Page 2 - Restricted rights legend
2 NN46110-500 Copyright © 2007 Nortel Networks. All rights reserved. The information in this document is subject to change without notice. The statements, configurations, technical data, and recommendations in this document are believed to be accurate and reliable, but are presented without express ...
Page 3 - Nortel Networks Inc. software license agreement
3 Nortel VPN Router Configuration — Basic Features Nortel Networks Inc. software license agreement This Software License Agreement (“License Agreement”) is between you, the end-user (“Customer”) and Nortel Networks Corporation and its subsidiaries and affiliates (“Nortel Networks”). PLEASE READ THE ...
Page 5 - Contents
5 Nortel VPN Router Configuration — Basic Features Contents Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...
Page 11 - Figures
11 Nortel VPN Router Configuration — Basic Features Figures Figure 1 Typical PDN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Figure 2 VPN service models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Figure 3 ...
Page 13 - Tables
13 Nortel VPN Router Configuration — Basic Features Tables Table 1 Sample IP addressing associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Table 2 Services supported on a multinetted interface . . . . . . . . . . . . . . . . . . . . . 39 Table 3 Web interface configuration opt...
Page 15 - Preface; Before you begin; This guide uses the following text conventions:
15 Nortel VPN Router Configuration — Basic Features Preface This guide introduces the Nortel VPN Router. It also provides overview and basic configuration information to help you initially set up your Nortel VPN Router. Before you begin This guide is for network managers who are responsible for sett...
Page 16 - italic text
16 Preface NN46110-500 braces ({}) Indicate required elements in syntax descriptions where there is more than one option. You must choose only one of the options. Do not type the braces when entering the command.Example: If the command syntax is ldap-server source {external | internal} , you must en...
Page 17 - Acronyms; terminal paging
Preface 17 Nortel VPN Router Configuration — Basic Features Acronyms This guide uses the following acronyms: separator ( > ) Shows menu paths. Example: Choose Status > Health Check. vertical line ( | ) Separates choices for command keywords and arguments. Enter only one of the choices. Do not ...
Page 19 - Related publications
Preface 19 Nortel VPN Router Configuration — Basic Features Related publications For more information about the Nortel VPN Router, refer to the following publications: • Release notes provide the latest information, including brief descriptions of the new features, problems fixed in this release, an...
Page 20 - Hard-copy technical manuals; URL. Find the product for which you; How to get Help; Finding the latest updates on the Nortel Web site; Nortel; Getting help from the Nortel Web site; download software, documentation, and product bulletins; Link to
20 Preface NN46110-500 Hard-copy technical manuals You can print selected technical manuals and release notes free, directly from the Internet. Go to the www.nortel.com/support URL. Find the product for which you need documentation. Then locate the specific category and model or version for your har...
Page 21 - open and manage technical support cases; Getting help over the phone from a Nortel Solutions Center
Preface 21 Nortel VPN Router Configuration — Basic Features • search the Technical Support Web site and the Nortel Knowledge Base for answers to technical issues • sign up for automatic notification of new software and documentation for Nortel equipment • open and manage technical support cases Gett...
Page 23 - New in this release; The following sections details what is new in; Features; “Configuring Network Time Protocol (NTP)” on page 106
23 Nortel VPN Router Configuration — Basic Features New in this release The following sections details what is new in Nortel VPN Router Configuration — Basic Features for Release 7.0. Network Time Protocol (NTP) support for Daylight Savings Time 2007 change Systemlog lifetime or disk size limit usag...
Page 24 - Systemlog lifetime or disk size limit usage option; FTP server passive mode parameter; in; Source IPs access restriction to management; “Restricting source IPs access to management” on page 44; SSH server configurations; “Using the SSH server to allow secure sessions” on page 112
24 New in this release NN46110-500 Systemlog lifetime or disk size limit usage option VPN Router allows you to choose between setting a log file disk size limit or a log file lifetime for the Systemlog. Previous versions of the VPN Router only allowed the Systemlog to have a lifetime specified (defa...
Page 25 - Network deployment alternatives
25 Nortel VPN Router Configuration — Basic Features Chapter 1Overview This chapter introduces the Nortel VPN Router. The Nortel VPN Router is a family of products that deliver security and IP services in a single integrated platform. With IP routing, Virtual Private Networking (VPN), stateful firewa...
Page 26 - Figure 1; Virtual private networking; shows examples of VPN services.
26 Chapter 1 Overview NN46110-500 Nortel VPN Router access allows remote users to dial in to an Internet Service Provider (ISP) anywhere and reach corporate headquarters or branch offices. The Nortel VPN Router provides remote users access to corporate databases, mail servers, and file servers. Figu...
Page 27 - Figure 2; Licensing features
Chapter 1 Overview 27 Nortel VPN Router Configuration — Basic Features Figure 2 VPN service models The Nortel VPN Router uses a combination of authorization, authentication, privacy, and access control for each user. Licensing features Licence keys can be obtained through Nortel’s customer support. ...
Page 28 - Command line interface; Nortel VPN Router Using the Command Line Interface; Federal Information Processing Standard (FIPS); It is only necessary to install a key once on each Nortel VPN; Admin
28 Chapter 1 Overview NN46110-500 The Nortel VPN Router Stateful Firewall License key must be installed to enable the Nortel VPN Router Stateful firewall. Tunnel keys are specific to the Nortel VPN Router hardware model that you are using. Nortel VPN Router switches are manufactured to allow either ...
