Nortel 3050 Manual de usuario

Nortel Networks

VPN Gateway 3050

RSA SecurID Ready Implementation Guide

Last Modified: March 14, 2008

Partner Information

Product Information

Partner Name Nortel Networks

Web Site www.nortelnetworks.com

Product Name VPN Gateway 3050

Version & Platform 7.0.1.0

Product Description The Nortel Networks VPN Gateway 3050 is a remote access

security solution that extends the reach of enterprise applications

and resources to remote users. The gateway performs on-the-fly

content transformation to instantly convert most intranet resources

into externally-viewable, secure HTML pages and employs an

advanced network address and port translation (NAPT) utility to

build SSL-secured VPN tunnels for client/server communications

Product Category Perimeter Defense (VPN, Firewalls & Intrusion Detection)

Solution Summary

The Nortel Networks VPN Gateway 3050 is a remote access security solution that extends the reach of

enterprise applications and resources to remote employees, partners, and customers. By using the

native capability of widely deployed Web browsers, the SSL VPN Gateway offers a convenient clientless

alternative for securely provisioning resources for remote users, without the need to install and manage

client tunneling software on their PCs.

Due to the clientless nature of this solution, Strong two factor authentication is essential to ensure the

identity of users connecting to your Enterprise from the internet. For this reason, Nortel Networks VPN

Gateway 3050 provides support for the RSA Authentication Manager as a method of strong

authentication for users using RSA SecurID Authentication.

For enterprises maintaining IPsec VPN environments, the Nortel VPN Gateway 3050 provides a new

level of deployment flexibility and end-user support by incorporating IPsec VPN client termination to

remove the network administrator's challenge of managing multiple devices to deliver both types of

remote access service.

Partner Integration Overview

Authentication Methods Supported Native RSA SecurID Authentication, RADIUS

List Library Version Used 5.0.3

RSA Authentication Manager Replica Support * Full Replica Support

Secondary RADIUS Server Support Yes Support for 2 Secondary Serves

RSA Authentication Agent Host Type Communication Server

RSA SecurID User Specification Designated Users,

RSA SecurID Protection of Administrative Users Yes via RADIUS. See Known issues.

RSA Software Token and RSA SecurID 800 Automation No

Product Requirements

Partner Product Requirements: Nortel VPN Gateway 3050

Firmware Version 7.0.1.0

Hardware Platform

Platform Required Patches

VPN 3050, ASA 310, ASA 410, ASA 310 FIPS N/A

Additional Software Requirements

Application Additional Patches

Internet Explorer 5.0, 5.5 and 6.0

RSA SecurID files

RSA SecurID Authentication Files

Files Location

sdconf.rec In Memory

Node Secret In Memory

sdstatus.12 In Memory

sdopts.rec Not implemented

Go to the appendix of this document to get detailed information regarding

these files.

Agent Host Configuration

Important: “Agent Host” and “Authentication Agent” are synonymous.

“Agent Host” is a term used with the RSA Authentication Manager 6.x

servers and below. RSA Authentication Manager 7.1 uses the term

“Authentication Agent”.

Important: All “Authentication Agent” types for 7.1 should be set to

“Standard Agent”.

To facilitate communication between the Nortel VPN Gateway and the RSA Authentication Manager /

RSA SecurID Appliance, an Agent Host record must be added to the RSA Authentication Manager

database and the RADIUS server database if using RADIUS. The Agent Host record identifies the Nortel

VPN Gateway within its database and contains information about communication and encryption.

To create the Agent Host record, you will need the following information.

•Hostname

•IP Addresses for all network interfaces

When adding the Agent Host Record, you should configure the Nortel VPN Gateway as Communication

Server. This setting is used by the RSA Authentication Manager to determine how communication with

the Nortel VPN Gateway will occur.

To create the RADIUS client record, you will need the following information.

•Hostname

•IP Addresses for all network interfaces

•RADIUS Secret

Note: Hostnames within the RSA Authentication Manager / RSA SecurID

Appliance must resolve to valid IP addresses on the local network.

Please refer to the appropriate RSA Security documentation for additional information about Creating,

Modifying and Managing Agent Host records.

Partner Authentication Agent Configuration

Before You Begin

This section provides instructions for integrating the partners’ product with RSA SecurID Authentication.

This document is not intended to suggest optimum installations or configurations.

It is assumed that the reader has both working knowledge of all products involved, and the ability to

perform the tasks outlined in this section. Administrators should have access to the product

documentation for all products in order to install the required components.

All vendor products/components must be installed and working prior to the integration. Perform the

necessary tests to confirm that this is true before proceeding.

Nortel VPN Gateway 3050 Agent configuration

Administrative tasks can be performed in the Command Line Interface (CLI) as well as the Web

Administration GUI. All configuration steps and screenshots in this guide will refer to GUI administration.

Please refer to Nortel Administrative documentation for more complete details on CLI and GUI

Administration tasks.

RSA SecurID Authentication Configuration Overview

1. Create a User Group

2. Configure the RSA Server record

3. Configuring the RSA SecurID Authentication Servers

RADIUS Authentication Configuration Overview

1. Create a User Group

2. Configuring the RADIUS Authentication Servers

Creating and Configuring a RSA SecurID or RADIUS User Group

1. From the admin console, expand VPN Gateways and click Add to add a VPN Gateway.

2. Click

Create VPN.

3. Now click on the VPN Gateway you just created and click on Groups.

4. Click on the button Add New Group.

5. Fill out the form with the desired group name, user type and description.

6. Click Update and then Apply to add the new group to the configuration.

7. From the Groups menu on the administration console, click on the group name.

8. Select the Access List tab.

9. Create an appropriate Access list based on your organizations configuration. In the example below you will

see we have created a generic rule allowing all access for authenticated RSA SecurID or RADIUS users.

