HP Sa3110 - VPN Server Appliance User manual

Hewlett-Packard Company
HP: 5971-0873
P/N: A55307-001
March 2001
hewlett-packard vpn server
appliance sa3110/sa3150/
sa3400/sa3450
network layout reference guide

ii

iii
Disclaimer
DisclaimerDisclaimer
Disclaimer
Information in this document is provided in connection with
Hewlett-Packard Company products. No license, express or
implied, by estoppel or otherwise, to any intellectual property
rights is granted by this document. Except as provided in
Hewlett-Packard Company’s Terms and Conditions of Sale for
such products, Hewlett-Packard Company assumesno liability
whatsoever,and Hewlett-Packard Company disclaims any
express or implied warranty, relating to sale and/or use of
Hewlett-Packard Company products including liability or
warranties relating to fitness for a particular purpose,
merchantability, or infringement of any patent, copyright or
other intellectual property right. Hewlett-Packard Company
products are not intended for use in medical, life saving, or life
sustaining applications.
Hewlett-Packard Companymay make changes to specifications
and product descriptions at any time, without notice.
This
Hewlett-Packard VPN Server Appliance SA3110/SA3150/
SA3400/SA3450 Network Layout Reference Guide
, as well as
the software described in it is furnished underlicense and may
only be used or copied in accordance with the terms of the
license. The information in this manual is furnished for
informationaluse only, is subject to change without notice, and
should not be construed as a commitmentby Hewlett-Packard
Company.Hewlett-PackardCompanyassumesnoresponsibility
or liability for any errors or inaccuracies that may appear in this
document or any software that may be provided inassociation
with this document.
Except as permitted by such license, no part of this document
may be reproduced, stored in a retrieval system, or transmitted
inanyformorbyanymeanswithouttheexpresswrittenconsent
of Hewlett-Packard Company.
Copyright © Hewlett-Packard Company 2001.

iv

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide i
Contents
ContentsContents
Contents
HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network
HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 NetworkHP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network
HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network
Layout Reference Guide
Layout Reference GuideLayout Reference Guide
Layout Reference Guide
Network Layout Reference Guide . . .. . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Client Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Client Scenarios . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
One-Armed Router Configuration With No Firewall. . . . . . . . . . . . . . . . . . . . . . . . . 2
Inline Router Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
In Parallel With Firewall (Extranet or Intranet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Bridge Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Edge Router Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Behind a Firewall With or Without NAT (One-Armed) . . . . . . . . . . . . . . . . . . . . . 11
Behind a Firewall With or Without NAT (Inline) . . . . . . . . . . . . . . . . . . . . . . . . . . 13
The VPN Device as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
In Parallel With a Firewall (Without NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
In Parallel With a Firewall (With NAT). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Behind a Firewall (One-Armed) With or Without NAT . . . . . . . . . . . . . . . . . . . . . 21
Behind a Firewall That May or May Not Use NAT (Inline) . . . . . . . . . . . . . . . . . . 24
The VPN Device as a Firewall (With or Without NAT) . . . . . . . . . . . . . . . . . . . . . 27

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide 1
HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
1Network Layout Reference Guide
Network Layout Reference GuideNetwork Layout Reference Guide
Network Layout Reference Guide
The purpose of this Network Layout Reference Guide is to help
you install the HP VPN ServerAppliance SA3110/SA3150/
SA3400/SA3450in your network.The termVPN device isused in
this document to refer to all of these devices.
Here are some real-world examples of how the VPN device can
be incorporated into your network infrastructure. Skim through
the following scenarios and find the ones most similar to your
network configuration. Then, note the corresponding
configuration options to help you quickly install the VPN device
into your network.
Scenarios are divided into client and LAN-to-LAN.
Client Scenarios
Client ScenariosClient Scenarios
Client Scenarios • One-armed router configuration (VPN server) with no
firewall
• Inline router configuration
• In parallel with firewall (for extranet or intranet)
• Bridge configuration
• Edge router configuration
• Behind a firewall (one-armed) that may or may not use
network address translation (NAT)
• Behind a firewall (inline) that may or may not use NAT
• VPN device as a firewall
LAN-to-LAN
LAN-to-LANLAN-to-LAN
LAN-to-LAN
Scenarios
ScenariosScenarios
Scenarios • In parallel with a firewall and no NAT
• In parallel with a firewall with NAT
• Behind afirewall (one-armed) that mayor may not use NAT
• Behind a firewall (inline) that may or may not use NAT
• VPN device as a firewall (may or may notuse NAT)

