Nortel 5100 Series Release 2.3.3 User manual

4655 Great America Parkway
Santa Clara, CA 95054
Phone 1-800-4Nortel
http://www.nortel.com
Nortel Switched Firewall 5100 Series
Release 2.3.3
Browser-Based Interface User’s Guide
part number: 216383-D, October 2005

2
216383-D
Copyright © Nortel Networks 2002– 2005. All rights reserved.
This document is protected by copyright and distributed under licenses restricting its use, copying,
distribution, and decompilation. No part of this document may be reproduced in any form by any means
without prior written authorization of Nortel Networks, Inc. Documentation is provided “as is” without
warranty of any kind, either express or implied, including any kind of implied or express warranty of non-
infringement or the implied warranties of merchantability or fitness for a particular purpose.
U.S. Government End Users: This document is provided with a “commercial item” as defined by FAR
2.101 (Oct 1995) and contains “commercial technical data” and “commercial software
documentation” as those terms are used in FAR 12.211-12.212 (Oct 1995). Government End Users
are authorized to use this documentation only in accordance with those rights and restrictions set forth
herein, consistent with FAR 12.211- 12.212 (Oct 1995), DFARS 227.7202 (JUN 1995) and DFARS
252.227-7015 (Nov 1995).
Nortel Networks, Inc. reserves the right to change any products described herein at any time, and
without notice. Nortel Networks, Inc. assumes no responsibility or liability arising from the use of
products described herein, except as expressly agreed to in writing by Nortel Networks, Inc. The use
and purchase of this product does not convey a license under any patent rights, trademark rights, or
any other intellectual property rights of Nortel Networks, Inc.
Nortel, Nortel Networks, the Nortel logo, and the Globemark are trademarks of Nortel Networks.
Check Point, OPSEC, and SmartUpdate are trademarks of Check Point Software Technologies Ltd.
FireWall-1 and VPN-1 are registered trademarks of Check Point Software Technologies Ltd.
Portions of this manual are Copyright © 2001 Check Point Software Technologies Ltd. All Rights
Reserved.
Portions of this manual are Copyright © 2001 Dell Computer Corporation. All Rights Reserved.
Any other trademarks appearing in this manual are owned by their respective companies.

216383-D October 2005
3
Contents
Preface 7
Who should use this book 7
How this book is organized 7
Typographic conventions 8
How to get help 9
Getting help from the Nortel web site 9
Getting help over the telephone from a Nortel Solutions Center 9
Using an Express Routing Code to get help from a specialist 10
Getting help through a Nortel distributor or reseller 10
Chapter 1: Introduction 11
Characteristics of the BBI 11
Getting started 12
Requirements 12
Enabling the BBI 12
CLI configuration tasks 12
Setting up the web browser 14
Starting the BBI 14
Using the VRRP virtual IP address to access the NSF BBI 15
Logging in 15
Loading the main page 16
Chapter 2: Basics of the Browser-Based Interface 17
Interface components 17

Nortel Switched Firewall Browser-Based Interface Users Guide
4 Contents
216383-D October 2005
Basic operation 22
Pending change exceptions 22
Lost changes 22
Creating a configuration 23
Viewing pending changes 23
Clearing pending changes 23
Submitting changes 23
Global command forms 24
Apply Changes 24
Diff 26
Revert 27
Logout 28
Help 29
Context-sensitive Help 29
Task-based Help 30
Chapter 3: Browser-Based Interface forms reference 33
BBI main menu selections 33
System form 34
NSF 5100 Ticker form 34
Cluster forms 38
Director(s) form 38
Time forms 40
Logs forms 42
Warnings form 49
Network forms 50
DNS form 51
Ports form 52
Routes forms 54
Network/Routes/OSPF forms 59
DHCP Relay forms 69
Interfaces form 74
Bridges form 78
VRRP form 80
GRE Tunnels form 82
Status forms 85
Firewall forms 89
Settings form 89

Nortel Switched Firewall Browser-Based Interface Users Guide
Contents 5
216383-D October 2005
License Management form 91
Installed License(s) form 93
Synchronization form 94
SMART Clients form 95
SecurID form 96
Operation forms 97
Director(s) form 97
Configuration form 98
Image Update forms 99
Administration forms 102
Monitor forms 102
Users forms 110
Access List form 115
Telnet-SSH form 117
Web forms 118
SNMP forms 126
SSH Keys form 135
RADIUS form 138
APC UPS form 141
Audit form 142
Diagnostics forms 145
Logs form 145
Events form 147
Audit Log form 148
Maintenance forms 149
System Commands form 151
Debug forms 152
Wizards forms 154
Initial Configuration Wizard 155
Add Wizard forms 156
Configure Wizard forms 157

