Nortel Secure Router 4134 Quick guide

Nortel Secure Router 4134
Security — Configuration and
Management
NN47263-600 (323257-A).

Document status: Standard
Document version: 01.02
Document date: 3 August 2007
Copyright © 2007, Nortel Networks
All Rights Reserved.
This document is protected by copyright laws and international treaties. All information, copyrights and any other
intellectual property rights contained in this document are the property of Nortel Networks. Except as expressly
authorized in writing by Nortel Networks, the holder is granted no rights to use the information contained herein and
this document shall not be published, copied, produced or reproduced, modified, translated, compiled, distributed,
displayed or transmitted, in whole or part, in any form or media.
Sourced in Canada, the United States of America, and India.

3
Contents
New in this release 13
Features 13
Firewall and NAT 13
Packet filter 14
IPsec VPN 14
GRE and IPIP tunneling 15
PPPoE client 15
Authentication, Authorization, and Accounting 16
SSH2 17
Introduction 19
Navigation 19
Firewall and NAT Fundamentals 21
Firewall Overview 21
Stateful inspection elements 22
Virtual firewall zones 22
Transit policies on trusted zones only 23
No transit policies on internet untrusted zone 23
Default firewall 24
Three-legged firewall 24
Firewall network protection features 25
Application and URL filtering 25
Policy-based controls 26
Logging and statistics 26
ALG Overview 27
Supported ALGs 27
NAT Overview 28
Static NAT 29
Dynamic NAT 29
PAT 29
NAT failover for firewalls 30
Scalability 30
Interoperability with CS 1000 and MCS 5100 call servers 30
Cone NAT for CS 1000 30
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Copyright © 2007, Nortel Networks
.

4Contents
SIP ALG for MCS 5100 31
NAT Hairpinning 35
Standards compliance 36
Packet filter fundamentals 37
Packet filters on WAN modules and chassis Ethernet ports 37
Packet filters on Ethernet modules 37
Maximum allowable filter rules on Ethernet modules 38
Available packet filters 38
IPv4 packet filters 38
IPv6 packet filters 39
MAC packet filters 40
Logging 40
Scalability 40
Ethernet module limits 40
Configuration considerations 41
Troubleshooting 41
IPsec VPN fundamentals 43
Site-to-Site VPN 44
Remote access VPN 46
Remote access VPN with L2TP server 47
Supported IPsec security protocols 48
IPsec modes 48
Shared key negotiation with IKE 48
IKE modes 49
Peer authentication methods for IKE 50
User authentication for remote access VPN 51
Digital Certificates in IKE 51
Internet X.509 PKI certificate and CRL profile 52
Certificate validation 52
Certificate enrollment using SCEP client 53
Manual certificate enrollment 54
Dead peer detection 54
Nat Traversal support 54
Multiple IKE proposals 54
Multiple IPsec proposals 55
Identifying traffic to be encrypted with VPN 56
Firewall considerations for trusted and untrusted VPN interfaces 57
Routing considerations for VPN (and firewall) 57
Perfect forward secrecy 57
Dead peer detection 58
Security Policy Database 59
PMTU support 59
Firewall considerations with VPN 59
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Copyright © 2007, Nortel Networks
.

Contents 5
QoS over VPN 60
Crypto QoS (CBQ) for IPsec VPN 60
Logging and Statistics 62
Standards compliance 62
GRE and IPIP tunneling fundamentals 65
GRE and IPIP tunneling for IPv4 65
IPIP 66
GRE 66
Tunnel protection 66
IPv6 over IPv4 tunneling 66
IPv6 over manually-configured IPv4 tunnels 66
IPv6 over IPv4 GRE tunnels 67
Auto 6to4 tunneling 67
Standards compliance 67
PPPoE client fundamentals 69
Standards compliance 70
Authentication, Authorization, and Accounting fundamentals 71
Authentication 71
PAP authentication 71
CHAP authentication 72
RADIUS 72
TACACS 72
EAP IEEE 802.1X 73
Standards compliance 73
Authorization 74
Accounting 74
SSH2 fundamentals 75
SSH2 features 75
SSH ciphers 76
SSH MAC algorithms 76
SSH compression 76
SSH key exchange methods 77
SSH public key algorithms 77
SSH user authentication methods 77
SSH public key file formats 78
Standards compliance 78
Firewall and NAT configuration 79
Configuring global properties 79
Configuring global ALGs 79
Configuring global bypass trusted 80
Configuring global DOS protection 81
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Copyright © 2007, Nortel Networks
.