Page 29 - Getting Started; IP addressing; Chapter 3, “Setting up the Nortel VPN Router 1010, 1050, and
29 Nortel VPN Router Configuration — Basic Features Chapter 2Getting started This chapter describes methods for configuring and managing the Nortel VPN Router . Full details on hardware installation, including adding local area network (LAN) or wide area network (WAN) cards, are in the Getting Start...
Page 30 - Figure 3; Table 1
30 Chapter 2 Getting started NN46110-500 Figure 3 Sample IP addressing scheme Table 1 Sample IP addressing associations IP address Description (when applicable, where configured ) 192.168.43.6 Dial-up networking to ISP (Internet access, ISP assigned) 192.19.2.30 Public default Internet VPN Router 19...
Page 31 - Management virtual address
Chapter 2 Getting started 31 Nortel VPN Router Configuration — Basic Features The Nortel VPN Router supports the Internetwork Packet Exchange (IPX) protocol. This allows the Nortel VPN Router to transmit and receive IPX packets over PPTP. The Nortel VPN Router supports IPX by encapsulating IPX traff...
Page 32 - window; Figure 4
32 Chapter 2 Getting started NN46110-500 • Identification • CRL Retrieval • CMP To enable or disable management protocols, go to Services > Available window . From this window, you can also specify whether to manage the VPN Router from the public or private side. To redistribute the MVA, go to Ro...
Page 33 - Figure 5; Figure 6
Chapter 2 Getting started 33 Nortel VPN Router Configuration — Basic Features Figure 5 MVA on same subnet as private physical interface Figure 6 shows MVA using CLIP to manage from a remote PC tunneled from the public side. Figure 6 MVA managing from a remote PC
Page 34 - Configuring MVA with the serial menu; Enter; admin
34 Chapter 2 Getting started NN46110-500 Configuring MVA with the serial menu To configure the MVA with the serial menu: 1 Connect the serial cable (supplied with your Nortel VPN Router) from the Nortel VPN Router serial port to a terminal or a communications port of a PC. 2 Power on the terminal or...
Page 35 - The following menu appears:; to display the Management IP Address menu.
Chapter 2 Getting started 35 Nortel VPN Router Configuration — Basic Features The following menu appears: Main Menu: System is currently in NORMAL mode. 0) Management Address 1) Interfaces 2) Administrator 3) Default Private Route Menu 4) Default Public Route Menu 5) Create A User Control Tunnel (IP...
Page 36 - Configuring Interfaces
36 Chapter 2 Getting started NN46110-500 7 Type M and press Enter to change the Management IP address. The current IP address appears. The Old Management IP Address field is blank on a new Nortel VPN Router. Please select a menu choice (M, R): M Type 0.0.0.0 to delete. Just type <CR> to skip. ...
Page 38 - Type; to save the settings and exit. You can then manage the; Multinetting
38 Chapter 2 Getting started NN46110-500 7 Type E and press Enter to save the settings and exit. You can then manage the Nortel VPN Router from a Web browser. Multinetting IP multinetting allows a maximum of eight addresses to be configured on a single Ethernet interface. The first IP address config...
Page 39 - Table 2 shows the services supported on a multinetted interface.; Table 2; Service
Chapter 2 Getting started 39 Nortel VPN Router Configuration — Basic Features Table 2 shows the services supported on a multinetted interface. Table 2 Services supported on a multinetted interface Service Integration description Nortel VPN Router Stateful Firewall Supported at the interface level sp...
Page 40 - represents a legacy system consisting of two class B IP
40 Chapter 2 Getting started NN46110-500 Multinetting is supported on the following Nortel VPN Routers: Nortel VPN Router 1100/1010/1050 and 600, 1700, 1600/1500, 2700, 2600/2500, 4500/4600 and 5000. The multinetting feature is interoperable with Nortel VPN Router 100-400, BayRS, P8000 (8100, 8600, ...
Page 41 - Figure 7; Changing the management IP address; Power on the terminal or PC.
Chapter 2 Getting started 41 Nortel VPN Router Configuration — Basic Features Figure 7 Deployment Scenario Changing the management IP address To manage the system, the network must have a route to the management IP address through one of the system interfaces. To change the management IP address, co...
Page 44 - Restricting source IPs access to management; Configuring ACL through the CLI:
44 Chapter 2 Getting started NN46110-500 Restricting source IPs access to management You are able to filter management access of source IP addresses. Access Lists (ACLs) restrict connection of designated source IPs for management purposes over HTTP, FTP, TELNET and SNMP. Management traffic is interc...
Page 45 - Accessing ACL through the GUI:; OK; Configuring the serial interface
Chapter 2 Getting started 45 Nortel VPN Router Configuration — Basic Features To set an ACL for TELNET, enter the following NNCLI command: CES(config) #telnet access-list <the_name_of_an_acl> To remove an ACL for TELNET, enter the following command: CES(config) #no telnet access-list Accessing...
Page 46 - The Welcome window appears
46 Chapter 2 Getting started NN46110-500 3 Using a terminal emulation program, such as HyperTerminal on the PC, press Enter . The Welcome window appears and you are prompted to supply a user name and password. Nortel VPN Router Copyright (c) 1999-2007 Nortel Networks, Inc. Version: V07_00.038 Creati...
