e.g. “privat e” when the g[...]

Voice Ove r IP Issue 4 May 2005 177 6. Select LRQ Required to enable t he location request. When learn reques t (LRQ) is enabled, the voic e packet s ar e routed us ing domain names. The secur ity gateway uses LRQ to locate the dest ina tion and returns the appropr iate IP address to rou te the voice pac ket to the corr ect desti nation. ! Import a[...]

Establishing security 178 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 56: V oice ove r IP t ab Using the Gatekee per Routed Call Mo del The Gatekeeper Routed cal l model shou ld be used when there is an SG in the network path between IP end point s (e.g. I P har d phones and IP sof t phones) and t he Gatekeeper wit h whi ch those IP[...]

Voice Ove r IP Issue 4 May 2005 179 Add gatekeeper set tings When you add a gatekeeper , you include the gatekeeper name or IP address, the lo cation of the gatekeeper wi th respect to the firewal l, the regis tr ation, authent i cation, sta tus protocol, and time-out. Cli ck Add to configure gate keeper settings for th e V oIP configuration. Only [...]

Establishing security 180 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Note: Note: If the network object d oes not exi st, cancel the config uratio n and create one. 8. Clic k Next . The Gatek eeper(s) dial og appears. ● In the Zone field, select t he zone which the desti nation end point s are c onnected to. For example, i f the en dpoin[...]

QoS policy and QoS mapping Issue 4 May 2005 181 Therefore, it is not necessary to creat e a class for all oth er traf fic. If 0% is alloc ated, the class is removed from the exist ing configurati on. Note: Note: When the media inte rface is configured , the tot al upstre am bandwidt h can be specifi ed in Medi a Settings and this setti ng i s parti[...]

Establishing security 182 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Note: Note: It is not recommended to as sign simi lar t raf f ic i n dif ferent classes. Example: One class co ntaining any FTP and another class contai ning “ANY T CP”. This would be ambiguous because “ANT+YTCP” woul d incl ude FTP also . Similar cases might cau[...]

QoS policy and QoS mapping Issue 4 May 2005 183 Figure 59: Modify QoS bandwid th. burst and DSCP value screen 4. Configure bandwi dth, bur st and DSCP values. ● Enter the percent age of bandwid th to be allocat ed for this type. When classes are configure d, it is re commended that the sum tot al al location of al l th e classes be less th an 98%[...]

Establishing security 184 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 QoS map ping QoS Mapping is the mapping of a QoS policy to a zone. A zone can map to only one QoS policy , but a QoS policy can be applied to multiple zones. When you map QoS policies consider the fol lowing: ● If QoS is configured over multipl e interfaces, the DSCP v[...]

Packet Fi ltering Issue 4 May 2005 185 What can be filtered Ta b l e 1 0 list s the specifi c types of traf fic that can b e filt ered. Packet Filtering and NA T Network address tr anslation (NA T) and p acket filt ering ser vices can be run simult aneously . Depending on th e direct ion of the traf fic, t he VSU automatical ly determin es which se[...]

Establishing security 186 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 60: Policy Manager , Packet Filteri ng/QoS Clicki ng on the Edi t or Add but tons launche s a Packe t Filteri ng Policy Wizard that guides y ou through c onfigurati on of th e desir ed packe t filt ering. Advanced The Advanced tab acc esses specific types of filte[...]

Packet Fi ltering Issue 4 May 2005 187 Note: Note: This mode should be used when the VSU is dedicated to VPN traf fic and is in pa ral lel with another devi ce (such as a router or fi rewal l) that can resolve ARPs from the priva te networ k to the Internet gateway . This mode should not be used when the VSU is the o nly p ath bet ween network d ev[...]

Establishing security 188 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 T raffic T ype - The fields and drop-down lis ts in this secti on change accordi ng to the IP Protocol type select ed. Dependi ng on the traf f ic type selected (user -defined TCP and user-define d UDP), Source and Destina tion field s appear to col lect additiona l para[...]

Packet Fi ltering Issue 4 May 2005 189 T o Where ● T ype . Net workMask Pair or Any . ● IP Ne two r k M a sk P a ir . Identify the sour ce IP address to which the fi lter rule appli es. The Filtering Policy in progress This area present s a dynamicall y updat ed summary of the filter p arameters based on the current sel ection s. ● Inte rface[...]

Establishing security 190 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Note: Note: As you build your poli cy , its p arameters populate the “Filter ing Policy in Progress” text box , which i s loca ted at t he bottom of the wiza rd. 7. If you want to make a note about thi s poli cy , in the Memo text box, type in a note. 8. From the IP [...]

Packet Fi ltering Issue 4 May 2005 191 Note: Note: A pack et is filtered agai nst the ACL policies defi ned in the ACL list in the lis t order . The p acket i s matched against polic y nu mber 1 fir st, t hen policy number 2, then policy number 3, and so on until the packet fi nds a match or it exhaust s the list. If a ma tch is f ound, the VSU app[...]

Establishing security 192 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 4. From the dr op-do wn li st , select Packet Filteri ng , then click GO to open t he Pol icy Mana ger for P ack et Fi lterin g . 5. Clic k Advanced to open the Packet Filte r Rule-Advanced di alog box. 6. Use T able 12 for determini ng which option you want. 7. Clic k O[...]

Packet Fi ltering Issue 4 May 2005 193 About Differentiated Servi ces IP p ackets move from rou ter to r out er by usi ng Routing and Pack et Forwar ding proces ses. The routing pro cess involves buildi ng and maint aini ng a routing ta ble. The packet for warding process inv olves comp aring the destinati on address of a p acket wi th entrie s in [...]

Establishing security 194 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 T ypes of m arking rule s T wo kinds of packet mark ing rules can be created. ● A rule can b e made to exami ne the T oS field of a header and copy t he e xisti ng mark to the TO S field of t he new packet, which is entering or exiti ng the VSU. This is known as inheri[...]

Packet Fi ltering Issue 4 May 2005 195 6. From the Action drop-down l ist, s elect Permit to act ivate the QoS Mark drop-down l ist. Note: Note: As you build your Pa cket Marking Rule, it s paramet ers populate the “Filter ing Policy in Prog ress” text box, which is located at the bottom of the wizard . 7. From the QoS Mark drop-down list , do [...]