Nortel Switched Firewall Browser-Based Interface Users Guide
6 Contents
216383-D October 2005

216383-D October 2005
7
Preface
This Quick Guide describes the Nortel Switched Firewall Browser-Based Interface (BBI). The
components and features of the BBI can be used as an alternative to the Nortel Switched
Firewall Command Line Interface (CLI) documented in the Nortel Switched Firewall 2.3.3
User’s Guide and Command Reference, (213455-L).
Who should use this book
This Quick Guide is intended for network installers and system administrators engaged in
configuring and maintaining a network. Installers and administrators must be familiar with
Ethernet concepts and IP addressing.
How this book is organized
The chapters in this book are organized as follows:
Chapter 1, Introduction,on page 11 describes how to enable and access the BBI.
Chapter 2, Basics of the Browser-Based Interface, on page 17 describes the BBI global
commands, the BBI page components, and how to access the context-sensitive online Help for
referencing page fields, buttons, and labels.
Chapter 3, Browser-Based Interface forms reference, on page 33 describes in detail all of the
forms associated with the BBI.

Nortel Switched Firewall Browser-Based Interface Users Guide
8 Preface
216383-D October 2005
Typographic conventions
The following table describes the typographic styles used in this book.
Table 1 Typographic conventions
Typeface or
Symbol
Meaning Example
AaBbCc123 This fixed-width type is used for names of
commands, files, and directories used within
the text.
View the readme.txt file.
It also depicts on-screen computer output and
prompts.
Main#
AaBbCc123 This italicized type shows book titles, special
terms, or words to be emphasized.
Read your User’s Guide
thoroughly.
AaBbCc123 This fixed-width, bold type appears in com-
mand examples. It shows text that must be
typed in exactly as shown.
Main# sys
<AaBbCc123> Italicized type within angle brackets appears
in command examples as a parameter place-
holder. Replace the indicated text with the
appropriate real name or value when using the
command. Do not type the brackets.
To establish a Telnet
session, enter:
host# telnet <IP address>
[ ] Command items shown inside square brack-
ets are optional and can be used or excluded
as the situation demands. Do not type the
brackets.
host# ls [-a]
|Command items separated by the vertical bar
depict a list of possible values, only one of
which should be entered. The vertical bar is
considered to mean “or.”
System# autoneg on|off
This can also be used to separate different
selections within a window-based menu bar.
Select Edit | Copy from
the window’s menu bar.
<Key> Non-alphanumeric keyboard items are shown
in regular type inside brackets. When
directed, press the appropriate key.
Press the <Enter> key.

Nortel Switched Firewall Browser-Based Interface Users Guide
Preface 9
216383-D October 2005
How to get help
This section explains how to get help for Nortel products and services.
Getting help from the Nortel web site
The best way to get technical support for Nortel products is from the Nortel Technical Support
web site at: www.nortel.com/support.
This site provides quick access to software, documentation, bulletins, and tools to address
issues with Nortel products.
Use the Nortel Technical Support web site to do the following:
download technical information, including the following items:
software
documentation
product bulletins
search the Technical Support web site and the Nortel Knowledge Base for answers to
technical questions
sign up for automatic notification of new software and documentation for Nortel
equipment
open and manage technical support cases
Getting help over the telephone from a Nortel Solutions
Center
If you do not find the information you require on the Nortel Technical Support web site, you
can get help over the telephone from a Nortel Solutions Center. You must have a Nortel
support contract to use the Nortel Solutions Center.
To reach a Nortel Solutions Center, do one of the following;
In North America, call 1–800–4NORTEL (1–800–466–7835).
Outside North America, go to the following web site to obtain the telephone number for
your region: www.nortel.com/callus.

Nortel Switched Firewall Browser-Based Interface Users Guide
10 Preface
216383-D October 2005
Using an Express Routing Code to get help from a specialist
You can find Express Routing Codes (ERC) for many Nortel products and services on the
Nortel Technical Support web site. ERCs allow you to connect directly to service and support
organizations based on specific products or services.
To locate the ERC for your product or service, go to www.nortel.com/erc.
Getting help through a Nortel distributor or reseller
If you purchased a service contract for your Nortel product from a distributor or authorized
reseller, contact the technical support staff for that distributor or reseller.