Page 50 - Using boot modes; To save your configuration into the Safe Mode boot directory:; Managing through a Web browser
50 Chapter 2 Getting started NN46110-500 Using boot modes The Nortel VPN Router can be booted in one of two system modes: Safe mode or Normal mode. Each mode has its own software image, configuration files, and LDAP database. A system booted in Safe mode is only allowed to accept secured management ...
Page 51 - for help in determining
Chapter 2 Getting started 51 Nortel VPN Router Configuration — Basic Features 3 Enter the system default login and password in lowercase characters, as follows: Login: admin Password: setup At this point, follow the Quick Start Configuration procedure or the Guided Configuration procedure. Refer to ...
Page 52 - Preparing for configuration; Nortel VPN Router and router types.
52 Chapter 2 Getting started NN46110-500 Preparing for configuration To properly prepare for configuration of the Nortel VPN Router, you should have the following items available: • A plan to distribute IP addresses to clients when connections are requested; for example, via a DHCP server or an inte...
Page 53 - Include brief explanations with the layout.; Table 3; Table 4
Chapter 2 Getting started 53 Nortel VPN Router Configuration — Basic Features • Manufacturer of device as well as firmware version, throughput, and any special configuration requirements for any devices on the network. If you assign static IP addresses to any of these devices, record them and a brie...
Page 56 - Welcome window
56 Chapter 2 Getting started NN46110-500 Welcome window The Welcome window allows access to any of the configuration areas for the Nortel VPN Router. Before entering the configuration options, first register your Nortel VPN Router to activate licenses, warranties, and services. To start using your N...
Page 59 - Chapter 3; “Connecting for Internet; Default configuration; show a typical default configuration.window
59 Nortel VPN Router Configuration — Basic Features Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 This chapter provides instructions for the network administrator who is responsible for the Nortel VPN Router 1010, 1050, and 1100 located at branch office sites. If you are at a branc...
Page 60 - Figure 8
60 Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 NN46110-500 Figure 8 Default configuration By default, the Nortel VPN Router 1010, 1050, and 1100 are configured with the following parameters: • The DHCP server is configured on the switch’s private interface, with a default range o...
Page 61 - Branch office quick start utility; The BOQS will remain accessible after the information is entered.; username
Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 61 Nortel VPN Router Configuration — Basic Features Branch office quick start utility The branch office quick start utility (BOQS) simplifies deployment of the Nortel VPN Router in the branch office environment. BOQS converts the Nortel...
Page 62 - Enterprise environment
62 Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 NN46110-500 After the VPN services are provisioned, branch office networks are logically connected to a central office network or to a NOC network. Branch office end users can rerun BOQS multiple times to restore the initial VPN conf...
Page 63 - Set Dynamic Routing to enabled.; Service provider environment; Table 5
Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 63 Nortel VPN Router Configuration — Basic Features • Set the Text Pre-Shared Key to the same name as central office tunnel password. • Set Dynamic Routing to enabled. • Set RIP to enabled. After the central office setup and the BOQS ar...
Page 64 - NAT Local option should NOT be used.
64 Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 NN46110-500 Every Nortel VPN Router 1010, 1050, and 1100 must have a distinct IP address that is visible from the NOC subnet. A NOC can assign any address reachable from a NOC network to a Nortel VPN Router 1010, 1050, or 1100. BOQS ...
Page 65 - Deployment procedure; The end user opens the Web browser and types; and; setup; as the username and
Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 65 Nortel VPN Router Configuration — Basic Features Deployment procedure The following sequence of events illustrates the deployment procedure. • Factory configured Nortel VPN Router 1010, 1050, and 1100 boxes are shipped directly to th...
Page 66 - Table 6
66 Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 NN46110-500 Table 6 contains the BOQS parameters. Table 6 BOQS parameters Central office tunnel configuration Central office tunnel name Name of the branch office tunnel on the central office switch. Central office tunnel password Pa...
Page 67 - Branch office quick start template; Appendix A, “Branch office quick start template; Connecting for Internet access; If you did not receive the worksheet, call the ISP or the company
Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 67 Nortel VPN Router Configuration — Basic Features Branch office quick start template The branch office quick start template provides a list of values that the local Nortel VPN Router 1010, 1050 or 1100 users will need to enter on the ...
Page 68 - Note; Cable the VPN Router and turn the power on; private
68 Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 NN46110-500 • Power cord • AC to DC external power supply • Molded serial cable RJ-45 to DB9 • Ethernet crossover cable (Nortel VPN Router 1010 only) • Nortel VPN Router CD ( Note : the documentation on this CD is for reference only)...
Page 69 - Make sure that your PCs can obtain IP addresses automatically; “DHCP instructions” on page 70
Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 69 Nortel VPN Router Configuration — Basic Features 7 Press the power switch to the “on” position and wait for the VPN Router to boot. Make sure that your PCs can obtain IP addresses automatically By default, DHCP server is enabled on t...
Page 70 - “Static IP instructions” on; DHCP instructions
70 Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 NN46110-500 • If your ISP uses static IP addressing, go to “Static IP instructions” on page 71 .” DHCP instructions If your ISP uses DHCP to assign an IP address to your PCs, verify that your VPN Router is connected to the Internet a...
Page 71 - Static IP instructions
Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 71 Nortel VPN Router Configuration — Basic Features 6 Set the Administrative State option to Enabled . 7 From the Interface Filter list, choose permit all . 8 Click on OK . 9 Locate the provisioning worksheet sent by the company or prov...