6Contents
Configuring global NAT hairpinning 83
Configuring global IP reassembly 84
Configuring global logging 87
Configuring global maximum connection limits for the firewall 89
Configuring NAT failover 90
Configuring proxy NAT 91
Configuring global timeout 91
Configuring global URL key filters 93
Configuring port trigger records 93
Configuring policy-specific properties 95
Configuring firewall objects 95
Configuring connection reservations 97
Configuring reset of invalid ACK packets 97
Configuring stealth mode 98
Configuring firewall policies 98
Applying an object to a policy 100
Configuring bandwidth for the policy 101
Configuring the maximum connections for the policy within a configured
timeframe 102
Configuring the maximum connections for the policy 102
Configuring policing for the policy 103
Enabling the policy 104
Adding interfaces to the firewall zone 104
Displaying firewall information 105
Clearing firewall connections 106
Clearing firewall statistics 106
Packet filter configuration 107
Configuring IPv4 packet filters 107
Configuring IPv6 packet filters 110
Configuring MAC packet filters 112
Applying a packet filter to an interface 113
Deleting rules from packet filters 113
Deleting a packet filter 114
Displaying packet filters 114
Displaying packet filters applied to an interface 114
IPsec VPN configuration 117
Configuring IKE for site-to-site VPN 118
Creating an IKE policy 118
Configuring the local address for IKE negotiations 118
Configuring the IKE policy local ID 119
Configuring the IKE policy remote ID 120
Configuring the IKE mode 120
Configuring the IKE exchange type 121
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Copyright © 2007, Nortel Networks
.

Contents 7
Configuring the pre-shared key for IKE 122
Enabling or disabling PFS 123
Configuring IKE proposal 123
Configuring OCSP for the IKE policy 128
Configuring IPsec for site-to-site VPN 129
Creating an IPsec policy 129
Configuring anti-replay 129
Enabling or disabling the IPsec policy entry 130
Specifying the IP stream on which to apply IPsec 130
Configuring DH prime modulus group for PFS 131
Configuring IPsec proposal 132
Configuring remote access IKE policies 137
Creating an IKE policy for remote access VPN 137
Configuring an IKE proposal for remote access VPN 146
Configuring remote access IPsec policies 151
Creating an IPsec policy for remote access VPN 151
Specifying the IP stream on which to apply IPsec for remote access VPN 152
Configuring DH prime modulus group for PFS 153
Configuring IPsec proposal template for remote access VPN 154
Enabling the dynamic IPsec policy 158
Configuring L2TP server for L2TP remote access 159
Creating the L2TP remote access interface 159
Configuring IP address for the L2TP access interface 159
Configuring IPsec protection for the L2TP access interface 160
Configuring client parameters for L2TP remote access 161
Configuring user parameters for L2TP remote access 161
Shutting down the L2TP access interface 162
Configuring dead peer detection keepalive 162
Enabling dead peer detection 162
Configuring the keepalive retry interval 163
Configuring the keepalive transmit-interval 163
Configuring PMTU 163
Configuring DF bit 163
Configuring the MTU threshold value 164
Configuring processing of unsecured ICMP messages 164
Configuring CA trustpoint 165
Configuring the certificate enrollment method 165
Configuring parameters for the certificate request 166
Configuring certificate password 169
Authenticating the CA and importing a CA certificate 169
Generating a certificate request for enrollment 170
Manually importing a self certificate 171
Manually importing an OCSP Responder certificate 171
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Copyright © 2007, Nortel Networks
.

