Nortel 325 series User manual

Nortel Secure Network Access Switch
Using the Command Line
Interface
Release: 2.0
Document Revision: 03.01
www.nortel.com
NN47230-100 320818-D
.

Nortel Secure Network Access Switch
Release: 2.0
Publication: NN47230-100
Document status: Standard
Document release date: 28 July 2008
Copyright © 2007, 2008 Nortel Networks
All Rights Reserved.
Sourced in Canada, the United States of America, and India
LEGAL NOTICE
While the information in this document is believed to be accurate and reliable, except as otherwise expressly
agreed to in writing NORTEL PROVIDES THIS DOCUMENT "AS IS "WITHOUT WARRANTY OR CONDITION OF
ANY KIND, EITHER EXPRESS OR IMPLIED. The information and/or products described in this document are
subject to change without notice.
Nortel, the Nortel logo, and the Globemark are trademarks of Nortel Networks.
All other trademarks are the property of their respective owners.
.

3
.
Contents
Software license 11
New in this release 15
Features 15
Other changes 16
Introduction 17
Before you begin 18
Text conventions 18
Related information 20
Publications 20
Online 21
How to get help 21
Overview 23
The Nortel SNAS 24
Elements of the Nortel SNAS 25
Supported users 25
Supporting additional users with the software license file 26
Role of the Nortel SNAS 27
Nortel SNAS clusters 35
Interface configuration 35
Nortel SNAS configuration and management tools 36
Nortel SNAS configuration roadmap 37
Initial setup 41
Before you begin 41
About the IP addresses 42
Initial setup 43
Setting up a single Nortel SNAS device or the first in a cluster 43
Adding a Nortel SNAS device to a cluster 50
Next steps 54
Applying and saving the configuration 55
Managing the network access devices 57
Before you begin 57
Nortel Secure Network Access Switch
Using the Command Line Interface
NN47230-100 03.01 Standard
28 July 2008
Copyright © 2007, 2008 Nortel Networks
.

4
Managing network access devices 58
Roadmap of domain switch commands 58
Adding a network access devices 60
Deleting a network access devices 64
Configuring the network access devices 64
Mapping the VLANs 66
Managing SSH keys 68
Monitoring switch health 73
Controlling communication with the network access devices 74
Configuring SSCPLite 74
Configuring SNMP Profiles 75
Configuring SNMP Versions 76
Configuring SSCPLite Community 77
Configuring SNMP Templates 77
Configuring the domain 79
Configuring the domain 79
Roadmap of domain commands 81
Creating a domain 83
Deleting a domain 89
Configuring domain parameters 89
Configuring the Nortel Health Agent check 92
Configuring the SSL server 97
Configuring HTTP redirect 107
Browser-Based Management Configuration 108
Browser-Based Management Configuration with SSL 108
Configuring advanced settings 109
Configuring RADIUS accounting 110
Configuring local DHCP services 115
Creation of the location 123
Configuring Lumension PatchLink integration 124
Configuration of the RADIUS server 127
Overview of RADIUS server 127
802.1x functionality 127
Roadmap of RADIUS server configuration commands 128
Configuration of the RADIUS server 129
Configuration of the client 130
Configuration of the realms 131
Configuration of the dictionary 133
Configuration of the RADIUS accounting 134
Configuration of the RADIUS authentication methods 134
Configuration of the EAP authentication methods 136
Select the server certificate 137
Select the CA certificate 138
Nortel Secure Network Access Switch
Using the Command Line Interface
NN47230-100 03.01 Standard
28 July 2008
Copyright © 2007, 2008 Nortel Networks
.

5
Configuration of Microsoft NAP Interoperability 139
Roadmap of NAP configuration commands 139
Configuration of NAP Interoperability 140
Probation Settings 141
Remote Network Policy Servers 142
System Health Validators 143
Configuration of Windows System Health Validator 144
Configuring groups and profiles 149
Overview 149
Groups 150
Linksets 151
SRS rule 151
Extended profiles 151
Before you begin 152
Configuring groups and extended profiles 153
Roadmap of group and profile commands 153
Configuring groups 156
Configuring client filters 162
Configuring extended profiles 164
Creating RADIUS attributes to a group 166
Mapping linksets to a group or profile 167
Creating a default group 169
Configuring authentication 171
Overview 171
Before you begin 172
Configuring authentication 174
Roadmap of authentication commands 174
Configuring authentication methods 177
Configuring advanced settings 179
Configuring RADIUS authentication 180
Configuring LDAP authentication 187
Configuring local database authentication 200
Specifying authentication fallback order 209
Managing system users and groups 211
User rights and group membership 211
Managing system users and groups 212
Roadmap of system user management commands 212
Managing user accounts and passwords 213
Managing user settings 216
Managing user groups 217
CLI configuration examples 218
Nortel Secure Network Access Switch
Using the Command Line Interface
NN47230-100 03.01 Standard
28 July 2008
Copyright © 2007, 2008 Nortel Networks
.