Page 72 - Compact flash disk
72 Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 NN46110-500 12 In the Gateway Address field, type the default route address that the ISP provided. 13 Click on OK . 14 Locate the provisioning worksheet sent by the company or provider that sent you the VPN Router. 15 Enter the follo...
Page 73 - Numerous text files; window, click on Enabled and enter
Chapter 3 Setting up the Nortel VPN Router 1010, 1050, and 1100 73 Nortel VPN Router Configuration — Basic Features • Numerous text files You can store two software images on the flash disk at the same time. Operational changes for the compact flash disk are: • The config file is saved every minute ...
Page 75 - Figure 9
75 Nortel VPN Router Configuration — Basic Features Chapter 4Configuring user tunnels The Nortel VPN Router uses the Internet and tunneling protocols to create secure connections. The following sections describe configuring the tunnel portion of the Nortel VPN Router. The configuration process inclu...
Page 76 - PPP multilink is not supported with branch office tunnels. It is
76 Chapter 4 Configuring user tunnels NN46110-500 The Nortel VPN Router associates all remote users with a group, which dictates the attributes that are assigned to a remote user session. A group can even consist of a single user, thereby creating a personal connection. The Nortel VPN Router organiz...
Page 77 - The group name Certificates is not allowed as a valid group name
Chapter 4 Configuring user tunnels 77 Nortel VPN Router Configuration — Basic Features For example, \Base is the base group, Research and Development and Finance are child groups of the base group, and they are parent groups to groups below them. Groups are collections of users with the same access ...
Page 78 - Configuring group characteristics
78 Chapter 4 Configuring user tunnels NN46110-500 Configuring group characteristics In addition to assigning users to groups and providing authentication access, you can configure other group characteristics: 1 Go to the Profiles > Groups window and click on the Edit button next to the group that...
Page 79 - Enter the amount of; Idle Timeout; time a connection can be idle (no data has; Access Network Name; , specify a source IP address that restricts user
Chapter 4 Configuring user tunnels 79 Nortel VPN Router Configuration — Basic Features • Maximum password age is the time after which the login password expires. The Maximum Password Age range is from 0 (no password expiration) to 180 days (6 months). Default is 30 days. Users receive a warning that...
Page 81 - Excess Action; Setting up user tunnels
Chapter 4 Configuring user tunnels 81 Nortel VPN Router Configuration — Basic Features c Choose an Excess Action for traffic handling, either Drop or Mark. You can also choose Define new bandwidth rate to select a new bandwidth rate. 20 You can configure the TunnelGuard settings by refering to Norte...
Page 83 - Display
Chapter 4 Configuring user tunnels 83 Nortel VPN Router Configuration — Basic Features 2 After selecting a group, you must click on Display to view the group members. This allows you to quickly change from viewing one group to another. The last names and first names of the selected group’s users app...
Page 85 - Configuring inverse split tunneling; Inverse split tunneling
Chapter 4 Configuring user tunnels 85 Nortel VPN Router Configuration — Basic Features • LDAP search allows you to enter any LDAP database attribute that is part of the person, organizational Person, or inetOrgPerson object database (for example, cn=common name or sn=surname) to generate the associa...
Page 86 - does have a significant security advantage over split
86 Chapter 4 Configuring user tunnels NN46110-500 The security of a mandatory tunnel is partially compromised by the addition of inverse split tunneling in a way similar to that of split tunneling. However, inverse split tunneling (Figure 11) does have a significant security advantage over split tun...
Page 87 - Configuring the subnet wildcard; To configure the subnet wildcard:
Chapter 4 Configuring user tunnels 87 Nortel VPN Router Configuration — Basic Features To select the split tunneling mode in which you wish to operate, the Split Tunneling drop down menu has been modified to include two new options. Enabled – Inverse and Enabled – Inverse (locally connected). The de...
Page 88 - Select; Enabled; - Inverse or Enabled Locally Connected from the Split; Table 7
88 Chapter 4 Configuring user tunnels NN46110-500 Figure 12 Edit > IPsec page for wildcard 2 Select Enabled - Inverse or Enabled Locally Connected from the Split Tunneling menu. The Split Tunneling menu is used to select the tunneling mode that is used by the selected group. Table 7 shows the opt...
Page 89 - None; from the Split Tunnel Networks menu.; Configuring tunneling modes using the CLI
Chapter 4 Configuring user tunnels 89 Nortel VPN Router Configuration — Basic Features 3 Select None from the Split Tunnel Networks menu. 4 Select a network from the Inverse Split Tunnel Networks menu. 5 Go to the bottom of the page and click OK. Configuring tunneling modes using the CLI The tunneli...
Page 91 - Configuring the system identity
91 Nortel VPN Router Configuration — Basic Features Chapter 5Configuring the system This chapter describes how to configure various system-level features: • LAN interfaces • WAN interfaces • 802.1q VLAN subinterfaces • MTU and TCP MSS • Circuitless IP • Asynchronous data over TCP • NTP • Safe mode c...
Page 93 - Setting up LAN interfaces; shows a connection from a LAN to a Nortel VPN Router.
Chapter 5 Configuring the system 93 Nortel VPN Router Configuration — Basic Features 10 Click on OK. The Nortel VPN Router checks all of the DNS addresses to see if they respond and then provides an operational or error status. The ISP Provided Server is not user configurable. It is provided by the ...
Page 94 - Add Multinet
94 Chapter 5 Configuring the system NN46110-500 A host can send only enough packets to a public interface to establish a tunnel connection. If the tunnel is not established before a preset maximum number-of-packets-allowed counter is reached, then the packets from that host are discarded. Public ind...