Establishing security 196 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 9. Continue us ing any remaining cont rols in the wizard t o complete your new rul e. 10. Clic k Finished to return the Policy Manager f or Packet Fi ltering window . 1 1. Y our new rule appears in the Access Control List. 12. Clic k Save to save your w o rk . Packet fil[...]

Packet Fi ltering Issue 4 May 2005 197 T o use the firewall policy management: 1. Move to the Configurat ion Consol e window . 2. From the Con tents column, sel ect the securi ty gateway t hat the po licy is ap plied. 3. Clic k the Poli cies tab to br ing it to the front. 4. Select Fi rewall from the Polici es drop -down list. 5. Clic k Go to open [...]

Establishing security 198 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 17. The keep state function allo ws a rule set for th e intended traf fic to also be applied to the reply p acket s. The f unction can be applied t o TCP , UDP , and ICMP p acket s. 18. Keep state set s up a state t able with each ent ry set up by the sending side. Reply[...]

Issue 4 May 2005 199 Chapter 9: Using ad vanced fea tures This chapter explai ns about t he adv anced funct ions of VPNmanager . The followi ng t abs c an be used to c onfigure a dvanced funct ions for domains and f or securi ty gateways: ● Device Advanced ● TEP Policy ● Servers ● Resilien t T unnel ● Failover TEP ● Advanced Action ● [...]

Using ad vanced fe atures 200 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 ● VPNos 4.4 includes MTU Path Discovery , NA T T raversal, and Port for Dyna Pol icy Download ● VPNos 4.5 includes Path MTU Discovery , NA T T raversal, and Port for Dyna Pol icy Download Note: Note: The Pri vate IP Address and t he local DHCP server IP addr ess [...]

Device Ad vanced Issue 4 May 2005 201 Examples of traf fic desti ned for the private networ k are: ● Decap sulated IPSec packet s desti ned for t he private ne twork. ● SNMP Get Responses being sent to a VPNmanager console residi ng on the pri vate side of the VSU ● T rap s sent to a VPNmanager console res idi ng on the pri vate side of the V[...]

Using ad vanced fe atures 202 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 As a p acket is routed through di ff erent networ ks, it may be necessar y for a router to divide the pa cket into smaller pieces becaus e it might be too large to transmi t as a single pac ket on a dif ferent network. This may occur at the int erfaces of physical ly[...]

Device Ad vanced Issue 4 May 2005 203 6. In t he Fragment ation Contr ol f or Encap sulated VPN T raffic a rea, selec t the appropri ate Do Not Fragment (DF) bit pr operty . Note: Note: If DF bit i s set in th e IP header , the p ack et would not be f ragmented fu rt her down the networ k pat h. ● Copy DF bit from the so urce p acket. If this pro[...]

Using ad vanced fe atures 204 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Port for dyna-p olicy down load If a VSU is configur ed to recei ve dyna-policie s from a remote server instead of st oring them locall y , it uses a specific port for lis teni ng to the remote server . The port uses the Secur e Socket s Layer (SSL) for pr otection, [...]

Device Ad vanced Issue 4 May 2005 205 A typical use of th e private IP address i s when the VSU’ s private side IP netwo rk i s a diffe rent network ( dif ferent network number and/or mask) fr om the VSU’ s public side IP network. For example, when you deploy the VSU in par allel with a fir e wall or other access devic e. If you are using the V[...]

Using ad vanced fe atures 206 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 ● Send VSU(s) names that are involved in CCD only . Select this option i f you want th e remote cli ent to query only t hose VSUs that are perf orming Dyna-Pol icy ser vices. This is useful i f a domain co nta ins many VSUs that are not used for a uthenticat ing re[...]

Device Ad vanced Issue 4 May 2005 207 Note: Note: The VSU det ermi nes what type of authent ica tion it per mits, but this i s de pendent upon the a uthenticat ion polic y last downloa ded from VPNman ager (SuperUser Password OFF or ON). Remember that if you set the SuperUser Passwor d to OFF you are no long er abl e to connec t t o the VSU usi ng [...]

Using ad vanced fe atures 208 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 63: VSU T unnel Persisten ce Figure 64 , il lustrat e s tunnel pers istence between SGs and remote users (RUser). The addition of SG D to VPN 2 (SG A , SG C , SG D , and Remote User) interrupt s tunnel per sistence in VPN 2 , thus brea king the r emote conn ec[...]

TEP Policy Issue 4 May 2005 209 TEP Policy The T unnel End Point (TEP) Policy tab provi des control of the securi ty policy applied to the traf fic that fl ows between the end point s of a tunnel . The default is of f, or Do not apply configur ed VPN policies to TEP traf fic. Figure 65: T unnel End Point Poli cy Enabling apply confi gured VPN polic[...]

Using ad vanced fe atures 210 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Servers The Servers t ab is used for adding backup di rectory s ervers to a speci fic sec urity gat eway . There is no pra ctical li mit on how many backup s you ca n configur e. Backup ser vers can be added at anyt ime, a nd they can be organize d so that when one f[...]

Server s Issue 4 May 2005 211 T o crea te a back up se rver : 1. Move to the Config uration Console window . 2. From the Device>Content s column, select the secu ri ty gateway that needs to have the backup server . 3. Clic k the Director y Servers t ab to bring it to the f ront. 4. Clic k Add to open the Add Directo ry Server dialog box. 5. Use [...]

Using ad vanced fe atures 212 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 4. From the Servers list, select a specific secondary end- point. 5. Use T able 16 for perfor ming specif ic managemen t ta sks. When finished, cli ck Save to save your work. Resilient T unnel T unnels are used to pr otect VPN traf fic that moves through the public n[...]

Resilient Tunnel Issue 4 May 2005 213 Figure 67: Primary and Resilient T unnels T unnel Switchin g The switching mechanism involves time and a packet called a Heartbeat . Figure 68 illu stra tes how tunnels are s witched. Figure 68: T unnel Swi tching Explanation f or Figure 68 1. VSU A listens to VSU B ’ s heartbea t. The heartbeat has a confi g[...]

Using ad vanced fe atures 214 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 6. Af t er VSU A establishes a connecti on with VSU C , the r esilient tunnel is used for VPN traf fic. 7. On a per iodic basis, VSU A continues to request a heartbeat fr om VSU B . The period is called Dead Primary Poll I nterval . 8. If VSU A reconnect s with VSU B[...]

