VPNet VSU 100 User manual

VSU-100
VPNware Service Unit
User Guide
VPNet Technologies, Inc.

VSU-100 User Guide
Licenses, Warranties, Copyrights, and Trademarks
THE SPECIFICATIONS REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO
CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND
RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE
PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST
TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
LIMITED WARRANTY
Hardware. VPNet Technologies, Inc. (“VPNet”) warrants that for a period of one (1) year from the
date of shipment from VPNet that the Hardware will be free from defects in material and
workmanship under normal use. This limited warranty extends only to Customer as the original
purchaser. Customer’s exclusive remedy and the entire liability of VPNet and its suppliers under this
limited warranty will be, at VPNet or its service center's option, repair or replacement within ten (10)
business days or refund of the Hardware if returned to the party supplying the Hardware to Customer,
freight and insurance prepaid. VPNet replacement parts used in Hardware repair may be new or
equivalent to new.
Restrictions. This warranty does not apply if the product (a) has been altered, except by VPNet (b)
has not been installed, operated, repaired, or maintained in accordance with instructions supplied by
VPNet, (c) has been subjected to abnormal physical or electrical stress, misuse, negligence, or
accident, or (d) is used in ultrahazardous activities.
DISCLAIMER OF WARRANTY. EXCEPT AS SPECIFIED IN THIS WARRANTY, ALL EXPRESS
OR IMPLIED CONDITIONS, REPRESENTATIONS, AND WARRANTIES INCLUDING,
WITHOUT LIMITATION, ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE, NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE, ARE HEREBY EXCLUDED TO THE EXTENT
ALLOWED BY APPLICABLE LAW.
IN NO EVENT WILL VPNET OR ITS SUPPLIERS BE LIABLE FOR ANY LOST REVENUE,
PROFIT, OR DATA, OR FOR SPECIAL INDIRECT, CONSEQUENTIAL, INCIDENTAL, OR
PUNITIVE DAMAGES HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF
LIABILITY ARISING OUT OF THE USE OF OR INABILITY TO USE THE PRODUCT EVEN IF
VPNET OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES. In no event shall VPNet's or its suppliers’ liability to Customer, whether in contract, tort
(including negligence), or otherwise, exceed the price paid by Customer. The foregoing limitations
shall apply even if the above-stated warranty fails of its essential purpose.

VSU-100 User Guide
The following information is for FCC compliance of Class B devices: This equipment has been tested
and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC rules.
These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. This equipment generates, uses, and can radiate
radio-frequency energy and, if not installed and used in accordance with the instruction manual, may
cause harmful interference to radio communications. Operation of this equipment in a residential area
is likely to cause harmful interference, in which case users will be required to correct the interference
at their own expense.
BMSI (Chinese Warning Label)
Hardware, including technical data, is subject to U.S. export control laws, including the U.S. Export
Administration Act and its associated regulations, and may be subject to export or import regulations
in other countries. Customer agrees to comply strictly with all such regulations and acknowledges
that it has the responsibility to obtain licenses to export, re-export, or import hardware.
VSU, VPNmanager, VPNremote, VPLink, VPNos, and VPNet are trademarks belonging to VPNet
Technologies, Inc. MD5 Message Digest Algorithm copyright RSA Data Security, Inc. All other
product names mentioned in this manual are trademarks or registered trademarks of their respective
manufacturers.
VSU-100 VPN Service Units User Guide
Copyright 2001 VPNet Technologies, Inc.
All rights reserved. Printed in USA.
January 2001
P/N 09-0041-02

VSU-100 User Guide

Table of Contents
Preface
How This Guide Is Organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i
Product Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i
Contacting Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i
Chapter 1 Introduction
Functional Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
VSU-100 Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
General Site Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Chapter 2 Installing the VSU-100
Connecting the VSU-100 to the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
Chapter 3 Preparing the VSU-100 for Configuration
Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
FIPS Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8
General Firmware Upgrade Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8
APPENDIX A Specifications
Glossary VSU Acronyms

