用户手册 — Secure Computing Soft-PK Version 5.1.3 Build 4

目录

• Table of Contents

  5
• Preface: About this Guide

  7
  • Who should read this guide?

    7
  • How this guide is organized

    8
    • Finding information

      8
    • Viewing and printing this document online

      9
  • Where to find additional information

    9
    • About this chapter

      11
• Chapter 1: Getting Started

  11
  • About Soft-PK & Sidewinder VPNs

    12
    • Figure 1-1. Sidewinder VPN connection providing secure data transmission between a remote system ...

      12
  • Requirements

    13
    • Sidewinder and other network requirements

      13
      • Table 1-1. Network requirements for using Soft-PK with Sidewinder

        13
    • Soft-PK requirements

      14
      • Table 1-2. System requirements for running Soft-PK

        14
  • Roadmap to deploying your VPNs

    15
    • Figure 1-2. VPN deployment overview

      16
      • Soft-PK deployment checklist

        17
      • About this chapter

        21
• Chapter 2: Planning Your VPN Configuration

  21
  • Identifying basic VPN connection needs

    22
    • Figure 2-1. Identify remote users and the target internal systems in a sample diagram

      22
  • Identifying authentication requirements

    23
    • Using digital certificate authentication

      23
      • Table 2-1. Sidewinder self-signed certificates versus CA-based certificates

        24
    • A closer look at self-signed certificates

      24
    • Figure 2-2. Sidewinder self-signed certificate summary

      24
      • A closer look at CA-based certificates

        25
    • Figure 2-3. CA-based digital certificate summary

      25
      • Understanding pre-shared key authentication

        25
      • Extended authentication

        26
  • Determining where you will terminate your VPNs

    27
    • Figure 2-4. VPN tunnel terminating on trusted burb

      27
    • Figure 2-5. VPN tunnel terminating on a virtual burb

      27
      • More about virtual burbs and VPNs

        28
      • Defining a virtual burb

        28
        • 1. Select Firewall Administration -> Burb Configuration.

          28
        • 2. Click New and create the new virtual burb.

          28
        • 3. Click Apply.

          28
        • 4. Assign DNS to listen for the virtual burb. Enter the following command:

          28
        • 5. Verify that DNS is listening on the virtual burb by typing the following command:

          28
  • Understanding Sidewinder client address pools

    29
    • Figure 2-6. VPN association implemented using client address pool

      29
      • About this chapter

        31
• Chapter 3: Configuring Sidewinder for Soft-PK Clients

  31
  • Enabling the VPN servers

    32
    • 1. Enable the cmd, egd, and isakmp servers.

      32
      • a. Select Services Configuration -> Servers -> Control.

        32
    • Figure 3-1. Services Configuration -> Servers -> Control

      32
      • b. To enable a server, select it from the Server Name list and click Enable.

        32
      • c. Click Apply.

        32
      • 2. Configure the ISAKMP server.

        32
        • a. Select VPN Configuration -> ISAKMP Server.

          32
    • Figure 3-2. VPN Configuration -> ISAKMP Server

      32
      • b. In the Burbs to Listen on list column, click the burb name associated with the Internet burb.

        32
      • c. In the Available Authentication Method fields, specify the method(s) to use for Extended Authe...

        32
      • d. Click Apply.

        32
  • Configuring ACL & proxies entries for VPN connections

    33
    • 1. Define (or ensure you have) an ACL entry that allows external-to- external ISAKMP traffic. Sel...

      33
    • 2. [Configuration dependent] Define (or ensure you have) ACL entries that allow access to and fro...

      33
    • 3. [Configuration dependent] Enable the desired proxies in the appropriate virtual burb(s). Selec...

      33
  • Managing Sidewinder self- signed certs

    34
    • Creating & exporting a firewall certificate

      34
      • 1. Select Services Configuration -> Certificate Management.

        34
      • 2. Select the Firewall Certificates tab. Click New.

        34
    • Figure 3-3. Sidewinder Certificate Management: Create New Firewall Certificate window

      34
      • 3. Specify the following Firewall Certificate settings.

        35
      • 4. Click Add to add the certificate to the Certificates list.

        35
      • 5. Click Close to return to the Firewall Certificate window.

        35
      • Export the firewall certificate (for later transfer to each client system)

        35
        • 6. Click Export and save the firewall certificate (containing the public key) to a file. Add a .p...