Resilient Tunnel Issue 4 May 2005 215 Add resilient tu nn el There are four p arameter s associ ated with Resilien t T unnel auto mat i c backup mode. They are: ● Heartbeat Int erval The time, in seconds , between hear tbeat requ est attempt s made by the r emote securi ty gateway to the primary secur ity gateway . Default is 10 seconds. ● Hear[...]

Using ad vanced fe atures 216 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 7. From the Properties list, cl ic k on Heartbeat Inter val so the heartbeat int erval values appears. ● In the Heartbeat Interval drop-down list, select a unit of ti me. ● In the Heartbeat Interval tex t box, type in a duration that defines the period of the pri[...]

Resilient Tunnel Issue 4 May 2005 217 5. Y ou can edit , move u p, move down or delete. 6. When finished, click Save to save your work. S toppin g and st arting resilient tunn el services Resilie nt tunnel se rvices for a specific primary end-poi nt or secondary end-point can be stopped or st arted at any time . Primary end-point service T o stop o[...]

Using ad vanced fe atures 218 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Failover TEP Failover TEP is use d to prot ect site-t o-si te VPN traf fic that moves thr ough the public networks. The endpoi nt s for tunnel s are located in SGs. Up t o four head-end devi ces can be confi gured to backup a specific secur ity gateway . Upon complet[...]

Advanced Act ion Issue 4 May 2005 219 Configuring failo ver TEP Failover TEP is confi gure d from the Failover TEP t ab. T o configure failover TEP: 1. Move to the Config uration Console window . The Device tabs are dis played. 2. From the Device>Content s column, select the device tha t is operating as the head- end device. 3. Clic k the Failov[...]

Using ad vanced fe atures 220 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 71: Advanced Action t ab Switch Flash Switch flash is used to swi tc h the flash chip from which the securit y gate way is executing it s NOS. Normally , a duplicat e image of t he NOS is loaded into the second flash bank, however , a new or pre vio us NOS i m[...]

High Availabilit y Issue 4 May 2005 221 High A vailabili ty This t ab provides access to the High A vailabil i ty (HA) functions for the secur ity gateway including e nabling hi gh availabi lity , set ting th e public and pr ivate vir tual addres ses, adding securit y gateway members to the HA group, viewing the st atus of the HA group, conve rt in[...]

Using ad vanced fe atures 222 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 T o configure the security gateway to deny all non-VPN traffic through the VPNmana ger: 1. Move to the Config uration Console window . Sele ct Devi ces . 2. From the Device>Content s column, sel ect the securit y ga teway you want to configure. 3. Clic k the Poli [...]

High Availabilit y Issue 4 May 2005 223 member is down and wi ll force t he elect ion to become th e act ive membe r . The value for mis sed advertis e ment rang es from 3 to 16. Group ID. - The Group ID allows configur ation of a uni que identifi er f or the HA group. By usi ng the Group ID, the HA group avoids confli cts wi th other VRRP implemen[...]

Using ad vanced fe atures 224 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 By selectin g the member in the table, the f oll owing actions can be perf ormed: ● Edit - This action al lows the member to be edited. ● Up date - Thi s action allows t he selected member config uration t o be upda ted. If you suspect that a pa ss ive member doe[...]

High Availabilit y Issue 4 May 2005 225 Note: Note: V irtual Addresses must be valid routabl e addresses. 6. Clic k the Add butt on to add members t o the HA gr oup. 7. Enter th e private IP addresses of the Active secu rity gateway . 8. The priv ate IP address may have been entered duri ng the initia l creation of the security gateway obj ect. If [...]

Using ad vanced fe atures 226 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 5. Clic k the Enable High A vail ability check box to d isable Hig h Availa bility o n th e re maining securit y gateway . 6. Clic k Up date Devices from the Con fi gura tion Console . Click OK to complete updat e. Failover Use the Failover object to configure up to [...]

Failover Issue 4 May 2005 227 Note: Note: If the public-b ackup inter face idl e timer is disabled, the securi ty gateway continues to use the alternate network int erface. Network pa th failure i s defined as the configu red number of co nsecut ive connectiv it y checks without a response f rom the number of host s that nee d to fai l. The fo llow[...]

Using ad vanced fe atures 228 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 4. Select Get IP List for DN S Nam es so that when a DNS query is made, the security gateway keep s all the IP addresses tha t are re turned in the cache. The secur ity gateway attempt s to respond to the queri es in the same order that the quer ies were received. If[...]

Failover Issue 4 May 2005 229 10. In t he Host s field, cl i c k Add , to enter the networ k host or host s for whi ch you want to monitor connectivity . Y ou can define up to fiv e DNS names or IP addresses. These ho sts can be ei ther wit hin the VPN or outsi de the VPN. If the h ost is wit hin the VPN, the host informat ion is encap sulated in t[...]

Using ad vanced fe atures 230 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 In previ ous r eleases of VPNos 4. x, a system r eboot would not res tor e t he original R TEP . ● Restore pr imary R TEP In the event of tunnel fai lover , restore the origi nal, primary re mote tunnel end point in eff ect follo wing a syst em reboot. Beginning wi[...]

Converged Network Analyze r Test Plug Issue 4 May 2005 231 T ypically , one CNA unit is configur ed in t he network operat ions center , and another CNA uni t i s configur ed in the corporate network. The CNA unit in the net work operations center (NOC) is used to s et up networ k topologies, configure network test s, and schedule network t ests. M[...]

Using ad vanced fe atures 232 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 ! Import ant: Important: When the default RTP tes t port value is modified, you mus t cr eate a new CNA service to use th e new RTP test dest i nation port. I f the secu rity gateway is configur ed to allow CNA traf fic, be sure to upd ate t he firewal l rule to us e[...]

Keep Alive Issue 4 May 2005 233 Figure 74: Keep alive t ab T o configure keep alive: 1. From the Con figuration Console window , select New Object>Keep Alive . Th e Keep ALive dialog is displayed. 2. In th e Keep Alive name te xt box, e nter a unique na me. Click Apply . Click Close to go to the Keep Alive t ab. 3. Clic k Enable to enable the ke[...]

Using ad vanced fe atures 234 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 8. In t he T racer oute Crit eria area, s elect Initiate T racerou te when cr iteria ar e met , and complete t he foll owing: a. In the Number of Failed Host s field, ent er the number of hosts fr om the configured keep alive host s that can fail to re cei ve keep al[...]

