HP Sa3110 - VPN Server Appliance Manual de usuario

Hewlett-Packard Company

HP: 5971-0873

P/N: A55307-001

March 2001

hewlett-packard vpn server

appliance sa3110/sa3150/

sa3400/sa3450

network layout reference guide

iii

Disclaimer

DisclaimerDisclaimer

Disclaimer

Information in this document is provided in connection with

Hewlett-Packard Company products. No license, express or

implied, by estoppel or otherwise, to any intellectual property

rights is granted by this document. Except as provided in

Hewlett-Packard Company’s Terms and Conditions of Sale for

such products, Hewlett-Packard Company assumesno liability

whatsoever,and Hewlett-Packard Company disclaims any

express or implied warranty, relating to sale and/or use of

Hewlett-Packard Company products including liability or

warranties relating to fitness for a particular purpose,

merchantability, or infringement of any patent, copyright or

other intellectual property right. Hewlett-Packard Company

products are not intended for use in medical, life saving, or life

sustaining applications.

Hewlett-Packard Companymay make changes to specifications

and product descriptions at any time, without notice.

This

Hewlett-Packard VPN Server Appliance SA3110/SA3150/

SA3400/SA3450 Network Layout Reference Guide

, as well as

the software described in it is furnished underlicense and may

only be used or copied in accordance with the terms of the

license. The information in this manual is furnished for

informationaluse only, is subject to change without notice, and

should not be construed as a commitmentby Hewlett-Packard

Company.Hewlett-PackardCompanyassumesnoresponsibility

or liability for any errors or inaccuracies that may appear in this

document or any software that may be provided inassociation

with this document.

Except as permitted by such license, no part of this document

may be reproduced, stored in a retrieval system, or transmitted

inanyformorbyanymeanswithouttheexpresswrittenconsent

of Hewlett-Packard Company.

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide i

Contents

ContentsContents

Contents

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 NetworkHP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

Layout Reference Guide

Layout Reference GuideLayout Reference Guide

Layout Reference Guide

Network Layout Reference Guide . . .. . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

One-Armed Router Configuration With No Firewall. . . . . . . . . . . . . . . . . . . . . . . . . 2

Inline Router Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

In Parallel With Firewall (Extranet or Intranet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Bridge Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Edge Router Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Behind a Firewall With or Without NAT (One-Armed) . . . . . . . . . . . . . . . . . . . . . 11

Behind a Firewall With or Without NAT (Inline) . . . . . . . . . . . . . . . . . . . . . . . . . . 13

The VPN Device as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (Without NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (With NAT). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Behind a Firewall (One-Armed) With or Without NAT . . . . . . . . . . . . . . . . . . . . . 21

Behind a Firewall That May or May Not Use NAT (Inline) . . . . . . . . . . . . . . . . . . 24

The VPN Device as a Firewall (With or Without NAT) . . . . . . . . . . . . . . . . . . . . . 27

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide 1

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

1Network Layout Reference Guide

Network Layout Reference GuideNetwork Layout Reference Guide

Network Layout Reference Guide

The purpose of this

Network Layout Reference Guide

is to help

you install the HP VPN ServerAppliance SA3110/SA3150/

SA3400/SA3450in your network.The termVPN device isused in

this document to refer to all of these devices.

Here are some real-world examples of how the VPN device can

be incorporated into your network infrastructure. Skim through

the following scenarios and find the ones most similar to your

network configuration. Then, note the corresponding

configuration options to help you quickly install the VPN device

into your network.

Scenarios are divided into client and LAN-to-LAN.

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios • One-armed router configuration (VPN server) with no

firewall

• Inline router configuration

• In parallel with firewall (for extranet or intranet)

• Bridge configuration

• Edge router configuration

• Behind a firewall (one-armed) that may or may not use

network address translation (NAT)

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall

LAN-to-LAN

LAN-to-LANLAN-to-LAN

LAN-to-LAN

Scenarios

ScenariosScenarios

Scenarios • In parallel with a firewall and no NAT

• In parallel with a firewall with NAT

• Behind afirewall (one-armed) that mayor may not use NAT

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall (may or may notuse NAT)

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios

If you are using the VPN device with the HP SA3000 Series VPN

Client, skim the following scenarios and find the ones most

similar to your network configuration. Then, use the

corresponding table of configuration parameters as a guideline

when configuring your VPN device and VPN Client.

If you are using the VPN device in LAN-to-LAN configurations,

skip to the next section “LAN-to-LAN Scenarios.”

One-Armed

One-ArmedOne-Armed

One-Armed

Router

RouterRouter

Router

Configuration

ConfigurationConfiguration

Configuration

With No

With NoWith No

With No

Firewall

FirewallFirewall

Firewall

This scenario shows the following:

• One-armed configuration uses only one of the VPN device’s

two interfaces.

• Firewall is not enabled.

• The VPN device (VPND) acts as a VPN server.

Figure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No FirewallFigure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No Firewall

Configuring a One-Armed Router Configuration

Configuring a One-Armed Router ConfigurationConfiguring a One-Armed Router Configuration

Configuring a One-Armed Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the HP SA3000 Series VPN Manager or command shell.

Desktop

System

Desktop

System

Internal

Network

Internet Router

VPND

Internet

Connection

Direct

Dial

Laser Printer

PSTN

Router or Remote

Access Server

No Firewall

Functions

Router Mode

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 3

To set up a one-armed router configuration, use the

configuration parameters in the following table. Note that the

values of these parametersare examples only; you must enter

values specific to your network.

