Nortel NN46120-104 User manual

Nortel VPN Gateway
User Guide
Release: 7.1
Document Revision: 02.01
www.nortel.com
NN46120-104 216368-G
.

Nortel VPN Gateway
Release: 7.1
Publication: NN46120-104
Document status: Standard
Document release date: 14 April 2008
Copyright © 2007-2008 Nortel Networks
All Rights Reserved.
The information in this document is subject to change without notice. The statements, configurations, technical
data, and recommendations in this document are believed to be accurate and reliable, but are presented without
express or implied warranty. Users must take full responsibility for their applications of any products specified in this
document. The information in this document is proprietary to Nortel Networks.
*Nortel, Nortel Networks, the Nortel logo and the Globemark are trademarks of Nortel Networks.
Export
This product, software and related technology is subject to U.S. export control and may be subject to export or
import regulations in other countries. Purchaser must strictly comply with all such laws and regulations. A license to
export or reexport may be required by the U.S. Department of Commerce.
Licensing
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit
(https://www.openssl.org/).
This product includes cryptographic software written by Eric Young ([email protected]).
This product includes software written by Tim Hudson ([email protected]).
This product includes software developed by the Apache Software Foundation http://www.apache.org/
This product includes a TAP-Win32 driver derived from the CIPE-Win32 kernel driver, Copyright©Damion K.
Wilson, and is licensed under the GPL.
.

3
.
Contents
Preface 7
Who Should Use This Book 8
Related documentation 9
Product Names 10
How This Book Is Organized 11
Typographic Conventions 13
How to Get Help 14
Getting help from the Nortel Web site 14
Getting help over the phone from a Nortel Solutions Center 14
Getting help from a specialist by using an Express Routing Code 14
Getting help through a Nortel distributor or reseller 14
Introducing the VPN Gateway 15
SSL Acceleration 16
VPN 17
Hardware Platforms 18
Feature List 19
Introducing the ASA 310-FIPS 27
HSM Overview 28
Extended Mode vs. FIPS Mode 29
The Concept of iKey Authentication 30
Additional HSM Information 33
Initial Setup 35
Clusters 36
IP Address Types 37
Ports 38
Interfaces 39
Configuration at Boot Up 41
Installing an NVG in a New Cluster 42
Joining a VPN Gateway to an Existing Cluster 52
Installing an ASA 310-FIPS 58
Reinstalling the Software 70
Nortel VPN Gateway
User Guide
NN46120-104 02.01 Standard
14 April 2008
Copyright © 2007-2008 Nortel Networks
.

4
Upgrading the NVG Software 73
Performing Minor/Major Release Upgrades 74
Managing Users and Groups 79
User Rights and Group Membership 80
Adding a New User 81
Changing a Users Group Assignment 86
Changing a Users Password 88
Deleting a User 91
Certificates and Client Authentication 93
Generating and Submitting a CSR Using the CLI 94
Adding Certificates to the NVG 99
Update Existing Certificate 107
Configure a Virtual SSL Server to Require a Client Certificate 108
Generating client certificates 110
Managing Revocation of Client Certificates 116
Client certificate support 123
Signing CSRs 124
Generate Test Certificate 126
General Commands 128
Virtual Desktop 131
Running the Virtual Desktop on Client Computers 132
Licensing vdesktop 132
Launch Vdesktop from Portal 133
Virtual Desktop Operations 134
The Command Line Interface 135
Connecting to the VPN Gateway 136
Accessing the NVG Cluster 140
CLI vs. Setup 142
Command Line History and Editing 143
Idle Timeout 144
Troubleshooting the NVG 145
Cannot Connect to VPN Gateway through Telnet or SSH 146
Cannot Add an NVG to a Cluster 148
Cannot Contact the MIP 149
The NVG Stops Responding 151
A User Password is Lost 152
An ASA 310-FIPS Stops Processing Traffic 153
Resetting HSM Cards on the ASA 310-FIPS 155
AnASA 310-FIPS Cluster Must be Reconstructed onto New Devices 158
A User Fails to Connect to the VPN 163
User Unable to Connect to the VPN Gateway through the Net Direct Client 168
Nortel VPN Gateway
User Guide
NN46120-104 02.01 Standard
14 April 2008
Copyright © 2007-2008 Nortel Networks
.