VSU-100 User Guide

i
Preface
This user guide provides installation and configuration information for the
VSU-100 VPN Service Unit (VSU).
How This Guide Is Organized
Chapter 1, Introduction, includes a functional overview of the VSU-100 and its
major components along with site requirements for safe installation and
operation of the VSU-100.
Chapter 2, Installing the VSU-100, provides instructions for physical installation,
including placement and connection to the network.
Chapter 3, Preparing the VSU-100 for Configuration, provides instructions for
setting up VSU-100 addressing and enabling remote connectivity for using the
VPNmanager.
Appendix A, Specifications, documents physical, environmental, electrical, and
compliance specifications, as well as additional features.
Product Registration
To register the VSU-100, navigate to http://www.vpnet.com on the World
Wide Web.
Contacting Technical Support
Technical support is available to registered users of the VSU-100.
•Voice: 1-888-VPNET-88 (within U.S.) or [phone] (outside U.S.)

ii
VSU-100 User Guide
•FAX: [phone]
•Email: [email protected]
•World Wide Web: http://www.vpnet.com

Introduction 1-1
Chapter 1 Introduction
Functional Overview
The VSU-100 is a dedicated hardware-based VPN gateway that enables secure
data communications over public IP networks such as the Internet for a small
enterprise or small office environment.
Designed to work with an existing IP-based WAN-access router, the VSU-100
provides all the services required to implement a virtual private network (VPN),
including a network firewall, in one compact desktop enclosure.
The VSU-100 comes in two models:
•VSU-100 (site-to-site only)
•VSU-100R (site-to-site and supports VPNremote remote client access)
Figure 1-1 The VSU-100

1-2 Introduction
VSU-100 User Guide
The VSU-100R adds remote access support for remote clients running
VPNremote™client software on their PCs. Both units support up to 100
conncurrent IPSec sessions. Each has its own version of embedded operating
system, VPNos. The VSU-100 VPNos can be field upgraded (optional) to the
VSU-100R.
Like other platforms in the VPNware family, the VSU-100 adds encryption,
compression, authentication, and keymanagement to public network data links to
ensure privacy and integrity of corporate data over public IP networks, and to
enable the efficient and secure operation of virtual private networks (VPNs). It is
designed to perform complex operations, in real-time, without compromising
network performance, and in many cases can actually increase data throughput.
The VSU-100 supports a full suite of VPN services including: ICSA-certified
IPSec-based encryption, data compression, packet and user authentication, IKE
and SKIP key management, Network Address Translation (NAT), routing, and
packet filtering.
Security
The VSU-100 provides data stream privacy by employing cryptographic
algorithms and keys powerful enough for the most sensitive business
communications. It supports 56-bit DES and 168-bit Triple DES encryption, as
well as the ISAKMP and SKIP key management standards. The VSU-100 is able
to change keys frequently during transmission.
Data authenticity is assured by using MD5™or SHA-1 hashing to reject altered
or forged packets. All security mechanisms employed by the VSU-100 conform
to IPSec standards, in order to provide interoperability and broaden the use of
VPN technology.
Performance
The VSU-100 supports IP over 10BASE-T or 100BASE-T local area networks
(LANs). Up to 100 concurrent site-tosite IPSec sessions are supported. When
packets are encrypted and authenticated according to IPSec protocol guidelines,
additional bytes—in the form of IPSec headers—must be added to packets. In
many cases, the additional packet overhead imposes a performance penalty in
return for security. The extra bytes may lengthen packets and reduce the
throughput (measured in packets per second). Of even greater impact is the
tendency for packets lengthened by IPSec headers to be fragmented by network
routers, causing further reductions in performance and additional latency. Real-

Introduction 1-3
VSU-100 User Guide
time compression performed by the VSU-100 eliminates packet fragmentation
and produces fewer, smaller packets, which can significantly enhance network
throughput and performance.
Plug-and-Play Installation
The VSU-100 can be placed in a variety of configurations on a 10/100BASE-T
LAN to provide VPN functionality. Native support for IP ensures that the
VSU-100 interoperates transparently with the broadest range of intranet and
other network applications.
The graphical VPNmanager™ (available separately) network management
application steps network managers through the configuration processand allows
them to create a VPN in minutes. The VPNmanager also supports extensive
facilities for VPN monitoring and troubleshooting, and for establishing multi-
company extranets. The VSU-100 provides support for RADIUS servers,
enabling VPNs that support hundreds of remote users and a variety of
mechanisms for remote user authentication.
VSU-100 Components
Each of the major VSU-100 components are shown in Figure 1-2.
Figure 1-2 VSU-100 Front Panel
Ethernet Ports
The VSU-100 includes two 10/100BASE-T Ethernet interfaces for a public
(encrypted) and private (unencrypted) interface port.
Console Port Ethernet Ports
Status Indicators
Private Port Public Port
DC Power
Connector