          35
        • 7. Click OK when done.

          35
        • Creating & exporting remote certificate(s)

          36
          • 1. Select Services Configuration -> Certificate Management.

            36
          • 2. Select the Remote Certificates tab. Click New.

            36
    • Figure 3-4. Sidewinder Certificate Management: Create New Remote (Client) certificate window

      36
      • 3. Specify the following Remote Certificate settings.

        37
      • 4. Click Add to add the certificate to the Certificates list.

        37
      • 5. Click Close to return to the previous window.

        38
      • Converting the certificate file/private key file pair to pkcs12 format

        38
        • 6. To start the PKCS12 utility on the Sidewinder, from the command line, enter the following comm...

          38
        • 7. Type the full path name of the private key file.

          38
        • 8. Type the full path name of the associated certificate file.

          38
        • 9. Type the full path name of the object file that will be created by the utility. Be sure to use...

          38
        • 10. Type a password for this PKCS12 object.

          38
        • 11. Return to Step 1 for each remote client.

          38
      • Copy the client key/ certificate object to a diskette

        38
  • Managing CA- based certificates

    39
    • Defining a CA to use and obtaining the CA root cert

      39
      • 1. Select Services Configuration -> Certificate Management and click the Certificates Authorities...

        39
    • Figure 3-5. Create New Certificate Authority window

      39
      • 2. In the New Certificate Authority window, specify the name, type, and location of the CA.

        39
      • 3. Click Add, then click Close.

        39
      • 4. Click Get CA Cert to request the CA certificate and import it to the firewall

        39
      • 5. Click Get CRL to manually retrieve a new Certificate Revocation List (CRL) from the CA.

        39
      • 6. Click Export to save the CA certificate to a file for later importation into client system(s)....

        40
      • Requesting a certificate for the firewall

        40
        • 1. Select Services Configuration -> Certificate Management and click the Firewall Certificates ta...

          40
    • Figure 3-6. Create New Firewall Certificates window

      40
      • 2. Specify the firewall certificate information.

        41
      • 3. Click Add to send the enrollment request.

        41
      • 4. On the Firewall Certificates tab, click Query to request the CA for a signed copy of the certi...

        41
      • 5. Record all firewall certificate information specified in Step 2. This information must be ente...

        41
      • Determining identifying information for client certificates

        42
        • Table 3-1. Client Distinguished Name (DN) information

          42
      • Defining remote client identities in Sidewinder

        43
        • 1. Select Services Configuration -> Certificate Management and click the Certificate Identities t...

          43
    • Figure 3-7. Certificate Identities defined on the firewall

      43
      • 2. Specify an identify name and the Distinguished Name fields.

        43
      • 3. Click Add.

        43
  • Managing pre- shared keys (passwords)

    44
  • Configuring the VPN on the Sidewinder

    45
    • 1. Select VPN Configuration -> Security Associations. Click New.

      45
    • Figure 3-8. Sidewinder Security Associations window (defined VPNs)

      45
      • 2. Select the General tab and specify the following primary VPN settings.

        45
      • 3. Select the Authentication tab. Choose the authentication method appropriate for your configura...

        47
    • Figure 3-9. Sidewinder Security Associations Properties, Authentication tab

      47
    • Figure 3-10. "Single Certificate" options

      47
      • Table 3-2. Single Certificate (self-signed) options

        47
    • Figure 3-11. "Certificate & Certificate Authority" options

      48
      • Table 3-3. Certificate + Certificate Authority options

        48
    • Figure 3-12. "Password" options

      49
      • Table 3-4. Password options

        49
      • Save your settings!

        49
        • 4. Click Add to save the settings.

          49
        • 5. Click Close.

          49
      • About this chapter

        51
• Chapter 4: Installing and Working with Soft-PK

  51
  • Soft-PK installation notes

    52
    • Table 4-1. Soft-PK install/uninstall task summary

      52
  • Starting Soft-PK

    53
    • Figure 4-1. Soft-PK icon in the Windows taskbar

      53
      • Determining Soft-PK status from icon variations

        53
        • Table 4-2. Soft-PK taskbar icons

          53
      • Activating/Deactivating Soft-PK

        54
    • Figure 4-2. Soft-PK taskbar icon options

      54
    • Figure 4-3. Soft-PK Start menu options

      54
      • About the Soft-PK program options

        55
  • Managing certificates on Soft-PK

    56
    • Setting up Sidewinder self-signed certificates

      56
      • 1. If not already done, create and export a firewall certificate. See "Creating & exporting a fir...

