Manuels d'utilisation pour Nortel Networks 620

Manuel D’Utilisation (English)

Manuel D’Utilisation

Table des matières

Contents
5
About this IPSec Configuration Guide
11
- Abstract
  11
- Applicability
  11
- Used Symbols
  11
- Terminology
  11
- Documentation and software updates
  11
1 IPSec: Concept for secure IP connections
13
- Policies
  13
- The Target of IPSec
  13
- In this section
  13
- 1.1 IPSec Concepts
  14
  - Red and Black Network
    14
  - Authentication Header
    14
  - Encapsulated Security Payload
    14
  - Internet Key Exchange
    15
  - Security Associations
    15
  - Tunnel Mode
    15
  - Transport Mode
    15
2 SpeedTouch™ IPSec terminology
17
- Introduction
  17
- In this section
  17
- 2.1 Policy
  18
  - What is ...
    18
  - Static policy
    18
  - Dynamic policy
    18
- 2.2 Security Descriptor
  19
  - What is ...
    19
  - IKE session Descriptor
    19
  - IPSec Descriptor
    19
- 2.3 Authentication Attribute
  20
  - What is ...
    20
- 2.4 Peer (Phase 1)
  21
  - What is ...
    21
- 2.5 Connection (Phase 2)
  22
  - What is ...
    22
- 2.6 Network descriptor
  23
  - What is ...
    23
3 Configuration via Local Pages
25
- Prerequisites
  25
- IPSec Web Pages
  25
- VPN Menu
  25
- In this section
  26
- 3.1 LAN to LAN Application
  27
- 3.2 VPN Client
  53
- 3.3 VPN Server
  65
- 3.4 Certificates
  75
  - Introduction
    75
  - Secure Storage page
    75
  - Request Import page
    75
  - CRL page
    75
  - CRL Distribution Point
    75
  - CEP page
    76
  - Enrollment URL
    76
  - Subject DN
    76
- 3.5 Advanced VPN Menu
  77
  - When to use
    77
  - Peer Profiles page
    78
  - Connection Profiles page
    79
  - 3.5.1 Peer Profiles Page
    80
    - Peer Profiles page layout
      80
    - Peer name
      80
    - Remote address
      80
    - Backup remote address
      80
    - Local ID
      81
    - Remote ID
      81
    - Primary Untrusted Physical Interface
      82
    - Exchange mode
      82
    - Authentication
      82
    - Peer Descriptor
      82
    - Client/Server
      82
    - Peer Options
      83
  - 3.5.2 Authentication Page
    84
    - Authentication page layout
      84
    - Parameter table
      84
  - 3.5.3 Peer Descriptors Page
    85
    - Descriptors page layout
      85
    - Parameter table
      85
    - Peer Descriptor name
      85
    - Crypto
      86
    - Integrity
      86
    - Group
      86
    - Lifetime-secs
      86
  - 3.5.4 Peer Options Page
    87
    - Options page layout
      87
  - 3.5.5 VPN-Client Page
    88
    - VPN-Client page layout
      88
    - Client descriptor name
      88
    - Configuring XAuth
      88
    - Gateway Vendor
      88
    - Type
      89
  - 3.5.6 VPN-Server Page
    90
    - VPN-Server page layout
      90
    - Server descriptor name
      90
    - Virtual IP Range
      90
    - Netmask
      90
    - Push IP
      90
    - Domain
      90
    - Primary DNS
      90
    - Secondary DNS
      91
    - Primary WINS
      91
    - Secondary WINS
      91
    - XAuth Pool
      91
  - 3.5.7 VPN-Server-XAuth Page
    92
    - VPN-Server-XAuth page layout
      92
    - XAuth pool name
      92
    - Type
      92
    - Username and Password
      92
  - 3.5.8 Connection Profiles Page
    93
    - Connection Profiles page layout
      93
    - Connection name
      93
    - Peer name
      93
    - Local network
      94
    - Remote network
      94
    - Always on
      94
    - Connection Descriptor
      94
    - Connection Options
      95
    - Connection enabled
      95
  - 3.5.9 Networks Page
    96
    - Networks page layout
      96
    - What is a Network Descriptor?
      96
    - How is it used?
      96
    - Network name
      96
    - Type of network and IP address
      96
    - Protocol
      97
    - Port
      97