8Contents
Configuring LDAP parameters 172
Requesting a CRL from the CA 173
Configuring OCSP 173
Displaying IPsec VPN configurations 174
Displaying certificates 174
Displaying CRL 174
Displaying trustpoint 174
Displaying IKE policies 175
Displaying IKE SA 175
Displaying IPsec policies 175
Displaying IPsec SA 175
Displaying remote access IKE policies 176
Displaying remote access IPsec policies 176
Displaying remote access VPN clients 176
Displaying status of interfaces as trusted or untrusted 176
Displaying dead peer detection configuration 177
Displaying PMTU information 177
Displaying IPsec statistics 177
Displaying L2TP server configuration 177
Clearing IPsec configurations 178
Deleting certificates 178
Deleting CRL 178
Deleting CA private key 178
Clearing IKE SA information 178
Clearing IPsec SA information 179
Clearing IPsec statistics 179
GRE and IPIP tunnel configuration 181
Configuring a tunnel 181
Creating a tunnel 181
Configuring tunnel encapsulation mode 182
Configuring an IP address for the tunnel 182
Configuring tunnel source 183
Configuring tunnel destination 183
Configuring GRE tunnel parameters 184
Configuring keepalive for GRE tunnels 184
Configuring checksum for GRE tunnels 185
Configuring tunnel key for GRE tunnels 185
Configuring tunnel sequencing 186
Configuring tunnel parameters 186
Configuring path MTU discovery for tunnel packets 186
Configuring the tunnel as an untrusted interface for IPsec protection 187
Configuring tunnel protection with IPsec 187
Configuring tunnel ToS 188
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Copyright © 2007, Nortel Networks
.

Contents 9
Configuring tunnel TTL 189
Shutting down a tunnel 189
Displaying tunnel information 190
Clearing tunnel counters 190
PPPoE client configuration 191
Creating a PPPoE interface 191
Configuring IP address for PPPoE interface 191
Configuring PPPoE tunneling protocol 192
Configuring PPPoE Ethernet interface 193
Configuring PPP authentication method and parameters 193
Configuring PPPoE access concentrator 194
Configuring PPP keepalive 194
Displaying PPPoE client information 195
Authentication, Authorization, and Accounting configuration 197
Enabling AAA 197
Configuring AAA authentication 197
Configuring AAA authentication login 197
Configuring AAA authentication protocol 198
Applying AAA authentication to an interface 199
Configuring AAA authorization 199
Configuring AAA authorization 199
Applying AAA authorization to an interface 200
Configuring AAA accounting 200
Configuring AAA accounting 200
Configuring AAA accounting update 201
Applying AAA accounting to an interface 202
Configuring RADIUS primary and secondary servers 202
Configuring RADIUS server port for accounting 202
Configuring RADIUS server port for authentication 203
Configuring the RADIUS server IP address 203
Configuring RADIUS client retries 204
Configure RADIUS shared secret key 205
Configure RADIUS timeout 205
Configuring RADIUS client source address 206
Configuring TACACS+ primary or secondary server IP address 206
Configuring TACACS+ retries 207
Configuring TACACS+ server port 207
Configuring TACACS+ shared encryption key 208
Configuring TACACS+ timeout 208
Configuring 802.1x 209
Configuring 802.1x on an Ethernet interface 209
Enable 802.1x on the interface 209
Configuring the maximum failed requests 210
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Copyright © 2007, Nortel Networks
.

10 Contents
Configuring port control 210
Configuring quiet period 211
Enabling reauthentication 211
Configuring reauthorization period 212
Configuring authentication server response timeout 212
Configuring supplicant response timeout 213
Displaying AAA information 214
Displaying AAA accounting information 214
Displaying AAA authentication information 214
Displaying AAA authorization information 214
Displaying AAA interface information 214
Displaying AAA status 215
Displaying RADIUS information 215
Displaying TACACS+ information 215
Displaying 802.1x information 215
Clearing 802.1x statistcs 216
SSH2 configuration 217
Configuring SSH2 server keys 217
Generating SSH2 server keys 217
Encrypting a private key file 218
Changing the passphrase used for encryption 218
Converting public key files to SSH format 219
Generating a public key digest of a key file 220
Configuring SSH2 server parameters 221
Configuring SSH2 authentication 221
Configuring SSH2 authentication retries 221
Configuring SSH encryption algorithms 222
Configuring SSH compression 222
Enabling and disabling SSH server 223
Specifying host key file for the SSH server 223
Enabling and disabling log events 224
Configuring MAC algorithms 225
Configuring SSH listen port 225
Restoring default SSH parameter values 226
Enabling and disabling SSH SFTP server 226
Configuring SSH session timeout 227
Displaying SSH server configuration 227
Displaying SSH server sessions 228
Clearing SSH sessions 228
Configuration examples 229
Configuring an IPv4 packet filter 229
Configuring an IPv6 packet filter 229
Configuring a MAC packet filter 230
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Copyright © 2007, Nortel Networks
.