Policy Manager - My Cert ificates Issue 4 May 2005 235 Up to eight certificates can be stored in a VSU. During I KE negotiation, a VSU sends a specified certif icate to its target. Those other VSUs and client s are called ta rgets. Likewis e, the target that received a certif icate must di stribut e its [unique] certificat e to the sender to comple[...]

Using ad vanced fe atures 236 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 76: The Policy Manager for My Certificat es T o install a signed certif ic at e into a VSU: 1. From the Device>Content s column, sel e ct t he VSU that needs a Signed Certificat e. 2. Clic k the Policie s tab to br ing i t to the front. 3. From the drop-dow[...]

Policy Manager - My Cert ificates Issue 4 May 2005 237 Figure 77: An Example of a Signed Certificat e 1 1. Cut the signed certificate fr om whatever file the PKI System sent it in, then paste it to t he file you creat ed in S tep 6. Incl ude the head er and foot er . Note: Note: The alignme n t of the right side of the cer ti fi cate must be even ([...]

Using ad vanced fe atures 238 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 4. From the Main tain Ce rt ific a t e s list select t he certifi cate that you want the VPNmanager Console to use. 5. The defaul t VSU certi f icate is ident if ied by an asterisk in the MGR column. Although a specifi c cert ificate may have other t arget s , as ass[...]

Policy Manager - My Cert ificates Issue 4 May 2005 239 Figure 78: Issuer Certif icates Explanation f or Figure 78 : 1. A Certif icate Reques t from VSU A is sent to a PKI System to be sig ned. 2. The PKI uses the Certif ic ate Request to cr eate a Signed Certificate specific ally for VS U A . The Signed Cert ificate i s then stored on VSU A . 3. Ev[...]

Using ad vanced fe atures 240 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 79: An Example of an Issuer Certificat e 3. Cut the issuer certifi cate from whatev er file th e PKI system sent it in, then p aste it int o a text file. The file can have a DER or TXT file name extension. Note: Note: The alignme n t of the right side of the c[...]

Policy Manager - My Cert ificates Issue 4 May 2005 241 Abou t C erti fic ate Us age (Exc han ge ) Every cer tificate identifies its owner and con tains the owner’s public -key . T he concept of certif icate usag e is based on Owners and T argets . An owner sends its ce rt ificate t o a target , who then uses it to encr ypt any informat io n it se[...]

Using ad vanced fe atures 242 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 When a VSU recogni zes tha t an t arget wants t o communicate, the VSU uses the I KE Certificate Usage list to determine which bundl e to send to the tar get . The search always st art s at the top of the list , so it ’s important to put the most frequentl y used b[...]

Policy Manager - My Cert ificates Issue 4 May 2005 243 7. From the T arget T ype drop-down, select the ty pe of target for the certif i cate. ● IP Address. Selec t to show the Enter T arget Address text boxes. T ype in the address of any IKE comp atibl e device as a t arget. T ypicall y , this is a VSU. ● VPN. Select to show the Select T arget [...]

Using ad vanced fe atures 244 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7[...]

Issue 4 May 2005 245 Chapter 10: Monitoring your network This chapter desc ribes the real-t ime monitoring facil i ties that the VPNmanager applic ation provides. This i n cl udes the followi ng ● Using SNMP to monitor the device ● Syslog Servic es ● Using Monitor ● Monitoring al arms ● Report Wizard Using SNMP to mo nitor th e devi ce Th[...]

Monitoring your netwo rk 246 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 The trap s that are generated by the securi ty gateway are sent to the list of trap target s that are configur ed. The version of the tr ap that is sent is the same as the version of the SNMP Agent, that is, if the secur ity gateway is conf igured for SNMPv1 , a SNMPv[...]

Using SNMP to monitor the devi ce Issue 4 May 2005 247 T o add an SNMP T rap T arget for securit y gateway’ s running versions prior to VPNos 4 .2, do the f ollowing: 1. From the Contents col umn, select the securit y gate way you want to configure. 2. Clic k the SNMP t ab to bri ng it to the front . 3. In t he T rap Community text box, type in a[...]

Monitoring your netwo rk 248 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Note: Note: If your organi zat ion’ s security polic y dictat es that this traf fic be secur e, TEP Policy (in the Main Consol e Preferences t a b ) can be turned on to encrypt this traffic. For additi onal information about using t hird part y SNMP Manager , see Us[...]

Syslog S ervices Issue 4 May 2005 249 Add Syslog Policy The Add Syslog Policy screen all ows you to desi gnate the host to which sys log messages are sent by the selec ted security gateway or all devices. It also enables sysl og messages to be sent to the VPNmanager through a designated UDP port. ● Host s to rec eive log messages . Enter the name[...]

Monitoring your netwo rk 250 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 12. T ype in the foll owing command l ine to cr eate a direct ory for the sysl og file, its size li mit, protocol used, port number . ● If you want the size of th e log file to be li mit ed to a specific size, type in a specifi c si ze in kilobyt es, otherwise the 8[...]

Using Monitor Issue 4 May 2005 251 Device List For VPN Domain. - This drop-down menu allows you to select a specif ic domai n, or all domains to monitor . Select Device(s) . - A list of all a vailable network obj ects available for monitori ng. Y ou can select a singl e devi ce, or select all devi ces displayed. Select Monitori ng Group. - This win[...]

Monitoring your netwo rk 252 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 The followi ng t ables det ai l the individual enter prise MIB items in each of the monitori ng groups. T able 18: Log Group Par ameters Parameter Descript ion Log Index An integer ident i fying this row in the Log tabl e. T ime sysUpT ime value when thi s attac k occ[...]

Using Monitor Issue 4 May 2005 253 T able 20: ActiveSessions Parameters Parameter Descript ion ActiveSessions Name A VPNremote client name or a securit y gateway name as defined in VPNmanager . Length Length of th is ses sion in seconds . Original I P VPNremote client’ s or iginating I P address or remote securi ty gat eway IP address. Xlated IP [...]

Monitoring your netwo rk 254 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 T able 21: Address T able Parameters Parameter Descript ion Address T able Index The inter face on which this entry’ s equiva lence is ef fective. The interface iden tified by a p art icular val ue of this index is the same interf ace as ident ified by t he same va [...]

Using Monitor Issue 4 May 2005 255 Metric 3 An alternate routing me tr ic for this rou te. The semantics of t his metric are deter mined by the routing- prot ocol specified i n the route’ s ipRouteProt o value . If thi s metric is not u sed, its value s h ou l d be set to -1. Metric 4 An alternate routing me tr ic for this rou te. The semantics o[...]