  - 3.5.10 Connection Descriptors Page
    98
    - Descriptors page layout
      98
    - Parameter table
      99
    - Connection Descriptor name
      99
    - Crypto
      99
    - Integrity
      100
    - Encapsulation
      100
    - PFS
      100
    - Lifetime-secs
      100
    - Lifetime-kbytes]
      100
  - 3.5.11 Connection Options Page
    101
    - Options page layout
      101
  - 3.5.12 Client Page
    102
    - Client page layout
      102
    - Connection
      102
    - Local ID
      102
    - Configuring XAuth
      102
4 Configuration via the Command Line Interface
103
- In this chapter
  103
- Reference network
  103
- 4.1 Basic IPSec configuration procedure
  104
  - Terminology
    104
  - Procedure
    105
- 4.2 Peer: Authentication Attribute
  106
  - What is ...
    106
  - How is it used
    106
  - In this section
    106
  - 4.2.1 Authentication Attribute Parameters
    107
    - Parameter table
      107
  - 4.2.2 List all Authentication Attributes
    108
    - list command
      108
    - Example
      108
  - 4.2.3 Create a New Authentication Attribute
    109
    - add command
      109
    - Example
      109
  - 4.2.4 Set or Modify the Authentication Attribute Parameters
    110
    - modify command
      110
    - Example
      110
  - 4.2.5 Delete an Authentication attribute
    111
    - delete command
      111
    - Example
      111
- 4.3 Peer Security Descriptor
  112
  - What is ...
    112
  - How is it used
    112
  - In this section
    112
  - 4.3.1 Peer Security Descriptor Parameters
    113
    - Parameter table
      113
    - Example
      113
    - Peer Descriptor name [name]
      113
    - Cryptographic function [crypto]
      114
    - Key length [keylen]
      114
    - Authentication Hashing function [integrity]
      114
    - Diffie-Hellman group [group]
      114
    - IKE SA lifetime [lifetime_secs]
      115
  - 4.3.2 List all Peer Security Descriptors
    116
    - list command
      116
    - Example
      116
  - 4.3.3 Create a New Peer Security Descriptor
    117
    - add command
      117
    - Example
      117
  - 4.3.4 Set or Modify the Peer Descriptor Parameters
    118
    - modify command
      118
    - Example
      118
  - 4.3.5 Delete a Peer Descriptor
    119
    - delete command
      119
    - Example
      119
- 4.4 Peer
  120
  - What is ...
    120
  - How is it used
    120
  - In this section
    120
  - 4.4.1 Peer parameters
    121
    - Parameters table
      121
    - Peer name [name]
      121
    - Remote Security Gateway identifier [remoteaddr]
      122
    - Backup remote Security Gateway Identifier [backupaddr]
      122
    - Exchange mode [exchmode]
      122
    - Local Identifier [localid]
      122
    - Remote Identifier [remoteid]
      123
    - Physical Interface [phyif]
      124
    - Peer descriptor [descr]
      124
    - Authentication Attribute [auth]
      124
    - client/server
      124
    - options
      124
  - 4.4.2 List all peer entities
    125
    - list command
      125
    - Example
      125
  - 4.4.3 Create a new peer entity
    126
    - add command
      126
    - Example
      126
  - 4.4.4 Set or modify the peer parameters
    127
    - modify command
      127
    - Example
      127
  - 4.4.5 Delete a Peer entity
    128
    - delete command
      128
    - Example
      128
- 4.5 Connection Security Descriptor
  129
  - What is ...
    129
  - How is it used
    129
  - In this section
    129
  - 4.5.1 Connection Security Descriptor parameters
    130
  - 4.5.2 List all Connection Security Descriptors
    133
    - list command
      133
    - Example
      133
  - 4.5.3 Create a new Connection Security Descriptor
    134
    - add command
      134
    - Example
      134
  - 4.5.4 Set the Connection Security Descriptor Parameters
    135