Page 95 - Select Protocol; Edit LAN Interface window
Chapter 5 Configuring the system 95 Nortel VPN Router Configuration — Basic Features • From the Select Protocol list, select the tunneling protocol to use: IP is the standard Internet Protocol, and Point to Point Protocol over Ethernet (PPPoE) allows PPP to run over Ethernet. This window also provid...
Page 96 - Edit LAN Interface; You can also use the Interface selection on the Nortel VPN Router
96 Chapter 5 Configuring the system NN46110-500 Additional fields appear on the Edit LAN Interface window for optional network cards. LAN represents the physical port interface to which you assign an IP address. Slot n Interface n represents an optional LAN card in expansion Slot n using Interface n...
Page 97 - Select a value from the
Chapter 5 Configuring the system 97 Nortel VPN Router Configuration — Basic Features 4 MAC Pause (Ethernet packet flow control) section enables the Nortel VPN Router to automatically adjust and control the flow of incoming and/or outgoing packets from any standard speed LAN device. Check to enable M...
Page 99 - Enter an IP address in the; IP Address; Enter a subnet mask in the; Subnet Mask; Click; To delete an IP address:
Chapter 5 Configuring the system 99 Nortel VPN Router Configuration — Basic Features Figure 15 LAN Interfaces > Add IP Address window 2 Enter an IP address in the IP Address text box. 3 Enter a subnet mask in the Subnet Mask text box. 4 Click OK . To delete an IP address: 1 From the LAN Interface...
Page 100 - Configuring multinetting using the CLI; Adding an IP address; config; config; Table 8
100 Chapter 5 Configuring the system NN46110-500 Configuring multinetting using the CLI Table 8 shows the command syntax for configuring multinetting using the CLI. Adding an IP address To add an IP address: 1 Navigate to config mode by entering the following command: config . 2 Select the interface...
Page 101 - Table 9; Configuring OSPF over a secondary address
Chapter 5 Configuring the system 101 Nortel VPN Router Configuration — Basic Features Table 9 displays the command syntax for configuring OSPF. Table 9 Configuring OSPF over a secondary address Command description Command syntax Enable OSPF on a secondary address CES(config-if)# ip ospf <secondar...
Page 102 - displays the command syntax for configuring RIP
102 Chapter 5 Configuring the system NN46110-500 Table 10 displays the command syntax for configuring RIP Set the OSPF priority on a secondary address CES(config-if)# ip ospf priority <0-255> <secondary address> Reset the OSPF priority on a secondary address CES(config-if)# no ip ospf pr...
Page 105 - To enable asynchronous data over TCP/IP through the GUI:
Chapter 5 Configuring the system 105 Nortel VPN Router Configuration — Basic Features Asynchronous data over TCP Asynchronous data over TCP (AOT) is a protocol that enables transport of asynchronous data packets over a TCP/IP network. A TCP packet is de-capsulated and the data is then forward to the...
Page 107 - Click on the; Enable; Under; Servers
Chapter 5 Configuring the system 107 Nortel VPN Router Configuration — Basic Features NTP supports the 2007 Daylight Savings Time change in the United States and various Canadian provinces. In 2007, Daylight Savings Time begins at 2 a.m. on the second Sunday in March and ends at 2 a.m. on the first ...
Page 108 - Configuring system settings
108 Chapter 5 Configuring the system NN46110-500 5 Click on the Return to the Date and Time window link to return to the previous window. Configuring system settings The Nortel VPN Router can be booted in one of the two system modes: safe mode or normal mode. Each mode has its own software image, co...
Page 109 - Serial Menu
Chapter 5 Configuring the system 109 Nortel VPN Router Configuration — Basic Features • Serial Menu (default). In this mode, a standard menu interface is presented. You can use an application such as Hyper Terminal, when directly connected to the Nortel VPN Router, to access the menu interface. The ...
Page 111 - Using proxy ARP
Chapter 5 Configuring the system 111 Nortel VPN Router Configuration — Basic Features Using proxy ARP You can configure the Nortel VPN Router to respond to ARP requests on any of its physical interfaces. The Nortel VPN Router responds to the following types of routes: • User tunnels are routes creat...
Page 112 - Using the SSH server to allow secure sessions; Using the GUI for SSH server; Enabling the SSH server; SSH Service Enabled
112 Chapter 5 Configuring the system NN46110-500 Using the SSH server to allow secure sessions You can enable an SSH server to allow secure CLI sessions, such as telnet, to the NVR. You also have the option of enabling the private and public interface filters, set the port for the SSH server, and re...
Page 113 - Configuring the SSH server; To set the parameters for the SSH server:
Chapter 5 Configuring the system 113 Nortel VPN Router Configuration — Basic Features Configuring the SSH server To set the parameters for the SSH server: 1 Select Services > Available . The Allowed Services page appears as shown in Figure 18 on page 114 .
Page 114 - In the Port text box, enter the; SSH server port number; To enable filters, select either the; or the; Private; If an SSL VPN card exists in the NVR, the port for the SSH
114 Chapter 5 Configuring the system NN46110-500 Figure 18 Allowed Services window 2 In the Port text box, enter the SSH server port number . 3 To enable filters, select either the Public or the Private check box. 4 Click OK . Note: If an SSL VPN card exists in the NVR, the port for the SSH server c...