216383-D October 2005
11
CHAPTER 1
Introduction
This chapter explains how to enable the Browser-Based Interface (BBI), set up your web
browser, and launch the BBI to access the Nortel Switched Firewall (NSF) system-
management features from your web browser.
Characteristics of the BBI
Following are the characteristics of the BBI:
Intuitive interface structure.
Configuration and monitoring functions similar to those available through the Command
Line Interface (CLI).
Access using HTTP, or secure HTTPS using Secure Socket Layer (SSL).
No installation required; the BBI is part of the Firewall OS software.
Upgrades with future software releases (as available).
Runs up to ten BBI sessions simultaneously.
Online context-sensitive Help for each BBI page.
Online task-based Help for a variety of common procedures from each BBI page.

Nortel Switched Firewall Browser-Based Interface Users Guide
12 Introduction
216383-D October 2005
Getting started
Requirements
Following are the requirements to enable the BBI:
An installed Nortel Switched Firewall
A Check Point policy to allow management station access for HTTP or HTTPS traffic
A PC or workstation with network access to the Firewall host IP address
A Frame-capable web browser software, such as the following:
Netscape Navigator 4.6 or higher
Internet Explorer 5.5 or higher
JavaScript enabled in your web browser
Java 2 Runtime Environment SE plug-in, version 1.2.4-01 or higher
NOTE – JavaScript is different from Java. Ensure that JavaScript is enabled in your web
browser.
Enabling the BBI
Before you can access the BBI, you must perform some configuration at the CLI. For
information about accessing and using the CLI, see the Nortel Switched Firewall 2.3.3 User’s
Guide and Command Reference,(213455-L).
CLI configuration tasks
Following are the CLI configuration tasks required to enable access to the BBI:
Enable the BBI.
Generate a temporary certificate (if using HTTPS).
Apply the changes.
Use the access list to permit remote access to trusted clients.
Use the Check Point SmartDashboard on your SMART Client to add a security policy that
allows BBI traffic.

Nortel Switched Firewall Browser-Based Interface Users Guide
Introduction 13
216383-D October 2005
Enabling the BBI
You can enable the BBI for HTTP, HTTP and HTTPS, or you can fully disable the BBI. TIP:
The default setting for the BBI is enabled for HTTP access and disabled for HTTPS access.
NOTE – HTTP is not a secure protocol. All data (including passwords) between an HTTP
client and the Nortel Switched Firewall is not encrypted and is subject only to weak
authentication. If secure remote access is required, use HTTPS.
To explicitly allow remote BBI access, enter the following commands in the CLI:
To enable HTTP access:
To enable HTTPS access using SSL:
Generating a temporary certificate if using HTTPS
An SSL server certificate is required for HTTPS access to the BBI. The Firewall can generate
a temporary, self-signed certificate. Use the following commands to create a default certificate:
where Name is the common name that appears on the certificate, Country code is a two-letter
code (US for the United States of America, CA for Canada, JP for Japan, and so on), and Key
size is 512, 1024, or 2048 bits. For example:
NOTE – When you log in to the BBI with the temporary certificate, you are warned that the
certificate is not signed or authenticated. Permit use of the temporary certificate only during
initial configuration, where the system is not attached to active networks that can be a source
of attack. Install a signed and authenticated certificate prior to connecting any untrusted
network.
>> # /cfg/sys/adm/web/http/ena
>> # /cfg/sys/adm/web/ssl/ena
>> SSL configuration# certs/serv/gen <Name> <Country code> <Key size>
Do you want to generate a self-signed certificate with the generated
Key? y
>> SSL configuration# certs/serv/gen Nortel US 1024

Nortel Switched Firewall Browser-Based Interface Users Guide
14 Introduction
216383-D October 2005
Applying the changes.
Using the access list to permit remote access to trusted clients
If you already configured the access list for Telnet or SSH, you need not repeat the process.
Otherwise, to permit access to only trusted clients, see the Nortel Switched Firewall 2.3.3
User’s Guide and Command Reference, Part No. 213455-L.
Adding a security policy that allows BBI traffic
Use the Check Point SmartDashboard on your SMART Client to add a security policy that
allows BBI traffic.
The firewall policy should be constructed as follows:
Source: IP address of the SMART Client or IP address range of the management network
Destination: Host IP address of the Firewall
Service: HTTP for non-secure access, or SSL for HTTPS access
Action: Allow—select Nortel Switched Firewall
Setting up the web browser
Most web browsers work with JavaScript by default and require no additional setup. Check the
features and configuration of your web browser to ensure JavaScript is enabled.
NOTE – JavaScript is not the same as Java. Ensure that JavaScript is enabled in your web
browser.
Starting the BBI
When the Firewall and browser setup is complete, use the following steps to launch the BBI:
1. Start your web browser.
2. Enter one of the following in the URL field of the web browser:
a) host IP address
b) host IP address as a name (when IP address is assigned a name on the local domain name
server)
>> SSL configuration# apply