        56
      • 2. If not already done for each end user, create and export a remote certificate and convert to P...

        56
      • 3. Provide instructions for importing the self-signed firewall certificate. A copy of this proced...

        56
      • 4. Provide instructions for importing the self-signed personal certificate. A copy of this proced...

        56
    • Setting up CA-based certificates

      57
      • 1. If not already done, request and export the CA root certificate. See "Defining a CA to use and...

        57
      • 2. If not already done for each end user, create and export a remote certificate. See "Requesting...

        57
      • 3. Provide instructions for importing the CA root certificate. A copy of this procedure is provid...

        57
      • 4. Provide instructions for importing the personal certificate. A copy of this procedure is provi...

        57
    • Requesting a personal certificate from a CA on user’s behalf

      58
      • 1. Select Start -> Programs -> SafeNet/Soft-PK -> Certificate Manager (or right click the SafeNet...

        58
      • 2. Click the My Certificates tab.

        58
      • 3. Click Request Certificate.... The Online Certificate Request dialog box appears.

        58
      • 4. Select the Generate Exportable Key check box.

        58
      • 5. Click Advanced to select a certificate service provider.

        58
      • 6. Under Enrollment method, click Online.

        58
      • 7. Under Subject Information, enter all relevant personal information, pressing the Tab key to mo...

        58
      • 8. Under Online Request Information, enter or select these options:

        58
        • a. In the Challenge Phrase box, enter any combination of numbers or letters you choose. For secur...

          58
        • b. In the Confirm Challenge box, enter the same phrase from the last step.

          58
        • c. From the Issuing CA list, select a CA certificate.

          58
      • 9. Click OK. Certificate Manager now generates a public/private key pair, and then displays the O...

        58
      • 10. Optional: To view your request, click the Certificate Requests tab. Select the request and cl...

        58
      • 11. Get your CA administrator to approve your request.

        58
      • 12. Once your request is approved, select it under the Certificate Requests tab and click Retrieve.

        58
      • 13. Click Yes when the Certificate Manager dialog box asks if you want to add this personal certi...

        58
    • Exporting a personal certificate

      59
      • 14. In the My Certificates tab, select a personal certificate.

        59
      • 15. Click Export. The Export Certificate and Private Key dialog box appears.

        59
      • 16. In the Filename box, enter the drive, directory, and filename for the personal certificate fi...

        59
      • 17. In the Password box, type any password you choose.

        59
      • 18. In the Confirm Password box, retype the password.

        59
      • Importing certificate in Soft-PK

        59
    • Importing a CA root or self- signed firewall certificate into Soft-PK

      59
      • 1. Select Start -> Programs -> SafeNet/Soft-PK -> Certificate Manager (or right click the SafeNet...

        59
      • 2. Click the CA Certificates tab.

        59
      • 3. Click Import Certificate.... The Import CA Certificate window appears.

        59
    • Figure 4-4. Soft-PK Certificate Manager: CA Certificates tab, Import CA Certificate

      60
      • 4. Insert the diskette containing the self-signed firewall or certificate file.

        60
      • 5. From the Files of type: field, select All Files (*.*) and then navigate to display the files l...

        60
      • 6. Select the appropriate certname.pem file and click Open. The following window appears promptin...

        60
    • Figure 4-5. Verification window

      60
      • 7. Click Yes.

        60
      • 8. [Optional] From the CA Certificates tab, click View to see the information in the certificate.

        60
    • Figure 4-6. Viewing the certificate

      60
      • Importing a personal certificate into Soft-PK

        61
        • 1. Select Start -> Programs -> SafeNet/Soft-PK -> Certificate Manager (or right click the SafeNet...

          61
        • 2. Click the My Certificates tab.

          61
        • 3. Click Import Certificate....

          61
    • Figure 4-7. My Certificates tab: Import Certificate (and private Key) window

      61
      • 4. Insert the diskette containing the remote key/certificate object file.

        61
      • 5. From the Files of type: field, select All Files (*.*) and then navigate to display the files l...

        61
      • 6. Select the appropriate filename.p12 file and click Open. The following window appears.

        61
    • Figure 4-8. Import Certificate Password window

      61
      • 7. Specify the password used when creating the p12 object (step 10 on page 3-8). You will not be ...