Monitoring your netwo rk 256 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Route Prot o The routing mechanism via which thi s route was learned. Inc lusion of values for gat eway routing pro tocols is not intended t o imply that hosts should support those protocols. Enumerated values: 1. other 2. loca l 3. netmgmt 4. icmp 5. egp 6. ggp 7. he[...]

Using Monitor Issue 4 May 2005 257 Metric 5 An alternate routing me tr ic for this rou te. The semantics of t his metric are deter mined by the routing- prot ocol specified i n the route’ s ipRouteProt o value . If thi s metric is not u sed, its value s h ou l d be set to -1. Route Inf o A referen ce to MIB definiti ons specif ic to t he pa rticu[...]

Monitoring your netwo rk 258 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 No Match Out Number of outbound pa ckets that did not match any r ule. Thi s count i ncludes all non-rule- matching packet s, r egardless of whether the p acket s were ultimately p assed or blocked per the defa ult rul e. Pass Log I n Number of inboun d p ackets that [...]

Using Monitor Issue 4 May 2005 259 Packet s Logged In T otal number of inbound p acket s that should have been l ogged. This number incl udes pa cket s that matched f iltering rules decl a red using either the ‘l og opt ion’ or the ‘lo g acti on’. Packet s Logged Out T ot al number of outbound pack ets that shou ld have been l ogged. This n[...]

Monitoring your netwo rk 260 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Bad Frag Alloc Out Number of f ailed attempt s to allocate a Fragment t able entry for outbound p acket s. This occurs when a filter r ule is decl ared using the ‘keep fr ag’ opti on. A p acket s matchi ng this rule caus e a Fr agment t able entry to be allocat ed[...]

Using Monitor Issue 4 May 2005 261 Bad S t ate Alloc In Number of f ailed attempt s to allocated S tate tabl e entries for i nbound packet s. This occur s when a filter rule is declared using the ‘ keep stat e’ option. Packet s that match the rule cause a S tate tab le entry to be alloc a ted. This allows ex pected return pack ets t o bypas s o[...]

Monitoring your netwo rk 262 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Cache Hit Out Number of c ache hit s for inbound p ackets on this i nterface. Each outbound pac ket is examined to see if a p acket with identic al character istics exist s in the outbound cache for th is i nterface. If a match is found, th e resulting rul e match app[...]

Using Monitor Issue 4 May 2005 263 No Match Pass Out Number of ou tbound pa ckets for a gi ven interf ace which did not match any f iltering rule and were ultimately allowed t o p ass per t he interf ace’s default rule. No Match Block In Number of i nbound pa ckets for a gi ven interf ace which did not match any f iltering rule and were ult imate[...]

Monitoring your netwo rk 264 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 T able 25: Active Por t s Parameters Parameter/ Group Description Active Port s The number of acti ve port s on this secur ity gateway . T raffic Rate T able Group See T raffic Rate T abl e Pa ra m ete rs on page 26 4 . Overview S tat istics T a ble Group See Overview[...]

Using Monitor Issue 4 May 2005 265 KBit s From Port The average rat e (i n KBits per second ) at which p ackets have be en transmitted f rom this port over the las t <Summary Interval> seconds. KBit s T o Port The average rate (i n KBit s per second) at which p acket s have been received on t his port over the last < Su mmary Int erval>[...]

Monitoring your netwo rk 266 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 IP Header Length Errors The number of p ackets dropped on t his port because of an invali d IP header length. Address Map Discards The number of p acket s dropped because of IP Address Map errors. T able 28: Ethernet St ati stics T able Parameters Parameter Descript i[...]

Using Monitor Issue 4 May 2005 267 Define Custom The Define Cust om screen allows you t o define a custom monit oring group that only collect s the data you speci fy . Y ou select the desired MIB p ar ameters from the A vaila ble Data c olumn, then moving them into the Curr ent Data in Group column. All of the avai lable MIB-II and VPNet Enterpri s[...]

Monitoring your netwo rk 268 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Monitoring wizard (Presentation) The Monitor ing present ation sc reen is us ed to sel ect the di splay ty pe for the moni tored dat a. The update frequency is also indicated here. Present ation There are four typ es of present ations: ● Bar graph ● Line graph ●[...]

Monitoring alarms Issue 4 May 2005 269 This window provi des det ailed i nfor mation about the alarm incl uding a time stamp, the secur ity gateway generati ng the al arm, alarm definit ion, first and last occurrence. This window appear s even if it does not cont ain any content. The most recen t entry is at the top of the li st. ● Properties . T[...]

Monitoring your netwo rk 270 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Y ou can select to either ignore the alarm or take act ion on the alarm. If “T ake Actio n on Alarm” is checked, the User Defi ned Act ion Upon Alarm is executed. User Defined Action Upon Alarm. - Enter the name of the application t o be launched when any alar m i[...]

Report Wizard Issue 4 May 2005 271 The firs t Report wizard screen allows you to specify t he objects y ou wish to incl ude in the repor t. The avail able object s include: ● IP Group ● User ● User Group ● Device (secur ity gateway) ● VPN T o create a report using the report wizard: 1. Move to the Main Console. 2. Clic k Repor t to star t[...]

Monitoring your netwo rk 272 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Generating the report When you are satisfied wit h the report selections made, click on the Finished button to generate the report. The repor t window appears af ter a short pau se. If a hardcopy is desired, you may save the report as a PDF or html fil e, th en print [...]

Device diagnostics Issue 4 May 2005 273 Devi ce dia gnosti cs Beginning with VPNmanager 3.7, device spe cific d iagnostic report s can be retrieved from a securit y gateway ru nning VPNos 4.6 or hi gher The device diagnosti c capabil ity allows the network admi nis trator to run any of the available diagnosti c repor ts fr om a cent ral network man[...]

Monitoring your netwo rk 274 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Firewall S tate Shows informati on about each firewall rule configure d in the security gateway . Firewa ll Ti m e r s Shows firewall timer i nformation for the various IP protocols . Process Ta b l e Shows information about all user processes t hat are curr ently run[...]

Issue 4 May 2005 275 Chapter 1 1: Device management From the VPNmanager Console, you can manage a nd check that st atus of t he security gateways This chapt er descr ibes: ● Using the Management tab to chan ge administrat ive pa sswords an d set up SSH and T elnet to connect to a security gateway ● Using the Connecti vi ty tab to pin g the secu[...]