1-4 Introduction
VSU-100 User Guide
NOTE: The VSU-100 is enclosed in a FIPS 140-1 compliant tamper-evident
case and may be opened only by an authorized service technician.
The status indication of the LEDs on each of the two Ethernet ports are shown in
Figure 1-3 below:
Figure 1-3 Ethernet Port Status Indicators
General Site Requirements
This section describes the requirements your site must meet for safe installation
and operation of your system. Ensure that your site is properly prepared before
beginning installation.
Environmental Requirements
The VSU-100 is intended for use in a normal office environment. For more
extreme conditions, verify that temperature, humidity, and power conditions
meet the specifications indicated in Table 1-1.
Additional VSU-100 specifications are included in Appendix A.
OFF = 10 Mbps Connection
ON = 100 Mbps Connection
Activity
ON = Full Duplex
OFF = Half Duplex
Link
Table 1-1 Environmental Requirements
Item Operating Specification
Temperature 32° to 104° F, 0° to 40°C
Relative Humidity 5-90%, non-condensing
Altitude 0-12,000 feet, 0-3,660 meters
Voltage 100-240 VAC
Input Frequency 47-63 Hz
AC input current 0.7 Amp

Introduction 1-5
VSU-100 User Guide
Site Power Considerations
Check the power at your site to ensure that you are receiving “clean” power (free
of spikes and noise). Install a power conditioner if necessary.
WARNING: This product relies on the building's installation for short-circuit
(overcurrent) protection. Ensure that a fuse or circuit breaker no larger than 120
VAC, 15A U.S. (240 VAC, 10A international) is used on the phase conductor (all
current-carrying conductors).
Required Equipment
The VSU-100 shipping carton should contain:
To install and use the VSU-100 in a typical network, the customer must already
have or supply:
•Router providing connectivity to a WAN such as the Internet
•10/100BASE-T Ethernet hub, router, or switch providing connectivity to the
office LAN
•CAT 3, 4, or 5 UTP cable to interconnect router, VSU-100, and hub(s)
•An asynchronous ASCII terminal supporting RS-232 or a PC running
terminal emulation software to provide initial IP configuration (IP address,
subnet mask, default router)
•PC workstation to run VPNmanager network management application
Quantity Part Description
1 VSU-100 VPN Service Unit
1 VSU-100 VPN Service Unit User Guide
1 Null Modem Cable
1 UTP Crossover Cable
1 VSU-100 DC Power Supply
1 Power cord (110V) or
Power cord (230V)
4 Rubber feet for desktop installations
1 VSU-100 Firmware diskette

1-6 Introduction
VSU-100 User Guide

Installing the VSU-100 2-1
Chapter 2 Installing the VSU-100
This chapter provides instructions for Connecting the VSU-100 to the Network.
Connecting the VSU-100 to the Network
Figure 2-1 shows a typical network using the VSU-100.
Figure 2-1 Typical VSU-100 Hardware Installation
Public
Network
VSU-100
Router
Hub, Switch, Router
Private
Public Port
Private Port
LAN

2-2 Installing the VSU-100
VSU-100 User Guide
The VSU-100 rear panel is shown in Figure 2-2.
Figure 2-2 VSU-100 Frontpanel Connectors
The console port accepts a female RS-232 DB-9 connection from an
asynchronous ASCII terminal or a PC running terminal emulation software. The
connection requires a null modem cable, (supplied) and is used to assign IP
network configuration.
The communication settings for a terminal or PC connected to the console port
are provided in Table 2-1.
The Public port provides an interface to the public network, while the Private
port provides an interface to the private network.
Connect Cable between the
VSU-100 Public Port and the Router
Connect Cable between the VSU-100
Private Port and the Private LAN
Table 2-1 Terminal Settings
Parameter Setting
Baud 9600
Data Bits 8
Stop bits 1
Parity No
Flow control Hardware (RTS/CTS)