Licensing 5
Cannot download the NetDirect Zipped file from client PC 171
System Diagnostics 172
Unable to download NetDirect from VPN server 175
Supported Ciphers 177
Cipher List Formats 179
Modifying a Cipher List 180
Supported Cipher Strings and Meanings 181
The SNMP Agent 183
Supported MIBs 184
Supported Traps 189
Syslog Messages 191
List of Syslog Messages 192
Syslog Messages in Alphabetical Order 209
222
License Information 223
HSM Security Policy 233
Definition of Key Codes 253
Syntax Description 254
SSH host keys 257
Methods for Protection 258
The VPN Gateway 259
Adding User Preferences Attribute to Active Directory 261
262
Using the Port Forwarder API 271
General 272
Creating a Port Forwarder 273
Demo Application 274
Creating a Port Forwarder Authenticator 276
Adding a Port Forwarder Logger 279
Connecting Through a Proxy 282
Monitoring the Port Forwarder 283
Glossary 285
Index 295
Nortel VPN Gateway
User Guide
NN46120-104 02.01 Standard
14 April 2008
Copyright © 2007-2008 Nortel Networks
.

6
Nortel VPN Gateway
User Guide
NN46120-104 02.01 Standard
14 April 2008
Copyright © 2007-2008 Nortel Networks
.

7
.
Preface
This User’s Guide describes how to perform basic configuration and
maintenance of the Nortel VPN Gateway (NVG).
Nortel VPN Gateway
User Guide
NN46120-104 02.01 Standard
14 April 2008
Copyright © 2007-2008 Nortel Networks
.

8Preface
Who Should Use This Book
This User’s Guide is intended for network installers and system
administrators engaged in configuring and maintaining a network. It
assumes that you are familiar with Ethernet concepts and IP addressing.
Nortel VPN Gateway
User Guide
NN46120-104 02.01 Standard
14 April 2008
Copyright © 2007-2008 Nortel Networks
.

Licensing 9
Related documentation
For full documentation on installing and using the many features available
in the VPN Gateway software, see the following manuals:
•VPN Gateway 7.1 Command Reference
(part number 216369-F, April 2008)
Describes each command in detail. The commands are listed per
menu, according to the order they appear in the Command Line
Interface (CLI).
•VPN Gateway 6.0 Application Guide for SSL Acceleration
(part number 216370-D, April 2008)
Provides examples on how to configure SSL Acceleration through the
CLI.
•VPN Gateway 7.1 CLI Application Guide for VPN
(part number 216371-F, April 2008)
Provides examples on how to configure VPN deployment through the
CLI.
•VPN Gateway 7.1 BBI Application Guide for VPN
(part number 217239-E, April 2008)
Provides examples on how to configure VPN deployment through the
BBI (Browser-Based Management Interface).
•VPN Gateway 7.1 VPN Administrator Guide
(part number 217238-E, April 2008)
VPN management guide intended for end-customers in a Secure
Service Partitioning configuration.
•VPN Gateway 3050/3070 Hardware Installation Guide
(part number 216213-B, March 2005)
Describes installation of the VPN Gateway 3050 and 3070 hardware
models.
•VPN Gateway 7.1 Configuration-Secure Portable Office Client
(part number 324637-A, April 2008
•VPN Gateway 7.1 Troubleshooting Guide
(part number 324371-B, April 2008)
Describes the prerequisites and various tools used to troubleshoot the
Nortel VPN Gateway (NVG).
•VPN Gateway 7.1 Release Notes
(part number 216372-W, April 2008)
Lists new features available in version 7.1 and provides up-to-date
product information.
The preceding manuals are available for download (see “How to Get Help”
(page 14).
Nortel VPN Gateway
User Guide
NN46120-104 02.01 Standard
14 April 2008
Copyright © 2007-2008 Nortel Networks
.

10 Preface
Product Names
The software described in this manual runs on several different hardware
models. Whenever the generic terms Nortel VPN Gateway, VPN gateway
or NVG are used in the documentation, the following hardware models
are implied:
•Nortel VPN Gateway 3050 (NVG 3050)
•Nortel VPN Gateway 3070 (NVG 3070)
•Nortel SSL VPN Module 1000 (SVM 1000)
•Nortel SSL Accelerator 310-FIPS (ASA 310-FIPS)
•The integrated SSL Accelerator (SSL processor) on the Nortel
2424-SSL switch
•Nortel VPN Gateway Universal Serial Bus
Similarly, all references to the old product name – iSD-SSL or iSD – in
commands or screen outputs should be interpreted as applying to the
preceding hardware models.
Note: Manufacturing of the Nortel SSL Accelerator (formerly Alteon
SSL Accelerator) has been discontinued.
Nortel VPN Gateway
User Guide
NN46120-104 02.01 Standard
14 April 2008
Copyright © 2007-2008 Nortel Networks
.