Page 115 - Using the CLI for SSH server; portnum—specifies the SSH server port; Enabling or restarting the SSH server; enable—enables the ssh server
Chapter 5 Configuring the system 115 Nortel VPN Router Configuration — Basic Features Using the CLI for SSH server Defining an SSH server (CLI) To configure an SSH server on the Nortel VPN Router, from CLI Global Configuration Mode, enter: ssh-server {port < portnum > | private | public } or n...
Page 116 - Displaying the current settings for the SSH server; port—shows the SSH server port; Disabling the SSH server
116 Chapter 5 Configuring the system NN46110-500 Displaying the current settings for the SSH server To display the current settings for the SSH server, from CLI Global Configuration Mode, enter: show ssh-server { port | state } where: • port—shows the SSH server port • state—specifies the state (ena...
Page 117 - Restricted product - export license requirement
Chapter 5 Configuring the system 117 Nortel VPN Router Configuration — Basic Features Restricted product - export license requirement This product incorporates encryption technology that is highly restricted and can require an export license from the US Department of Commerce, Bureau of Export Admin...
Page 119 - shows a typical branch office environment.
119 Nortel VPN Router Configuration — Basic Features Chapter 6Configuring branch office tunnels The branch office feature allows you to configure a secure tunnel connection between two private networks. Typically, one private network is behind a locally configured Nortel VPN Router while the other i...
Page 120 - The section; Profiles; intended for remote branch office subnets.
120 Chapter 6 Configuring branch office tunnels NN46110-500 Figure 19 Typical branch office environment The section “Configuring a branch office” on page 128 ” provides sample branch office configurations for two locations, Boston and Cleveland. The initial configurations show connections establishe...
Page 121 - The encapsulated data goes onto the public LAN.
Chapter 6 Configuring branch office tunnels 121 Nortel VPN Router Configuration — Basic Features Figure 20 Branch-to-branch with a firewall and a router In the branch-to-branch illustration, the following interactions take place with a Nortel VPN Router: 1 The PC sends packets to the default route (...
Page 122 - Nortel VPN Router Security —
122 Chapter 6 Configuring branch office tunnels NN46110-500 Figure 21 Indirectly connected branch offices In branch offices, you might have two or more branches that use the same LAN addressing scheme. Nonetheless, users still have to communicate with one another across the branches. NAT allows bran...
Page 123 - PPTP nested tunnels
Chapter 6 Configuring branch office tunnels 123 Nortel VPN Router Configuration — Basic Features PPTP nested tunnels Nested tunnels allow you to create a PPTP end user tunnel inside an IPSec branch office tunnel or an asynchronous branch office tunnel. You can have a nested tunnel from within the pr...
Page 124 - DNS for branch office tunnel endpoints; The Nortel VPN Router provides the following DNS services:; VPN DNS
124 Chapter 6 Configuring branch office tunnels NN46110-500 DNS for branch office tunnel endpoints When configuring branch office tunnels with the Nortel VPN Router, you can enter a DNS name for the tunnel endpoint. The Nortel VPN Router uses domain name address resolution to resolve the actual IP a...
Page 125 - Round Robin DNS
Chapter 6 Configuring branch office tunnels 125 Nortel VPN Router Configuration — Basic Features Figure 22 VPN DNS When you configure an initiator for an asynchronous branch office tunnel, you can use a domain name of a remote peer instead of the IP address. 1 Go to Profiles > Branch Office . 2 I...
Page 126 - Round Robin DNS can be used to achieve failover.; shows a central office that has two Nortel
126 Chapter 6 Configuring branch office tunnels NN46110-500 A DNS server will be aware of all the IP addresses that correspond to a particular domain name. When a user requests a lookup for that domain, the DNS will provide all the known addresses in a random order. The user can pick one of the addr...
Page 127 - Dynamic DNS
Chapter 6 Configuring branch office tunnels 127 Nortel VPN Router Configuration — Basic Features branch offices are configured to use a domain name as a remote endpoint of the ABOT tunnel. When two initiators at the remote sites need to establish a tunnel, a DNS query resolves the configured domain ...
Page 128 - Configuring a branch office; Certain configuration changes are not reflected in the active
128 Chapter 6 Configuring branch office tunnels NN46110-500 The Nortel VPN Client supports dynamic DNS registration. The Client Dynamic DNS Registration setting on the Profiles > Groups > Edit > IPsec window enables you to select whether to enable or disable DDNS. It is enabled by default. ...
Page 130 - Adding a group; “Configuring a tunnel connection” on page 131
130 Chapter 6 Configuring branch office tunnels NN46110-500 Adding a group To create a new group: 1 Select Profiles > Branch Office . 2 In Groups section, click Add. The Add Group window appears. 3 Enter a name and then select select the parent group whose attributes the new group inherits; for e...
Page 131 - Configuring a tunnel connection
Chapter 6 Configuring branch office tunnels 131 Nortel VPN Router Configuration — Basic Features Configuring a tunnel connection To configure a connection: 1 On the Profiles > Branch Office window, select the button next to the connection name and click on Configure . The Connection Configuration...
Page 132 - Nortel VPN Router Security — Firewalls, Filters, NAT, and QoS
132 Chapter 6 Configuring branch office tunnels NN46110-500 6 Click the Filters drop-down list and choose the filter that you want this branch office connection to use. The default is permit all . You can specify one filter. Packet filtering controls the types of access allowed for users of this bra...