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
Client Scenarios
Client ScenariosClient Scenarios
Client Scenarios
If you are using the VPN device with the HP SA3000 Series VPN
Client, skim the following scenarios and find the ones most
similar to your network configuration. Then, use the
corresponding table of configuration parameters as a guideline
when configuring your VPN device and VPN Client.
If you are using the VPN device in LAN-to-LAN configurations,
skip to the next section “LAN-to-LAN Scenarios.”
One-Armed
One-ArmedOne-Armed
One-Armed
Router
RouterRouter
Router
Configuration
ConfigurationConfiguration
Configuration
With No
With NoWith No
With No
Firewall
FirewallFirewall
Firewall
This scenario shows the following:
• One-armed configuration uses only one of the VPN device’s
two interfaces.
• Firewall is not enabled.
• The VPN device (VPND) acts as a VPN server.
Figure: One-Armed Configuration With No Firewall
Figure: One-Armed Configuration With No FirewallFigure: One-Armed Configuration With No Firewall
Figure: One-Armed Configuration With No Firewall
Configuring a One-Armed Router Configuration
Configuring a One-Armed Router ConfigurationConfiguring a One-Armed Router Configuration
Configuring a One-Armed Router Configuration
When setting up a VPN device, you must configure many global
configuration settings. You configure the VPN device through
the HP SA3000 Series VPN Manager or command shell.
Desktop
System
Desktop
System
Internal
Network
Internet Router
VPND
Internet
Connection
Direct
Dial
Laser Printer
PSTN
Router or Remote
Access Server
No Firewall
Functions
Router Mode
E0
VPN Client

Client Scenarios
Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 3
To set up a one-armed router configuration, use the
configuration parameters in the following table. Note that the
values of these parametersare examples only; you must enter
values specific to your network.
Table:
Table:Table:
Table: O
OO
One-Armed Router Configuration Parameters
ne-Armed Router Configuration Parametersne-Armed Router Configuration Parameters
ne-Armed Router Configuration Parameters
Inline Router
Inline RouterInline Router
Inline Router
Configuration
ConfigurationConfiguration
Configuration In this scenario, VPN Client traffic is handled either through a
router (inline) or by directly dialing into the public-switched
telephone network (PSTN).
• For inline router configurations:
— The router accepts all incoming client traffic then trans-
fers the traffic to the VPN device.
NAT by Router
NAT by RouterNAT by Router
NAT by Router No NAT
No NATNo NAT
No NAT
Interface E0:
IP: 10.250.128.2 255.255.255.0
Mode: Red
Interface E0:
IP: 205.25.128.2 255.255.255.0
Mode: Red
Interface E1: (not used for
one-armed)
IP: NA
Mode: NA
Interface E1: (not used for one-
armed)
IP: NA
Mode: NA
Configuration file entries/
routing info:
security profile remote user
remote tunnel johndoe
security-profile remote
user
client-ip 10.250.128.2
255.255.255.255
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
ip route 209.29.128.50
255.255.255.255 john doe
HP SA3000 Series VPN Client
IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no client IP)
Subnet: 10.250.128.0 (net-
include) Subnet: 205.25.128.0 (net-include)
ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
4 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
— The VPN device then transfers the traffic on to the local
network to which it is attached. The VPN device may or
may not perform firewall functions on the traffic.
• For direct dial into the PSTN:
— Traffic may go through a router or remote access server,
which may or may not perform NAT.
— The traffic then goes through the VPN device,which
may or may not perform firewall functions on the
traffic.
Figure: Inline Router Configuration
Figure: Inline Router ConfigurationFigure: Inline Router Configuration
Figure: Inline Router Configuration
Configuring an Inline Router Configuration
Configuring an Inline Router ConfigurationConfiguring an Inline Router Configuration
Configuring an Inline Router Configuration
When setting up a VPN device, you must configure many global
configuration settings. You configure the VPN device through
the VPN Manager or command shell.
To set up an inline router configuration, use the configuration
parameters in the following table. Note that the values of these
parameters are examples only; you must entervaluesspecific to
your network.
With/Without
Firewall
Functions
Internet Router
Internet Connection
Direct Dial
VPND
Desktop
System
File Server
Laser Printer
PSTN
May/May Not NAT
Router Mode
Internal
Network
E0
E1
Router or
Remote Access Server
VPN Client

Client Scenarios
Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 5
Table:
Table:Table:
Table:
Inline Router Configuration Parameters
Inline Router Configuration ParametersInline Router Configuration Parameters
Inline Router Configuration Parameters
In Parallel With
In Parallel WithIn Parallel With
In Parallel With
Firewall
FirewallFirewall
Firewall
(Extranet or
(Extranet or(Extranet or
(Extranet or
Intranet)
Intranet)Intranet)
Intranet)
In this scenario, VPN Client traffic is handled either through a
router(inline) or by directly dialing in to the PSTN. In addition,
there is a third-party firewall on the network handling firewall
functionality.
• For inline router configurations:
— The router accepts all incoming client traffic, then trans-
fers the traffic to the VPN device.
— The VPN device then transfers the traffic to the local
network to which it is attached.
— The VPN device is in router mode and doesnot perform
firewall functions.
NAT by Router
NAT by RouterNAT by Router
NAT by Router No NAT
No NATNo NAT
No NAT
Interface E0:
IP: 10.250.128.2 255.255.255.0
Mode: Red
Interface E0:
IP: 205.25.128.2 255.255.255.0
Mode: Red
Interface E1:
IP: 192.168.10.2 255.255.255.0
Mode: Red
Interface E1:
IP: 210.35.129.2 255.255.255.0
Mode: Red
Configuration file entries/
routing info:
security profile remote user
remote tunnel johndoe
security-profile remote
user
client-ip 10.250.128.3
255.255.255.255
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
ip route 209.29.128.50
255.255.255.255 john doe
VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no
client IP)
Subnet: 10.250.128.0 (net-
include) Subnet: 205.25.128.0 (net-include)
ISP IP: 209.29.128.50 ISP IP: 209.29.128.50