10. Click Update to apply the Access rules.

11. Configure the user group for any necessary links or VPN Settings as required.

12. Click Apply to add the new information to the IOS configuration.

Configure the RSA Server record

1. Open the Management Interface (MIP) of the Nortel VPN Gateway using a web browser. Authenticate with

administrative user account and select the Config tab.

2. From the SSL-VPN admin menu select Administration > RSA Servers item.

3. Click the Add button and complete the form.

4. Click Apply to commit changes to the IOS configuration.

Note: You must Update and Apply the RSA Server Group entry before

you import the sdconf.rec file

5. To import your sdconf.rec file you will return to the RSA Servers menu and modify the entry for the

sdconf.rec file you will be adding.

6. Click import to upload the sdconf.rec file and then click Apply changes to the IOS configuration.

Configuring the RSA SecurID Authentication Servers

1. From the admin console, select VPN Gateways > Authentication.

2. Click Add.

3. Enter information for the Authentication Server such as Name and Display Name. The Authentication

Mechanism will be RSA. Then click update to complete additional RSA SecurID authentication options.

4. Select the Settings tab and fill in the appropriate information.

•RSA Server IP.Hostname: Select the RSA Authentication Manger server you created.

•Group For RSA Authenticated Users: Select The Group name you created for the.

5. Click Update and then Apply to add the new information to the IOS configuration.

Configuring the RADIUS Authentication Servers

6. From the admin console, select VPN Gateways > Authentication.

7. Click Add.

8. Enter information for the Authentication Server such as Name and Display Name. The Authentication

Mechanism will be RADIUS. Then click update to complete additional RADIUS authentication options.

9. Select the Servers tab and click Add.

10. Enter the appropriate information for you server and click Update.

Note: You can add a maximum of three RSA RADIUS servers to this

authentication server list.

11. Click Apply to add the new information to the IOS configuration.

Configuring RADIUS Authentication Servers for Administrative Access

1. From the admin console, select Administration > RADIUS.

2. Click Add.

3. Enter information for the RADIUS Authentication Server.

4. Click update.

5. Enable authentication by selecting enabled for RADIUS Authentication Status.

6. Click update then Apply.

NEW-PIN mode does not work via the admin console. See the Known

issues section of this guide for more information.

Testing the configuration

1. Open a web browser and point to the portal address.

2. For user credentials enter a SecurID username and Passcode.

3. From the Login Service list select your RSA SecurID or RSA RADIUS challenge group.

4. Click Login to authenticate and enter the Portal Server.

Note: The user name does not need to exist on the VPN Gateway 3050

in order to be authenticated. The VPN Gateway 3050 will pass off

authentication to the RSA Authentication Manager as a trusted

authentication source.

Otros manuales para 3050

Tabla de contenidos

Otros manuales de Puerta de Nortel

Nortel

Nortel 9110 Manual de instrucciones

Nortel

Nortel 9110 Manual de instrucciones

Nortel

Nortel MCG3100 Manual de instrucciones

Nortel

Nortel 911x Series Manual de usuario

Nortel

Nortel 1000 Con?guration guide Manual de usuario

Nortel

Nortel 9110 Manual de usuario

Nortel

Nortel 2000 Manual

Nortel

Nortel 3100 Series Manual de usuario

Nortel

Nortel BSG8ew 1.0 Manual de usuario

Nortel

Nortel MCG3100 Manual de usuario

Nortel

Nortel MCG3100 Manual de instrucciones

Nortel

Nortel Secure Router 4134 Manual de usuario

Nortel

Nortel BSG12 Instrucciones originales

Nortel

Nortel SRG200 Manual de usuario

Nortel

Nortel MCC 3100 Manual técnico

Nortel

Nortel NN46120-104 Manual de usuario

Nortel

Nortel VT100 Manual de usuario

Nortel

Nortel 3050 Manual de usuario

Nortel

Nortel BSG12aw/ew/tw Manual de usuario

Nortel

Nortel 1000 Con?guration guide Manual de usuario

Nortel

Nortel SRG200 Manual de usuario

Nortel

Nortel MG 3200 Manual de usuario

Nortel

Nortel 1000 Con?guration guide Manual de instrucciones

Nortel

Nortel Internet BWA System 3200 Manual de usuario

Manuales populares de Puerta de otras marcas

LST

LST M500RFE-AS Manual de usuario

Kinnex

Kinnex Media Gateway Manual de usuario

2N Telekomunikace

2N Telekomunikace 2N StarGate Manual de usuario

Mitsubishi Heavy Industries

Mitsubishi Heavy Industries Superlink SC-WBGW256 Manual de usuario

ZyXEL Communications

ZyXEL Communications ZYWALL2 ET 2WE Manual de usuario

Telsey

Telsey CPVA 500 - SIP Manual de usuario

RTA

RTA 460A-NNA4 Hoja de especificaciones

Shaw

Shaw Gateway HDPVR Manual de usuario

ABB

ABB VSN900 Guía de inicio rápido

Commander

Commander Pulse Manual de usuario

2N Telekomunikace

2N Telekomunikace ATEUS EasyGate 501309E Manual de usuario

NETGEAR

NETGEAR C6300BD Manual de usuario

Amit

Amit CDW531AM Manual de usuario

HMS

HMS Netbiter EasyConnect EC150 Manual de usuario

Huawei

Huawei EchoLife HG620 Manual de usuario

AT&T

AT&T U-verse 3801 Manual de uso y cuidado

Logic IO

Logic IO RTCU MX2 turbo Manual de usuario

Suttle

Suttle MediaMAX MXM-521 Manual de usuario