    - modify command
      135
    - Example
      135
  - 4.5.5 Delete a Connection Security Descriptor
    136
    - delete command
      136
    - Example
      136
- 4.6 Network Descriptor
  137
  - What is ...
    137
  - How is it used
    137
  - In this section
    137
  - 4.6.1 Network Descriptor Parameters
    138
    - Parameters table
      138
    - Network name [name]
      138
    - Type of network and IP address [type] and [ip]
      138
    - Protocol [proto]
      139
    - Port [port]
      139
  - 4.6.2 Create a New Network Descriptor
    140
    - add command
      140
    - Example
      140
  - 4.6.3 Set the Network Descriptor Parameters
    141
    - modify command
      141
    - Example
      141
  - 4.6.4 Delete a Network Descriptor
    142
    - delete command
      142
    - Example
      142
- 4.7 Connection
  143
  - What is ...
    143
  - How is it used
    143
  - In this section
    143
  - 4.7.1 Connection Parameters
    144
    - Parameters table
      144
    - Connection name [name]
      144
    - Peer [peer]
      144
    - Local network [localnetwork]
      145
    - Remote network [remotenetwork]
      145
    - Always-on connection [alwayson]
      146
    - Descriptors [descr]
      146
    - Options [options]
      146
    - State [state]
      146
  - 4.7.2 List all Connections
    147
    - list command
      147
    - Example
      147
  - 4.7.3 Create a New Connection
    148
    - add command
      148
    - Example
      148
  - 4.7.4 Set or Modify the Connection Parameters
    149
    - modify command
      149
    - Example
      149
  - 4.7.5 Delete a Connection
    150
    - delete command
      150
    - Example
      150
  - 4.7.6 Start a Connection
    151
    - start command
      151
    - Example
      151
  - 4.7.7 Stop a connection
    152
    - stop command
      152
    - Example
      152
- 4.8 Auxiliary Commands
  153
  - In this section
    153
  - 4.8.1 Config Command
    154
    - What is it used for
      154
    - Display the VPN configuration settings
      154
    - Control of general VPN settings
      154
    - Example
      154
    - AutoRoute
      154
    - AutoProxyARP
      155
    - When do I need ProxyARP
      155
    - An example of Auto ProxyARP
      156
  - 4.8.2 Flush Command
    157
    - What is it used for
      157
  - 4.8.3 Clear Command Group
    158
    - What is it used for
      158
    - clear all
      158
    - clear session
      158
- 4.9 Organisation of the IPSec Command Group
  159
  - Introduction
    159
  - ipsec command group
    159
  - Clear command group
    159
  - Connection command group
    160
  - Debug command group
    160
  - Peer command group
    161
  - Show command group
    162
5 Troubleshooting SpeedTouch™ IPSec
163
- Introduction
  163
- In this section
  163
- 5.1 Via the Debug Web pages
  164
- 5.2 Via the CLI: Show command group
  167
  - Show command group
    167
- 5.3 Via the CLI: Debug command group
  169
  - Traceconfig command
    169
  - Via Syslog messages
    170
  - Syslog messages
    171
- 5.4 Via SNMP
  172
  - Debugging via SNMP
    172
- 5.5 Pinging from the SpeedTouch™ to the remote private network
  173
  - Ping command
    173
  - Adapting the routing table
    173
6 Advanced Features
175
- In this section
  175
- 6.1 IPSec and the Stateful Inspection Firewall
  176
  - What about ...
    176
- 6.2 Surfing through the VPN tunnel
  177
  - Web Browsing Interception and surfing through a tunnel
    177
- 6.3 Extended Authentication (XAuth)
  178
  - What is ...
    178
  - How does it work
    178
- 6.4 VPN Client
  179
  - Introduction
    179
  - 6.4.1 VPN Client parameters
    180
    - Parameters table
      180
  - 6.4.2 Create a new vpnclient
    181
    - add command
      181
    - Example
      181
  - 6.4.3 Set or modify the vpnclient parameters