Nortel Switched Firewall Browser-Based Interface Users Guide
Introduction 15
216383-D October 2005
c) MIP address
d) virtual IP address (see Using the VRRP virtual IP address to access the NSF BBI)
The NSF login window opens.
3. Log in (see Logging in).
4. Allow the main page to load (see Loading the main page on page 16).
Using the VRRP virtual IP address to access the NSF BBI
To use the VRRP virtual IP address for firewall access by web browser, enable management
support for the VRRP interface.
Use the following CLI command to enable management support for the VRRP interface:
The virtual IP address is specified with the ip1 or ip2 command in the CLI menu. For more
information, see the Nortel Switched Firewall 2.3.3 User’s Guide and Command Reference,
Part No. 213455-L.
Using the VRRP interface IP address enhances firewall security, because users can configure
the VRRP interface with the user-defined CheckPoint policies. SSI traffic is separate from the
CheckPoint policies.
Logging in
To log in, enter the account name and password for the system administrator or operator
account (see Figure 1 on page 16). For more login and password information, see the Nortel
Switched Firewall 2.3.3 User’s Guide and Command Reference, (213455-L).
/cfg/net/if #/mgmt/ena/apply

Nortel Switched Firewall Browser-Based Interface Users Guide
16 Introduction
216383-D October 2005
Figure 1 NSF Login window
Loading the main page
When the valid account name and password combination is entered on the login window, the
BBI default page appears in your browser viewing window (see Figure 2).
Figure 2 NSF BBI main page
NOTE – A delay of a few seconds can occur while the default page collects data from all of the
cluster components. Do not stop the browser while loading is in progress.

216383-D October 2005
17
CHAPTER 2
Basics of the Browser-Based
Interface
Interface components
The Nortel Switched Firewall (NSF) Browser-Based Interface (BBI) main page has eight
component areas (see Figure 3).
Figure 3 NSF BBI main page
Global command buttons
Main page tabs
NSF Configuration
main menu
Director status
Current alarms
Warning display area Forms display area
History list

Nortel Switched Firewall Browser-Based Interface Users Guide
18 Basics of the Browser-Based Interface
216383-D October 2005
Main page tabs
The two main page tabs are Wizards and Config (see Figure 3 on page 17).
Wizards provides access to wizards that guide users through the processes of initial
configuration, interface and bridge addition, Check Point Firewall configuration,
routes and gateway configuration, DHCP Relay configuration, and OSPF configura-
tion (see Figure 4 and Figure 5). To use the wizards, select Initial Configuration,
Add, or Configure, and follow the instructions on the page. Click the plus sign (+)
adjacent to a selection to expand it and reveal its associated subcategories. To see
each of the initial Wizards pages, see Chapter 3, Browser-Based Interface forms ref-
erence.
Config is the default tab for the BBI main page and provides access to all of the
monitoring and configuration functions (see Figure 6 on page 20).
Figure 4 NSF Wizards main page

Nortel Switched Firewall Browser-Based Interface Users Guide
Basics of the Browser-Based Interface 19
216383-D October 2005
Wizards menu shows the selections available on the Wizards menu tree.
Figure 5 Wizards menu

Nortel Switched Firewall Browser-Based Interface Users Guide
20 Basics of the Browser-Based Interface
216383-D October 2005
NSF Config main menu tree
Each of the selections on the Config main menu tree represents a page, called a form,
which provides a method to monitor or configure the NSF (see Figure 3 on page 17 and
Figure 6).
Figure 6 NSF Config main menu
Each main menu category offers subcategories, providing a further level of control or
detailed information. Click the plus sign (+) adjacent to a selection to expand it and reveal
its associated subcategories.
For detailed information about the forms, see Chapter 3, Browser-Based Interface forms
reference, on page 33.
Warning display area
The Warning display area provides important warnings for the user, such as information
about CLI users logged in or the status of the GUI lock. Any user logged in as administra-
tor (username admin) can activate the GUI lock before changing or creating a configura-
tion. See Figure 75 on page 107.