Device management 276 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Note: Note: T o restr ict access to host s or networks , Firewall ru les limit access fr om specific zones. See Appendix B: Firewall rules templat e on page 297 . T o set up SSH or T elnet 1. Move to the Config uration Console window . 2. From the Icon to ol bar , click Devi[...]

Using t he Connectiv ity tab Issue 4 May 2005 277 ● Root is the login name for the secur ity gateway administ rator . The root administrato r has full privi leges to config ure and maintai n a specific secur ity gateway network and user configur ation. ● Monitor is th e login name for an administrat or who can view the Inspect proper ti es and [...]

Device management 278 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 85: The Connectivity t ab for a securit y gateway Object T wo methods for testing the conn ectivity of a securi ty gateway are: ● Ping between the VPNmanager workst ation and a security gate way ● Proxy pi ng, which ha s been ini tiated by t he VPNmanager , from a[...]

Using the Device A ctions tab Issue 4 May 2005 279 T o dire ctly pin g a spec ific se curi ty gat eway: 1. Move to the Config uration Console window . 2. From the Content s column, select the secur ity gateway that you want to ping. 3. Clic k the Connectivi ty tab to bri ng it to the front. 4. Clic k Ping This Device to s tart the ping. 5. Infor m [...]

Device management 280 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 Figure 86: The Actions t ab for a security gateway Object Upda te Co nfig urati on When changes are made to a Device Object, use the Up date Conf igur ation button to send the changes from the serve r to a specific securi ty gat eway . Reset Device T ime Click Reset T ime to[...]

Using the Device A ctions tab Issue 4 May 2005 281 Re-setup Device Allows a complete r e-set up of the securit y gateway . This is normall y done when the secu rity gateway cr eated did n ot exist in the network, or when the s ecurity gateway has been replaced with a new unit. Import Device Configuration Y ou can use t he Import Device Confi gurati[...]

Device management 282 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 T o import configurat io n dat a for a device: 1. Select “ Devices” on the Configurat ion window in VPNmanager . 2. Select the devi ce fr om which configurati on dat a will be importe d. (If th e device entry does not yet exist i n VPNmanager , simply c reate a new devic[...]

Using the Device A ctions tab Issue 4 May 2005 283 100 Mbp s, Full Duplex. - This opt ion allows the VPNmanager to configu re the security gateway’ s Ethernet port speed to 100 Mbp s in full dupl ex mode. In full duplex mode, the Ethernet port is capable of s ending and r eceiving p acket s simult aneously over the network at 100 Mbps. 100 Mbp s,[...]

Device management 284 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 IPSec Engine St atus - The IPSec Engine S tat us section s hows the cur rent st ate of the VSU-1200’ s two pa cket processor engines (PPE) . If either PPE fails, a F AILED stat us is displayed indi cating which PPE failed. Bot h PPEs must be functi onal for the VSU-1200 to[...]

Importing and exporting VPN configur ations to a device Issue 4 May 2005 285 ● When creating an “al ien Group, ” which is a group that incl udes IP addr ess/mask p ai rs residin g within an importing admini strator’s network, the expor t ing administr ator associates each alien Gr oup with an extranet device. In the Group conf igurat ion , [...]

Device management 286 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 The Users file var i able pa ramet ers are: ● <Client _name> – The name of the Client as ent ered i n VPNmanager. Case and spelling are sign ificant. This paramet er is wr itten by VPNmanager. ● <authenti cation p assword> – T he response r equi red f rom[...]

Issue 4 May 2005 287 Chapter 12: Upgrading firmware and lic enses Y ou can upgrade the VPNos fi rmware and l icense from t he VPNmanager and set encr yption strength and remot e a ccess for VSU100s. Centralized firmwa re manage ment The VPNmanager centrali zed fi rmware management al lows you to upgrade the firmware for one or many securit y gat ew[...]

Upgrading firmware and licenses 288 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 ● Upgrade Options The upgrade options are: ● Skip devices tha t are up- to-date This option i s the defa ult settin g. The devices that up-t o-date will not display in the upgrade list. If a device should be downgraded, th is option must be unchecked to vie[...]

Devic e - Upgrad e tab Issue 4 May 2005 289 Figure 87: Device Upgrade t ab Upgrading a sec urity gateway’ s firmware Use the Upgrade Firmware but ton for upgrading th e firmware of a specific secu rity gateway . Before upgrad ing firmware from the VPNmanager , you must downl oad the latest f irmware from A vaya I nc. The securi ty gateway firmwar[...]

Upgrading firmware and licenses 290 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7 6. Double-cl ick the firmware zip file to begin extrac ti ng the VPNos image. The Password screen appears. 7. Enter th e password from tec hnical support . 8. Go to the VPNmanager Conso le, then mo ve to the Configurati on Console window . 9. Clic k Vi ew>De[...]

Devic e - Upgrad e tab Issue 4 May 2005 291 Use the Li cense button t o upload t he license s from the VPNmanager Console. Once you have rece ived the license file fr om your sales represent ative, upl oad the license file to the sec urity gatewa y as follows: 1. Save the license f il e to a dir e ct ory on the computer . 2. From the s ecurity gate[...]

Upgrading firmware and licenses 292 Avaya VPNmanage r Configu ration Gu ide Relea se 3.7[...]

Issue 4 May 2005 293 Appendix A: Using SSL with Directory Serv er As an added benefit, al l communi cations with the Direct or y Server can be secured by SSL (Secure Sock ets La yer) . In order to enable SSL, a Public Key Infrastr ucture (PKI) i s used for creat ing a signed certi ficate and an is suer’s ce rt ifi cate . Both signed cert ificates[...]

Using SSL with Directory Ser ver 294 Av aya VPNman ager Conf iguration G uide Relea se 3.7 Inst alling the issuer ’ s certifi cate in the p olicy server and the VPNmanager Console Inst alling a n Issuer’s Certifi cate into VPNmanager Consol e is done fr om the command li ne. The same Issuer’s Certifica te that was inst al led in the server ca[...]

Installin g the Iss uer’s Cer tificate i nto a sec urity gate way Issue 4 May 2005 295 Solaris OS Computers T o inst all a cert ificate in VPNmanage r Console: 1. Copy t he certif icate to t he opt/A vaya/VPNmanag er/Console dir ectory . 2. Open a Con sole window . 3. Move to the opt/ Avaya/VPNmanager /Console di rectory . 4. T ype in the foll ow[...]