Table:

Table:Table:

Table: O

One-Armed Router Configuration Parameters

ne-Armed Router Configuration Parametersne-Armed Router Configuration Parameters

ne-Armed Router Configuration Parameters

Inline Router

Inline RouterInline Router

Inline Router

Configuration

ConfigurationConfiguration

Configuration In this scenario, VPN Client traffic is handled either through a

router (inline) or by directly dialing into the public-switched

telephone network (PSTN).

• For inline router configurations:

— The router accepts all incoming client traffic then trans-

fers the traffic to the VPN device.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1: (not used for

one-armed)

IP: NA

Mode: NA

Interface E1: (not used for one-

armed)

IP: NA

Mode: NA

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.2

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

HP SA3000 Series VPN Client

IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

4 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

— The VPN device then transfers the traffic on to the local

network to which it is attached. The VPN device may or

may not perform firewall functions on the traffic.

• For direct dial into the PSTN:

— Traffic may go through a router or remote access server,

which may or may not perform NAT.

— The traffic then goes through the VPN device,which

may or may not perform firewall functions on the

traffic.

Figure: Inline Router Configuration

Figure: Inline Router ConfigurationFigure: Inline Router Configuration

Figure: Inline Router Configuration

Configuring an Inline Router Configuration

Configuring an Inline Router ConfigurationConfiguring an Inline Router Configuration

Configuring an Inline Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the VPN Manager or command shell.

To set up an inline router configuration, use the configuration

parameters in the following table. Note that the values of these

parameters are examples only; you must entervaluesspecific to

your network.

With/Without

Firewall

Functions

Internet Router

Internet Connection

Direct Dial

VPND

Desktop

System

File Server

Laser Printer

PSTN

May/May Not NAT

Router Mode

Internal

Network

Router or

Remote Access Server

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 5

Table:

Table:Table:

Table:

Inline Router Configuration Parameters

Inline Router Configuration ParametersInline Router Configuration Parameters

Inline Router Configuration Parameters

In Parallel With

In Parallel WithIn Parallel With

In Parallel With

Firewall

FirewallFirewall

Firewall

(Extranet or

(Extranet or(Extranet or

(Extranet or

Intranet)

Intranet)Intranet)

Intranet)

In this scenario, VPN Client traffic is handled either through a

router(inline) or by directly dialing in to the PSTN. In addition,

there is a third-party firewall on the network handling firewall

functionality.

• For inline router configurations:

— The router accepts all incoming client traffic, then trans-

fers the traffic to the VPN device.

— The VPN device then transfers the traffic to the local

network to which it is attached.

— The VPN device is in router mode and doesnot perform

firewall functions.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1:

IP: 192.168.10.2 255.255.255.0

Mode: Red

Interface E1:

IP: 210.35.129.2 255.255.255.0

Mode: Red

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.3

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

Otros manuales para Sa3110 - VPN Server Appliance

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Servidor de HP

HP D7171A - NetServer - LPr Manual de usuario

HP NetServer AA 4000 Manual de usuario

HP Integrity rx2620 Manual de usuario

HP L1000 - 9000 - 0 MB RAM Instrucciones de funcionamiento

HP Integrity rx4640 Manual de instalación y operación

HP Rp3440-4 - 9000 - 0 MB RAM Manual del propietario

HP LC2000r - NetServer - 128 MB RAM Manual de instalación y operación

HP T5720 - Compaq Thin Client Hoja de especificaciones

HP LaserJet 9000 Manual de usuario

HP ProLiant DL140 Manual

HP t5300 - Thin Client Manual de usuario

HP BL920s Gen9 Instrucciones de montaje

HP D7171A - NetServer - LPr Manual de usuario

HP ProLiant DL145 Manual de usuario

HP NetServer E 45 Manual de usuario

HP Integrity rx6600 Manual de usuario

HP D7171A - NetServer - LPr Manual de usuario

HP ProLiant DL140 Instrucciones de montaje

HP Integrity NonStop NB54000c Manual de referencia

HP Compaq Presario,Presario 4400 Guía de inicio rápido

HP ProLiant ML110 Gen9 Manual

HP ProLiant DL980 Manual de usuario

HP ProLiant ML310 Generation 5p Manual de usuario

Manuales populares de Servidor de otras marcas

Dell

Dell PowerEdge R410 Manual de usuario

PowerNAS

PowerNAS CMA Manual de usuario

Supero

Supero FatTwin F617R3-FT Manual de usuario

MSI

MSI P1-109N-L70 Manual de usuario

Dell

Dell PowerEdge XE9640 Manual

Dell

Dell PS4100 Instrucciones de montaje

EtroVISION

EtroVISION EV3151 Manual de usuario

NEC

NEC Express5800/T110j Manual de usuario

Compaq

Compaq ProLiant 3000 Manual

Dell

Dell PowerEdge 3YPMN Manual de usuario

iRobo

iRobo IPC2U Manual de usuario

Nortel

Nortel 1000 Con?guration guide Manual de usuario

Asus

Asus AP7500 Manual de operación y mantenimiento

Avid Technology

Avid Technology AirSpeed 5000 Manual de usuario

Milestone

Milestone Husky IVO 350T Manual de usuario

Planet

Planet NAS-7410 Manual de usuario

Lenovo

Lenovo ThinkSystem SR635 V3 Manual de usuario

Dell

Dell PowerEdge HS5610 Manual