Page 133 - To add; Remote Networks; button to go to the; Add Networks; Sample branch office configuration; shows the configuration information and the addresses that
Chapter 6 Configuring branch office tunnels 133 Nortel VPN Router Configuration — Basic Features network, select it from the list and the Connection Configuration window appears. These networks have been previously set up on the Profiles > Networks window. 13 To add Remote Networks , click Add bu...
Page 135 - Sample branch office procedure
Chapter 6 Configuring branch office tunnels 135 Nortel VPN Router Configuration — Basic Features • The Profiles > Filters window must have the filters that you want to use for the branch office connection. For the example, the local Nortel VPN Router uses a filter of permit only dns/http, and the...
Page 136 - Try to ping from on PC to the other PC through the branch office.
136 Chapter 6 Configuring branch office tunnels NN46110-500 12 Click on the Test button on each end of the tunnel to verify connectivity. 13 Try to ping from on PC to the other PC through the branch office.
Page 137 - shows a sample branch office control tunnel environment
137 Nortel VPN Router Configuration — Basic Features Chapter 7Configuring control tunnels Control tunnels are special tunnels that allow you to securely manage a Nortel VPN Router over the Internet. The primary reasons for creating control tunnels are secure management and network data integrity. Co...
Page 138 - Control tunnel types; shows a special branch office control tunnel from
138 Chapter 7 Configuring control tunnels NN46110-500 Figure 27 Branch office control tunnel Control tunnel types There are two types of control tunnels: a branch office control tunnel and a user control tunnel. With both tunnel types, you can establish a secure IPsec tunnel to a system that you wan...
Page 140 - Restricted mode; If you change any settings to the branch office connection when
140 Chapter 7 Configuring control tunnels NN46110-500 In this environment, the remote Boston Nortel VPN Router is a control tunnel to the local Cleveland Nortel VPN Router. From any system on the Cleveland network, you can access the management address for the Boston Nortel VPN Router. This allows s...
Page 141 - Creating control tunnels; Nortel VPN Router Using the Command Line
Chapter 7 Configuring control tunnels 141 Nortel VPN Router Configuration — Basic Features To create a nailed-up control tunnel using the nailed-up parameter: 1 Go to Profiles > Branch Office window and click on Edit next to the group that you want to have nailed up. 2 On the Edit Group window, i...
Page 142 - When using the control create commands, you must enter them in a; Profiles > Branch Office
142 Chapter 7 Configuring control tunnels NN46110-500 1 Initiate a Telnet session to the customer’s Nortel VPN Router. 2 Enter the appropriate control create string, following the required control create parameters already described. A sample string follows: control create boston bostoncleveland 132...
Page 143 - Adding a control tunnel; “Configuring a control tunnel connection” on page 144
Chapter 7 Configuring control tunnels 143 Nortel VPN Router Configuration — Basic Features 3 Enter a name and then select select the parent group whose attributes the new group inherits; for example, /Base. The group name can be a maximum of 64 characters (spaces are permitted). The new group inheri...
Page 144 - Configuring a control tunnel connection
144 Chapter 7 Configuring control tunnels NN46110-500 Configuring a control tunnel connection To configure a Control Tunnel connection: On the Connection Configuration window, you enter required configuration information for the local branch office connection, for example, static routing and the IPs...
Page 146 - Creating a user control tunnel from the serial interface
146 Chapter 7 Configuring control tunnels NN46110-500 12 Click Create Local Network to go the Profiles > Networks window and define a local network. T he Local networks are the subnetworks on the private internal network of the local VPN Router.If you want to edit an existing local network, selec...
Page 147 - IPSec mobility and persistent mode; , if a client has a wireless connection to the
147 Nortel VPN Router Configuration — Basic Features Chapter 8Configuring IPSec mobility and persistent mode A large number of companies choose to secure access to their corporate networks via VPN using the IPSec protocol. IPSec allows corporate employees, located outside the corporate network to es...
Page 149 - IPSec mobility on Nortel VPN Router; Roaming performance factors; DHCP settings of the PC or the DHCP server; Logging and status for clients and servers
Chapter 8 Configuring IPSec mobility and persistent mode 149 Nortel VPN Router Configuration — Basic Features IPSec mobility on Nortel VPN Router Nortel VPN Router provides a new concept of IPSec mobility. The Nortel VPN Router IPSec implementation allows support for mobile clients to maintain tunne...
Page 150 - IPSec mobility and NAT; In
150 Chapter 8 Configuring IPSec mobility and persistent mode NN46110-500 The Nortel VPN Client status monitor reports if roaming is enabled for the session. The event log on the Nortel VPN Router reports on IPSec mobility actions. IPSec mobility and NAT If Nortel VPN Client is behind a NAT box with ...
Page 151 - Roaming from no NAT to behind NAT
Chapter 8 Configuring IPSec mobility and persistent mode 151 Nortel VPN Router Configuration — Basic Features Roaming from behind NAT to no NAT In Figure 31 before roaming a client was connected via AP1 and NAT box and had IP1 IP address. After roaming, the client is connected via AP2 without NAT, U...
Page 152 - IPSec mobility in NAT environment; illustrates; Routing table changes
152 Chapter 8 Configuring IPSec mobility and persistent mode NN46110-500 IPSec mobility in NAT environment In some situations roaming in the environment of NAT devices might prevent users from taking full advantage of IPSec mobility feature. Table 11 illustrates some configuration caveats that will ...