Using SSL with Directory Ser ver 296 Av aya VPNman ager Conf iguration G uide Relea se 3.7 4. From the Issuer Certi ficates list, select a row where the new issuer cer tific ate wil l be inst alled. 5. Clic k Add to open the Open dialog box. 6. Use the Look in list for navigati ng to the location of the Is suer Certi ficate . 7. Select t he Issuer [...]

Issue 4 May 2005 297 Appendix B: Firewall rules template Gene ral The security gateway contai ns a powerfu l multi-layer inspection engi ne to provi de ext ensive filteri ng capab il i ties, essential for a full-ti me conne cti on to the Internet . Y ou can configure your own rules, but, as a convenien ce in setting up the Firewal l on the secur i [...]

Firewall rul es template 298 Av aya VPNman ager Conf iguration G uide Relea se 3.7 Medium Security . - Selecting medium secur it y enforces the same securi ty policy as high securit y for al l zones ex cept t he semi-pri vate zone. The semi-pr ivate zone with medium secu rity is trusted the same as the private zone. That is , the same secur ity pol[...]

Public zone f irewall templa tes Issue 4 May 2005 299 ● DNS from any IP to any ● Common services originat ing from all inter nal network s, priva te, DMZ, management and semi-p rivate. All ot her outgoing t raf fic is blocked. The medium security policy for the public zone is the same as that of the high securit y policy . The low securit y pol[...]

Firewall rul es template 300 Av aya VPNman ager Conf iguration G uide Relea se 3.7 OutBoundP ublicGenera lAccess Permi t Any Any ICMP ECHO REQUEST SSH/ TELN ET FTP-C TRL P ASSIV EFT P HTTP/ HTTPS DNS-TCP/ DNS-UDP NETBIOS- N S-TCP/UD P NETBIOS- D GM-T CP/ UDP NETBIOS- S SN-TCP / UDP POP3/ IMAP/SM TP NNTP Out Public Y es Permit traf fic with the serv[...]

Public zone f irewall templa tes Issue 4 May 2005 301 Rule Name Action Source Destination Service Direction Zone Keep Stat e Description InBoundPu blicAccess Perm it Any PublicIP IKE_IN IPSEC_NA T_T_IN AH/ES P ICMPDestUnreach In Public no Permit incoming VPN t raffic and ICMP unreachable pack et InBoundPu blictoDMZA ccess Permit Any D MZNet ICMPEch[...]

Firewall rul es template 302 Av aya VPNman ager Conf iguration G uide Relea se 3.7 T able 32: Public low sec urity fi rewall rul es Rule Name Action So u rce Destination Service Direc- tion Interface Keep Stat e InBoundPublicA ccess Permit Any PublicIP IKE_IN IPSEC_NA T_T_I N AH/ESP ICMPDestUnreach In Public no InBoundPublicto DMZAcces s Permit Any[...]

Private z one fire wall template s Issue 4 May 2005 303 Private zone fir e wall templates The private net work interfac e provides connection to the pr ivate/cor porate LAN. Privat e zones are considere d trusted networks and becau se of thi s mos t tr aff ic is allowed. The priv ate high s ecurity r ules are enforced f or both incomi ng and outgoi[...]

Firewall rul es template 304 Av aya VPNman ager Conf iguration G uide Relea se 3.7 The private medium secur ity rules and the low security rules are th e same as the private high securit y rules. T able 34: Private high security firewall rules Rule Name Action Sour ce Destinati on Ser vice D ire c tion Zone Keep Stat e Description InBoundPrivateT o[...]

Semi-priv ate zone fire wall template s Issue 4 May 2005 305 Semi-private zone fi rewa ll templ ates A semi-pr ivate networ k interfac e provides connection to a network whos e equipment c an be made physical ly sec ure, but whose medium is vul nerable t o att ack (suc h as a Wire less ne twork used withi n a corpor ation’ s Pri vate network i nf[...]

Firewall rul es template 306 Av aya VPNman ager Conf iguration G uide Relea se 3.7 ● The desti nation is Public and t he serv ices are FTP , SSH, T eln et, HTTP , HTTPS, POP3, IMAP , or ICMPechorequest . All other incomin g traf fic is blocked. Outgoing traf fic to the semi-private zone that i s all owed includes ● Any allowed traf fic from oth[...]

Semi-priv ate zone fire wall template s Issue 4 May 2005 307 OutBoundS emiPrivate VPNAcc es s Perm it SemiPriv ateIP PublicIP Any IKE _OUT IPSEC_NA T_T_OUT AH ESP ICM PDe st Unr ea ch Out SemiP rivate No Permit outgoing VPN tra ffi c. OutBoundS emiPrivate PermitAll Permit Any A ny Any Out Sem iP rivate Y es P ermit everyt hing with Keep state. (For[...]

Firewall rul es template 308 Av aya VPNman ager Conf iguration G uide Relea se 3.7 T able 39: Sem i-priv ate low security fire wa ll rules Rule Name Action Source Destination Service Direct ion Zone Keep State Descrip tion InBoundSem iPrivateDeny Access Deny Any Manageme ntNet Any In Semi Priv ate No Tr a f fi c to Management Net is denied. InBound[...]

DMZ zone firewa ll templates Issue 4 May 2005 309 DMZ zone firewa ll templates The Demili ta rized Z one ( DMZ) net work i nte rface i s typ ica lly u sed t o all ow Inter net users access to some corporate ser vices wit hout compromis ing the pr ivate network where sensi tive informat ion is stored. For al l the services setup i n the DMZ, access [...]

Firewall rul es template 310 Av aya VPNman ager Conf iguration G uide Relea se 3.7 OutBoundD MZAc cess Permit Any DMZNet ICMPECHOREQUE ST SSH/TEL NET FTP-CTRL P A SSIV EFTP HTTP/HTTP S DNS-TCP/DNS-UDP NETBIOS-NS-TCP/UDP NETBIOS-DGM-TCP/UDP NETB IOS- SSN-TC P/U DP POP3 /IMAP/ SMTP NNTP Out DMZ Y es Permit outgoing traf fic with common s ervices OutB[...]