        61
      • 8. Click Import. A prompt appears to confirm you want to import the selected Personal Certificate.

        62
    • Figure 4-9. Verification window

      62
      • 9. Click Yes.

        62
      • 10. [Optional] From the My Certificates tab, click View to see the information in the certificate.

        62
    • Figure 4-10. Viewing the certificate

      62
  • Configuring a security policy on the Soft-PK

    63
    • Basic connection options

      63
    • Setting up an Other Connections policy

      63
      • 1. Select Start -> Programs -> SafeNet/Soft-PK -> Security Policy Editor (or right click the Safe...

        63
      • 2. Select Options -> Secure Specified Connections.

        63
      • 3. Click on Other Connections. This is the catchall rule for all IP communications that do not co...

        63
      • 4. Start defining a new policy. Select Edit -> Add -> Connection to create a new policy.

        64
    • Figure 4-11. Soft-PK: Security Policy Editor

      64
      • 5. Specify a descriptive name for the connection. (The name "SecureVPN" is used in this example.)

        64
      • 6. Specify the connection type. In the Connection Security field, specify Secure.

        64
      • 7. Specify the trusted network to which the client will be communicating. In the Remote Party Ide...

        64
      • 8. Specify the Sidewinder connection information.

        64
        • a. Enable the Connect using Secure Gateway Tunnel box.

          64
        • b. Specify the interface information:

          64
    • Figure 4-12. Soft-PK: Edit Distinguished Name window to specify Firewall public certificate

      65
      • 9. Select Security Policy and select the Phase 1 Negotiation Mode.

        65
    • Figure 4-13. Soft-PK: Security Policy fields

      65
      • 10. Specify how the user will be identified to the Sidewinder. Select My Identify.

        65
    • Figure 4-14. Soft-PK: My Identity fields

      65
      • a. Select the authentication method for this connection.

        66
      • b. In the Internet Interface selection drop-down box, specify which interface to use when creatin...

        66
      • 11. Specify the Authentication settings. Select Authentication (Phase 1) -> Proposal 1.

        66
    • Figure 4-15. Soft-PK: Authentication (Phase 1) -> Proposal 1 fields

      66
      • a. In Authentication Method field, specify the method appropriate for your configuration. (For ex...

        66
      • b. In Encryption and Data Integrity/Algorithms fields:

        66
      • c. In Key Group field, select at least Group 2. Group 5 (highest).

        66
      • 12. Specify the Key Exchange settings. Select Key Exchange (Phase 2) -> Proposal 1.

        67
    • Figure 4-16. Soft-PK: Key Exchange (Phase 2) -> Proposal 1 fields

      67
      • 13. [Optional] Click Save to save the policy on this system.

        67
      • 14. Select File -> Export.

        67
        • a. You will be prompted to protect your security policy. Your end users will then not be able to ...

          67
        • b. Specify the location of the exported file.

          67
      • 15. Provide a copy of this file to the appropriate end users (see Chapter 5 for details).

        67
      • About this chapter

        69
• Chapter 5: Deploying Soft-PK to Your End Users

  69
  • Overview

    70
    • Figure 5-1. Sample userworksheet.doc file contained on Soft-PK product CD

      70
      • Table 5-1. Organize the files/software for each client (end user)

        71
  • Customizing the user worksheet

    72
    • Specifying dial-up network instructions

      72
    • Figure 5-2. Sample text for specifying dial-up networking setup

      72
      • Specifying installation instructions

        72
    • Figure 5-3. Sample text for specifying Soft-PK installation instructions

      72
      • Specifying certificate import/request instructions

        73
    • Figure 5-4. Sample text for specifying certificate instructions (if applicable)

      73
      • Specifying security policy instructions

        74
    • Figure 5-5. Sample text for importing the security policy

      74
      • Specifying basic connection information

        74
    • Figure 5-6. Sample text for starting the VPN

      74
• Appendix A: Troubleshooting

  75
  • About this appendix

    75
  • Soft-PK Log Viewer

    75
    • Figure A-1. Log Viewer window on Soft-PK

      75
  • Soft-PK Connection Monitor

    76
    • Figure A-2. Connection Monitor window

      76
      • More about the Connection Monitor

        77
      • To view the details

        77
    • Figure A-3. Connection Monitor window

      77
  • Sidewinder troubleshooting commands

    78
    • Table A-1. Basic Sidewinder VPN troubleshooting commands

      78