Document Outline

• VPNmanager® Configuration Guide Release 3.7
• Contents
• Preface
  • What Products are Covered
  • VPNmanager Overview
    • Network-wide Visibility and Control
    • Intranet and Extranet Support
    • Secure VPN Configuration
    • No Special Consoles Required
    • Complementary to SNMP Management Tools
    • Using VPNmanager Help
  • Related Documentation
  • How This Book Is Organized
  • Contacting Technical Support
• Chapter 1: Overview of implementation
  • Components of the Avaya security solution
    • Security gateways
    • VPNremote Client software
    • VPNmanager software
  • Overview of the VPN management hierarchy
  • Preparing to configure your network
    • Security gateway
      • Static Routes
    • IP groups
    • Remote users and user groups
    • VPN
    • Security policies
      • Firewall policies
      • Denial of Service
      • QoS
    • VoIP
    • Additional features
      • NAT
      • SNMP
      • Syslog
      • Client IP address pooling
      • SSL for Directory Server
  • Sequence to configure your VPN
• Chapter 2: Using VPNmanager
  • About VPNmanager administrators
    • Role Based Management
  • Log into the VPNmanager console
    • Add a policy server
    • Open Domain
  • Navigating the main window
    • File menu
    • Edit menu
    • View menu
    • Tools menu
    • Help menu
    • Toolbar
    • VPN view pane
      • Network Diagram View
      • Tiled View
      • Tree View
    • Alarm monitoring pane
  • Configuration Console window
    • Configuration Console Menu bar
      • File menu
      • Edit menu
      • View menu
      • Tools menu
      • Toolbar
      • Contents pane
      • Details pane
  • Update Devices
  • Preferences
    • General tab
    • Dyna Policy Defaults (User)
    • Dyna Policy Defaults (Global)
    • Dyna Policy Authentication
    • Advanced
    • Remote Client
    • Alarm/Monitoring
    • TEP Policy
• Chapter 3: Setting up the network
  • New VPN Domain
  • Configuring a security gateway
    • Creating a new security gateway
  • Using Device tabs to configure the security gateway
    • General tab
    • Memo tab
    • DNS tab
      • Configuring the DNS tab for security gateways at 4.3 or later
      • Configuring the DNS tab for VSU at VPNos 4.2 or earlier
    • Interfaces tab
      • Options for IP addressing for interface zones
      • Static addressing
      • DHCP addressing
      • Point-to-Point Protocol Over Ethernet (PPPoE) Client
      • Local DHCP Server
      • DHCP Relay
      • Static
      • Changing network interfaces
    • Private port tab
      • Adding an IP Device Configuration
      • DHCP Relay
      • None
    • Device users tab
    • Network Object tab
    • Routing
    • Default Gateway for VPN Traffic (VPNos 3.X)
    • Policies tab, NAT services
      • About NAT types for VPNos 4.31
      • Configuring NAT (VPNos 4.31)
    • About NAT types for VPNos 3.X
      • NAT applications
      • Accessing the Internet from private networks
      • Setting up VPN with overlapping private addresses
      • Using NAT to support multiple gateway configurations
    • Interface for VPNos 4.2
      • Add NAT Rule (VPNos 4.2 or earlier)
      • Original
      • Tunnel NAT rules
• Chapter 4: Configuring IP Groups
  • About IP Groups
    • Creating a New IP Group
  • New IP Group
  • IP Group - General tab
  • Add IP Group member
    • Configuring an IP Group
    • Configuring an IP Group that connects to an extranet
    • Delete
  • Memo
• Chapter 5: Configuring remote access users
  • Default client configuration
  • Using dyna-policy
  • Configuring a global dyna-policy
    • Dyna-Policy Defaults (User) tab
      • VPN configuration files on remote user’s computer
      • Disable split tunneling
    • Dyna-Policy Defaults (Global) tab
    • Dyna-Policy Authentication tab
      • Local authentication
      • RADIUS authentication
      • LDAP authentication
      • Dynamic VPNs (VPNos 3.x)
    • Remote Client tab
      • Client DNS resolution redirection
      • Client DNS resolution redirection
      • Remote Client inactivity connection time-out (VPNos 3.x)
      • Send Syslog messages. . .