6
Customizing the portal and user logon 227
Overview 227
Captive portal and Exclude List 228
Portal display 230
Managing the end user experience 237
Customizing the portal and logon 238
Roadmap of portal and logon configuration commands 238
Configuring the captive portal 240
Configuring the Exclude List 240
Changing the portal language 241
Configuring the portal display 244
Changing the portal colors 249
Configuring custom content 250
Configuring linksets 251
Configuring links 253
Configuring system settings 257
Configuring the cluster 257
Roadmap of system commands 258
Configuring system settings 262
Configuring the Nortel SNAS host 264
Configuring host interfaces 268
Configuring static routes 270
Configuring host ports 271
Managing interface ports 272
Configuring the Access List 273
Configuring date and time settings 274
Configuring DNS servers and settings 276
Configuring RSA servers 279
Configuring syslog servers 279
Configuring administrative settings 281
Enabling TunnelGuard SRS administration 284
Configuring Nortel SNAS host SSH keys 284
Configuring RADIUS auditing 286
Configuring authentication of system users 290
Configuration of auto blacklisting 293
Configuration of harden password 295
Managing certificates 297
Overview 297
Key and certificate formats 298
Creating certificates 299
Installing certificates and keys 299
Saving or exporting certificates and keys 300
Nortel Secure Network Access Switch
Using the Command Line Interface
NN47230-100 03.01 Standard
28 July 2008
Copyright © 2007, 2008 Nortel Networks
.

7
Updating certificates 300
Managing private keys and certificates 301
Roadmap of certificate management commands 301
Managing and viewing certificates and keys 302
Generating and submitting a CSR 305
Adding a certificate to the Nortel SNAS 310
Adding a private key to the Nortel SNAS 312
Importing certificates and keys into the Nortel SNAS 314
Displaying or saving a certificate and key 316
Exporting a certificate and key from the Nortel SNAS 318
Generating a test certificate 320
Configuring SNMP 323
Configuring SNMP 324
Roadmap of SNMP commands 324
Configuring SNMP settings 325
Configuring the SNMP v2 MIB 326
Configuring the SNMP community 327
Configuring SNMPv3 users 328
Configuring SNMP notification targets 331
Configuring SNMP events 332
Viewing system information and performance statistics 337
Viewing system information and performance statistics 337
Roadmap of information and statistics commands 337
Viewing system information 339
Viewing alarm events 344
Viewing log files 345
Viewing AAA statistics 346
Viewing all statistics 348
Kicking by username or address 349
Nortel SNAS TPS Interface 349
Maintaining and managing the system 351
Managing and maintaining the system 352
Roadmap of maintenance and boot commands 352
Performing maintenance 353
Backing up or restoring the configuration 356
Configuring the Nortel SNAS scheduler 359
Managing Nortel SNAS devices 361
Managing software for a Nortel SNAS device 363
Upgrading or reinstalling the software 367
Upgrading the Nortel SNAS 367
Performing minor and major release upgrades 368
Activating the software upgrade package 369
Nortel Secure Network Access Switch
Using the Command Line Interface
NN47230-100 03.01 Standard
28 July 2008
Copyright © 2007, 2008 Nortel Networks
.

8
Reinstalling the software 372
Before you begin 372
Reinstalling the software from an external file server 373
Reinstalling the software from a CD 375
The Command Line Interface 377
Connecting to the Nortel SNAS 378
Establishing a console connection 378
Establishing a Telnet connection 379
Establishing a connection using SSH 380
Accessing the Nortel SNAS cluster 381
CLI Main Menu or Setup 383
Command line history and editing 383
Idle timeout 383
Configuration example 385
Scenario 385
Steps 387
Configure the network DNS server 388
Configure the network DHCP server 388
Configure the network core router 392
Configure the Ethernet Routing Switch 8300 393
Configure the Ethernet Routing Switch 5510 395
Configure the Nortel SNAS 397
Troubleshooting 403
Troubleshooting tips 403
Cannot connect to the Nortel SNAS using Telnet or SSH 403
Cannot add the Nortel SNAS to a cluster 405
Cannot contact the MIP 406
The Nortel SNAS stops responding 407
A user password is lost 408
A user fails to connect to the Nortel SNAS domain 409
Trace tools 409
System diagnostics 410
Installed certificates 410
Network diagnostics 410
Active alarms and the events log file 412
Error log files 412
Using the CLI 413
Global commands 414
Command line history and editing 416
CLI shortcuts 417
Using slashes and spaces in commands 419
IP address and network mask formats 420
Nortel Secure Network Access Switch
Using the Command Line Interface
NN47230-100 03.01 Standard
28 July 2008
Copyright © 2007, 2008 Nortel Networks
.

9
Variables 420
CLI Main Menu 421
CLI command reference 422
Information menu 422
Statistics menu 423
Configuration menu 424
Boot menu 448
Maintenance menu 449
Syslog messages by message type 451
Operating system (OS) messages 452
System Control Process messages 453
Traffic Processing Subsystem messages 457
Start-up messages 461
AAA subsystem messages 461
NSNAS subsystem messages 463
Syslog messages in alphabetical order 465
Supported MIBs 477
Supported traps 481
485
Install All Administrative Tools (Windows 2000 Server) 485
Register the Schema Management dll (Windows Server 2003) 485
Add the Active Directory Schema Snap-in (Windows 2000 Server and Windows
Server 2003) 486
Permit write operations to the schema (Windows 2000 Server) 488
Create a new attribute(Windows 2000 Server and Windows Server 2003) 489
Create the new class 489
Configuring IP Phone auto-configuration 494
Creating the DHCP options 494
Configuring the Call Server Information and VLAN Information options 497
Setting up the IP Phone 500
Configuring the logon script 501
Creating a logon script 502
Creating the script as a batch file 502
Creating the script as a VBScript file 503
Assigning the logon script 503
Nortel Secure Network Access Switch
Using the Command Line Interface
NN47230-100 03.01 Standard
28 July 2008
Copyright © 2007, 2008 Nortel Networks
.

10
Nortel Secure Network Access Switch
Using the Command Line Interface
NN47230-100 03.01 Standard
28 July 2008
Copyright © 2007, 2008 Nortel Networks
.