    182
    - modify command
      182
    - Example
      182
  - 6.4.4 Attach the vpnclient entity to the peer entity
    183
    - modify the peer parameters
      183
    - Example
      183
- 6.5 VPN Server
  184
  - Introduction
    184
  - 6.5.1 VPN Server parameters
    185
    - Parameters table
      185
    - Connection name [name]
      185
    - Push IP address [push_ip]
      186
    - VPN clients IP address range
      186
    - Client netmask
      186
    - XAuth pool
      186
  - 6.5.2 Create a new VPN server
    187
    - add command
      187
    - Example
      187
  - 6.5.3 Set or modify the vpnserver parameters
    188
    - modify command
      188
    - Example
      188
  - 6.5.4 Attach the vpnserver entity to the peer entity
    189
    - modify the peer parameters
      189
    - Example
      189
- 6.6 XAuth Users Pool
  190
  - Introduction
    190
  - 6.6.1 XAuth Pool parameters
    191
    - Parameters table
      191
  - 6.6.2 Create a new XAuth pool
    192
    - add command
      192
    - Example
      192
  - 6.6.3 Modify the xauthpool type
    193
    - modify command
      193
    - Example
      193
  - 6.6.4 Attach the xauthpool entity to the vpnserver entity
    194
    - modify the vpnserver parameters
      194
    - Example
      194
  - 6.6.5 Delete an xauthpool entity
    195
    - delete command
      195
    - Example
      195
  - 6.6.6 XAuth User parameters
    196
    - Parameters table
      196
  - 6.6.7 Create a new XAuth user
    197
    - adduser command
      197
    - Example
      197
  - 6.6.8 Set or modify the password of an XAuth user
    198
    - moduser command
      198
    - Example
      198
  - 6.6.9 Delete an xauthuser entity
    199
    - delete command
      199
    - Example
      199
- 6.7 The Default Peer Concept
  200
  - Why the default peer concept
    200
  - Example IPSec connection, applying the default peer concept
    201
- 6.8 One Peer - Multiple Connections
  202
  - Multiple tunnels
    202
- 6.9 Peer Options
  203
  - Options list
    203
  - Local Address
    203
  - NAT-Traversal
    203
  - Dead Peer Detection
    204
  - DPD Idle Period
    204
  - DPD number of Transmits
    204
  - DPD Timeout
    204
  - Tunnel inactivity timeout
    204
  - 6.9.1 List all Peer Options lists
    205
    - list command
      205
    - Example
      205
  - 6.9.2 Create a Peer Options list
    206
    - add command
      206
    - Example
      206
  - 6.9.3 Set or modify the Peer Option list parameters
    207
    - modify command
      207
    - Example
      207
  - 6.9.4 Delete a Peer Options list
    208
    - delete command
      208
    - Example
      208
- 6.10 Connection Options
  209
  - Options list
    209
  - IPSec routing mode [routed]
    209
  - Virtual interface
    209
  - Don’t Fragment bit [force_df]
    210
  - Minimal MTU [min_mtu]
    210
  - Add Route [add_route]
    210
  - 6.10.1 List all Connection Options lists
    211
    - list command
      211
    - Example
      211
  - 6.10.2 Create a Connection Options list
    212
    - add command
      212
    - Example
      212
  - 6.10.3 Set or modify the Connection Option list parameters
    213
    - modify command
      213
    - Example
      213
  - 6.10.4 Delete an Options list
    214
    - delete command
      214
    - Example
      214
- 6.11 Advanced Connection
  215
  - Introduction
    215
  - Parameters table
    215
  - Local network [localnetwork]
    216
  - Remote network [remotenetwork]
    216
  - Local match [localmatch]
    217
  - Remote match [remotematch]
    218
  - Local selector [localselector]
    219
  - Remote selector [remoteselector]
    219
  - Advanced Connection commands
    219
Need more help?
222

Manuel D’Utilisation

Taille:

3 Mo
Pages:

222
Language:

English

Ouvrir le manuel