Manag em en t zon e secur it y Issue 4 May 2005 311 Management zone security Management interface connec tion can be configur ed to si mpli fy network deployment s to eliminate en ter prise network depend encies on switches or router s. The Management zone is a trusted network si mil ar to the Private zone. Outgoi ng tr aff ic is allowed, bu t inco[...]

Firewall rul es template 312 Av aya VPNman ager Conf iguration G uide Relea se 3.7 The CNA template can be combined with any oth er preconfigur ed fi rewall template secur ity level - high , medium, low , or none. T able 44: Converged network analyzer fi rewall rules Rule Name Action Source Desti nation Service Di rect- ion Zone Kee p State InBound[...]

Issue 4 May 2005 313 Glossa ry A Aggressive mode An IKE mechanism used in the first phase of establishi ng a security associati on. Aggressive mode accomplishes the same authen tication negotiati ng goal bet ween client s as Main mode but fas ter (thr ee packet s v ersus six). AH/ESP In an IPSec p acket, the Authen tication Header ( AH) and Encapsu[...]

Certificate Au thority 314 Av aya VPNman ager Conf iguration G uide Relea se 3.7 Certificate Authority A trusted comp any or organizati on that serves as a reposi tory of digit al certif icates. Once a CA accept s your public key (wi th some othe r proof of identit y), othe rs can the n request v erificat ion of your public k ey . Cert ific ates Is[...]

Issu er C erti fic ates Issue 4 May 2005 315 Dynamic VPNs Dynamic VPNs are VPNs t hat can be readily s caled as dict ated b y business demands. As the remote client user population grows, the aut hent ication and session c onfigurati on infor mation for eac h new user must necessa rily also grow . By maint aini ng this i nformation not in the secur[...]

LAN 316 Av aya VPNman ager Conf iguration G uide Relea se 3.7 L LAN Local Area Network LDAP Lightweigh t Directory Acces s Prot ocol is a simplified version of th e standard X.500 distr ibut ed dir ectory model st andard. LDAP specif i es how a client accesses a director y server . LDAP has e merged as a favored prot ocol since i t also handles key[...]

Signing Certificates Issue 4 May 2005 317 O Oakley A key exchange prot ocol used in IPSec as part of the Inte rnet Key Exchange protocol . P Packet Filter Hardware or software mechani sm used in firewalls to di scar ds pack et s based on the co ntent s of the p acket headers. Perfect Fo rward Secrecy Perfec t Forward Secrecy defines a p arameter of[...]

SKIP 318 Av aya VPNman ager Conf iguration G uide Relea se 3.7 SKIP Simple Key-Management for Internet Protocol – SKIP di ff ers from ISAKMP in the area of negoti ation. In SKIP , all of the secur ity par amet er s are identifi ed within each SKIP secur ed p acket in the form of a SKIP header . The cryptogra phic algorithms defi ning the VPN serv[...]

Issue 4 May 2005 319 Ind ex Index Numerical 3DES . . . . . . . . . . . . . . . . . . . . . . . 142 A Acce ss Con trol Li st (A CL) , usi ng the . . . . . . . . 19 0 ACE/Server Acce ssManager . . . . . . . . . . . . 12 6 action tab, devic e . . . . . . . . . . . . . . . . . 279 Active V PN Sessions . . . . . . . . . . . . . . . . 24 7 ActiveSe ss io[...]

320 Av aya VPNman ager Con figuration Guide R elease 3.7 Index clients DNS resolut ion redirectio n . . . . . . . . . . . . 111 CNA enable . . . . . . . . . . . . . . . . . . . . . 23 1 compr essio n configu ring in an IKE VPN . . . . . . . . . . . . 15 3 how muc h can the LZS algorith m do . . . . . . . 15 3 compression (IPSEC) . . . . . . . . . .[...]

Issue 4 May 2005 321 Ind ex Extranet, (co nti nue d) IP Address text boxes . . . . . . . . . . . . . . 103 IP Group, confi guring an . . . . . . . . . . . . 10 2 IPSec Proposals , About . . . . . . . . . . . . . 15 4 support . . . . . . . . . . . . . . . . . . . . . 16 VSU . . . . . . . . . . . . . . . . . . . . . . 99 extranet , creating . . . . .[...]

322 Av aya VPNman ager Con figuration Guide R elease 3.7 Index IPSec engine st atu s . . . . . . . . . . . . . . . . 28 4 IPSec Proposals . . . . . . . . . . . . . . . . . . 14 5 ISAKMP . . . . . . . . . . . . . . . . . . . . . . 135 Issuer Ce rtifica tes, abou t . . . . . . . . . . . . . . 23 8 K Keep alive deta iled des cript ion . . . . . . . . [...]

Issue 4 May 2005 323 Ind ex Packet F owarding Beh avior, w hat is . . . . . . . . . 19 3 Packet M arking Ru le, creati ng a . . . . . . . . . . 19 4 packet mode . . . . . . . . . . . . . . . . . . . . 134 PAP . . . . . . . . . . . . . . . . . . . . . . . . 126 pas swor d configu ring fo r a specific User Obje ct (for Loc al Authentic ation) . . . .[...]

324 Av aya VPNman ager Con figuration Guide R elease 3.7 Index RADIUS, Settings . . . . . . . . . . . . . . . . . 12 5 RC5 as an IPSec encrypti on para me ter . . . . . . . 15 4 reboot . . . . . . . . . . . . . . . . . . . . . . . 28 0 redundan cy (VSU-1200 ) . . . . . . . . . . . . . . 283 Rekey User VPNs . . . . . . . . . . . . . . . . . 11 7 rek[...]

Issue 4 May 2005 325 Ind ex templat es, fir ewall . . . . . . . . . . . . . . . . . 297 TEP pol icy deta iled des cript ion . . . . . . . . . . . . . . . 20 9 termina l equipme nt to a VPN, a dding . . . . . . . . 97 Topolog y, VPN Acce ss Con trol One-arme d Remot e Tunnel o ption . . . . . . . . . . 84 ToS, markin g . . . . . . . . . . . . . . . [...]

326 Av aya VPNman ager Con figuration Guide R elease 3.7 Index X x . . . . . . . . . . . . . . . . . . . . . . . . . 16 9 Z zone, p ublic . . . . . . . . . . . . . . . . . . . . 68 zone, p ublic-bac kup . . . . . . . . . . . . . . . . 68 zones IP addressi ng . . . . . . . . . . . . . . . . . . 70 netw ork . . . . . . . . . . . . . . . . . . . . 67 [...]