Installing the VSU-100 2-3
VSU-100 User Guide
Both Ethernet ports are 10/100BASE-T ports. They accept category 3, 4, or 5
UTP cabling terminated in an RJ-45 connector per IEEE 802.3 requirements for
10/100BASE-T.
Perform the following steps to install the VSU-100 in a typical LAN:
1. Connect the VSU-100 Public port to the public side of the LAN.
2. Connect the VSU-100 Private port to the private side of the LAN.
3. Connect an asynchronous ASCII terminal or PC running terminal emulation
software to the VSU-100 console port using the RS-232 null modem cable
which came with the VSU-100.
The terminal’s communications parameters should be set to 9600 baud, 8 data
bits, 1 stop bit, no parity, and RTS/CTS hardware flow control.
4. Connect the DC power cable from the power supply to the VSU-100, then
plug in the AC power cable into an outlet. Proceed to Chapter 3, Preparing
the VSU-100 for Configuration.
Figure 2-3 Connecting the DC Power Supply to the VSU-100

2-4 Installing the VSU-100
VSU-100 User Guide

Preparing the VSU-100 for Configuration 3-1
Chapter 3 Preparing the VSU-100 for
Configuration
Preparation
Before the VSU-100 can be incorporated into a Virtual Private Network (VPN),
it must be configured through the VPNmanager. However, to enable
communication between the VPNmanager and the VSU-100, you must first
assign an IP address, subnet mask, and default route to the VSU-100.
This chapter describes how to set up the VSU-100 addressing and remote
connectivity capabilities in preparation for remote configuration using the
VPNmanager software. This preliminary configuration is performed using a
terminal (or a PC running terminal emulation software) connected to the RS-232
console port.
The following procedure assumes that the VSU-100 has been physically installed
on the network, according to the instructions provided in Chapter 2
Configuration
Beginning with VPNware 3.1, the following information is configured through
the VSU console Quick Setup:
•The VSU’s IP address and mask.
•The VSU’s secondary IP address and mask (Optional).
•The VSU’s default route.
•The VSU console password. Beginning with VPNware 3.1, if you forget this
password and need console access, it can be changed through the
VPNmanager’s Configuration console. Select the VSU Advanced Action tab,
then the Reset Password dialog box.

3-2 Preparing the VSU-100 for Configuration
VSU-100 User Guide
•The SuperUser name. This is the name that is authorized to perform any kind
of configuration request on a VSU. This name is provided by the
VPNmanager administrator the first time the VSU is added into the
VPNmanager database. The SuperUser name is case sensitive.
•The SuperUser password. This password authenticates the SuperUser name.
The SuperUser password is case sensitive. If the VPN administrator forgets
the SuperUser password, the VSU may still be reconfigured through the VSU
console Quick Setup menu as long the administrator has access to the VSU
console and knows the VSU console password.
•Configuration of blocking mode. This involves selecting one of three filtering
choices according to your organization’s security policy:
Permit all non-VPN traffic - When checked (default), all non VPN traffic is
allowed to pass through the VSU.
Deny all IP non-VPN traffic - When checked, all non-IP traffic is passed
through the VSU. All non-VPN IP traffic is dropped except for the following:
ICMP, IGMP, GGP, EGP, IGP, DGP, EIGRP, and OSPF. NOTE: This mode
should be used when the VSU dedicated to VPN traffic and is the only device
between the private and the public networks.
Deny all non-VPN traffic - When checked, all non-VPN traffic is prevented
from passing through the VSU. This mode blocks non-IP traffic and non-
VPN IP traffic including broadcast traffic (e.g. ARPs), IP-multicast traffic
(e.g. OSPF updates) and other traffic containing routing information. NOTE:
This mode should be used when the VSU is dedicated to VPN traffic and is in
parallel with another device (such as a router or firewall) that will enforce
the network's non-VPN traffic policy. This mode should not be used when the
VSU is the only path between network devices and a router with which those
devices need to communicate.
•Setting the unit to run in FIPs-compliant mode or not.
•The current time and date.
NOTE: Each of these items are preserved over firmware upgrades.
When the VSU-100 is powered on for the first time, the terminal screen should
display the initial power on bootup screen shown in Figure 3-1.