Page 153 - IP address change for any adapter
Chapter 8 Configuring IPSec mobility and persistent mode 153 Nortel VPN Router Configuration — Basic Features When operating in IPSec mobility mode with split tunneling enabled, the Nortel VPN Client does not consider the routing table to be maliciously altered and will not bring down the tunnel in ...
Page 154 - Maximum roaming time; Session persistence time has no direct impact on roaming time.
154 Chapter 8 Configuring IPSec mobility and persistent mode NN46110-500 Maximum roaming time Maximum roaming time is the time used by the Nortel VPN Client to keep the tunnel from going down after the IP address on the physical interface (on which tunnel was brought up) has been lost. For example, ...
Page 155 - Persistent tunneling; Session persistence time; If an authentication method with a challenge ,a one time password
Chapter 8 Configuring IPSec mobility and persistent mode 155 Nortel VPN Router Configuration — Basic Features Persistent tunneling A persistent VPN connection provides the ability to maintain a VPN connection without user intervention for a designated period of time. After successfully establishing ...
Page 156 - Configuring IPSec mobility and persistence; Configuring IPSec mobility; Nortel VPN Router Security — Firewalls, Filters,
156 Chapter 8 Configuring IPSec mobility and persistent mode NN46110-500 Session persistence time should be longer than the roaming time as persistence starts only after roaming fails. There is no direct relation between persistence and any other timers on the Nortel VPN Router. However, the Nortel ...
Page 157 - Mobility Support
Chapter 8 Configuring IPSec mobility and persistent mode 157 Nortel VPN Router Configuration — Basic Features Figure 32 Groups edit IPSec window 2 Scroll down to Mobility Support and select Enabled . The default is Disabled. 3 For Max Roaming Time(seconds), enter the number of seconds. The default i...
Page 158 - Enter the privileged mode:; Enter configuration mode:; To install advanced routing license:
158 Chapter 8 Configuring IPSec mobility and persistent mode NN46110-500 IPSec mobility performs at higher level than physical adapters. As a result, the PC on which the Nortel VPN Client runs can change between any physical adapters (wireless or wireline) and roaming will continue to work as long a...
Page 160 - To view the IPSec configuration for the group, for example Base:
160 Chapter 8 Configuring IPSec mobility and persistent mode NN46110-500 To view the IPSec configuration for the group, for example Base: CES(config)# show groups ipsec "/Base" IPSEC Settings: Rekey Timeout : 08:00:00 Rekey Data Count : 0 Perfect Forward Secrecy : Enabled Banner : Not Config...
Page 161 - To exit configuration mode:
Chapter 8 Configuring IPSec mobility and persistent mode 161 Nortel VPN Router Configuration — Basic Features Configured Client web page Saver Password Required : Disabled Client screen Saver Activation Time : 5 Client Policy : Not Configured Client Policy : Not Configured LDAP Authentication - User...
Page 165 - Glossary; IP addresses used to represent a series or range of IP addresses.
165 Nortel VPN Router Configuration — Basic Features Glossary acknowledgement (ACK) A type of message sent to indicate that a block of data arrived at its destination without error. address masks IP addresses used to represent a series or range of IP addresses. authentication A security procedure wh...
Page 168 - uses digital certificates, password-based keys, and tokens for
168 Glossary NN46110-500 IP address The identifiers used by the protocols that govern Internet information exchange. The Internet Network Information Center assigns these numbers to uniquely identify different machines on the Internet. IPsec A tunneling protocol that offers a strong level of encrypt...
Page 169 - The hardware address of a device connected to a shared media.
Glossary 169 Nortel VPN Router Configuration — Basic Features management IP address The IP address that is used to manage all system services from a Web browser, such as HTTP, FTP, and SNMP. This address must be accessible from one of the switch's private physical interfaces. To be accessible, the M...
Page 170 - A tunneling protocol that is used as a security tool.
170 Glossary NN46110-500 Point-to-Point Protocol (PPP) A protocol that provides a method for transmitting packets over serial point-to-point links. Point-to-Point Tunneling Protocol (PPTP) A tunneling protocol that is used as a security tool. port A transport layer demultiplexing value. Each applica...
Page 171 - A distance vector, as opposed to link state, routing protocol.
Glossary 171 Nortel VPN Router Configuration — Basic Features Routing Information Protocol (RIP) A distance vector, as opposed to link state, routing protocol. RSA digital signature A public-key encryptographic system that may be used for encryption and authentication. server A provider of resources...
Page 173 - Index
Nortel VPN Router Configuration — Basic Features 173 Index A access hours 78, 81, 119 accessible networks 120, 121 asymmetric branch office tunnel (ABOT) 119 asynchronous data over TCP (AOT) 105 authentication branch office 132, 145 authentication methods 119 B base group 76 branch office access hou...
Panasonic RB F10
User Manual
Panasonic SC HTB200
User Manual
Panasonic CS Z25UFRAW CU Z25UBRA
Manual
Panasonic CS Z50UFRAW CU Z50UBRA
User Manual
Panasonic DMW BLK22
User Manual
Panasonic NI WL55
Manual
Panasonic DMP BD903
Manual
Panasonic NN ST23QM
Manual
Panasonic FV-1115VK3
User Manual
Panasonic EH NA0J
Manual
Panasonic FV 30BG3
Manual
Panasonic RE7 59
User Manual
Panasonic NE C1275
Manual
Panasonic RG T810LHA
User Manual
Panasonic CF SR
User Manual
Panasonic RZ B110W
User Manual