  • Configure a default CCD with global dyna-policy
  • Creating new user object
    • Default user
  • About creating individual dynamic-policy
    • User - General tab
    • Memo tab
    • Dyna-Policy tab
    • Actions tab
  • Configuring a remote user object
  • Information for VPNremote Client users
    • Using local authentication
    • Using RADIUS authentication (VPNos 3.X and VPNos 4.31)
    • Using LDAP authentication (VPnos 3.X only)
  • Using Policy Manager for user configuration
    • Client IP address pool configuration
      • Add Client IP address pool
      • Add Client DNS
      • Add Client WINS
      • To configure the Client IP configuration
    • Configuring client attributes
      • Creating a message
      • Enforce brand name
  • RADIUS/ACE Services
    • Enable RADIUS/ACE
    • Settings
    • RADIUS concepts
    • The RADIUS protocol
    • Add (RADIUS/ACE server)
      • Authenticating (secret) password
      • RADIUS server data
      • To add a RADIUS server:
• Chapter 6: Configuring user groups
  • New user group
  • User Group - General tab
  • User Group - Memo tab
  • User Group - Actions tab
  • Configuring a user group
• Chapter 7: Configuring VPN objects
  • Types of VPN objects
    • SKIP VPNs
    • IKE VPNs
    • VPN packet processing modes
  • Default VPN policy
  • Creating a new VPN object
  • Creating a default VPN
  • Creating a designated VPN
  • Using the VPN tabs
    • General tab
      • General tab with IKE
      • General tab with SKIP
    • Memo tab
    • Members-Users tab
    • Members-IP Groups tab
    • Security (IKE) tab
      • Pre-Shared Secret
    • Security (IPSec)
      • IPSec Proposals
    • Add IPSec proposal
    • Actions tab
    • VPN configuration
      • Export
    • Rekey site-to-site VPN
      • Rekey
  • Advanced VPN tab
  • Configuring a SKIP VPN
  • Configuring an IKE VPN
  • Enabling CRL checking
  • Exporting a VPN object to an extranet
    • VPN Object export checklist
    • Export procedure
  • Importing a VPN object from an extranet
  • Rekeying a VPN object
• Chapter 8: Establishing security
  • Firewall rules set up
    • Levels of firewall policy management
    • Firewall rules
      • Domain level firewall rules
      • Device level firewall rules
      • Priority of Firewall rules versus NAT rules
      • Setting up firewall rules for FTP
      • FTP and Firewall/NAT Operation
      • Security Gateways and FTP
    • Firewall templates
      • Predefined templates
      • User defined templates
  • Services
  • Device Group
  • Denial of Service
  • Voice Over IP
    • Using the IP Trunking Call Model
      • Using the LRQ Required checkbox of the IP Trunking Call Model
    • Using the Gatekeeper Routed Call Model
      • Add gatekeeper settings
  • QoS policy and QoS mapping
    • QoS Policy
    • QoS mapping
  • Packet Filtering
    • What can be filtered
    • Packet Filtering and NAT
    • Advanced
      • Permit/Deny non-VPN traffic Radio Buttons
      • Add Packet Filtering Policy
      • From/Where
      • To Where
      • The Filtering Policy in progress
      • Locating this filtering policy
      • The filtering policy in progress
      • Running the packet filtering policy wizard
      • Running the Policy Manager for packet filtering
      • Starting and stopping filtering services
      • Managing the ACL
      • Configuring advanced filtering options
    • Marking packets for differentiated services (QoS)
      • About Differentiated Services
      • How a VSU marks packets
      • Types of marking rules
      • How to create a packet marking rule
    • Packet filtering firewall
      • Add firewall policy
• Chapter 9: Using advanced features
  • Device Advanced
    • ARP
    • Path MTU Discovery
    • NAT Traversal
    • Port for dyna-policy download
    • Port for Secure Authentication
    • Private IP Address (VPNos 3.x)
    • Send Device Names
    • SuperUser Password (VPNos 3.x)
    • Tunnel Persistence
  • TEP Policy
  • Servers
    • Add servers
    • Managing the server list
  • Resilient Tunnel
    • Tunnel Switching
    • Creating a resilient tunnel
    • Add resilient tunnel
      • Prerequisites
    • Managing the resilient tunnel list
    • Stopping and starting resilient tunnel services
      • Primary end-point service
      • Secondary end-point service
  • Failover TEP
    • Configuring failover TEP
  • Advanced Action
    • Switch Flash
    • Reset password
    • Disable FIPS
  • High Availability
    • Virtual addresses
      • Advanced parameters
    • Members
    • Configuring high availability
      • Creating a High Availability Group
      • Updating a high availability group using Update Device
      • Deleting a high availability group
  • Failover
    • Failover reconnect
  • Converged Network Analyzer Test Plug
  • Keep Alive
  • Policy Manager - My Certificates
    • About VSU certificates
    • Creating and Installing a Signed Certificate
    • Switching certificates used by VPNmanager Console
    • Issuer certificates
      • About Issuer Certificates
      • Installing an issuer certificate
    • IKE Certificate Usage
      • About Certificate Usage (Exchange)
      • Assigning a Target for a Certificate
• Chapter 10: Monitoring your network
  • Using SNMP to monitor the device
    • Adding Admin Users for SNMPv3
    • VPN active sessions
  • Syslog Services
    • Add Syslog Policy
  • Using Monitor
    • Enterprise MIB
    • Monitoring wizard
      • Define Custom
    • Monitoring wizard (Presentation)
      • Presentation
  • Monitoring alarms
    • Alarm Types
  • Report Wizard
    • Generating the report
  • Device diagnostics
• Chapter 11: Device management
  • Using the Management tab
    • Setting Up SSH and Telnet
    • Changing device administrator’s passwords
  • Using the Connectivity tab
    • Check connectivity by ping
    • Check Connectivity by Proxy Ping
  • Using the Device Actions tab
    • Update Configuration
    • Reset Device Time
    • Reboot Device
    • Re-setup Device
    • Import Device Configuration
    • Ethernet Speed
    • Redundancy
      • Network Interface Status
      • Switching
  • Importing and exporting VPN configurations to a device
    • Export VPN
    • Exporting RADIUS
• Chapter 12: Upgrading firmware and licenses
  • Centralized firmware management
  • Device - Upgrade tab
    • Upgrading a security gateway’s firmware
    • License
    • Encryption Strength
    • Remote Access (VSU-100 Only)
• Appendix A: Using SSL with Directory Server
  • When to Configure your VPNmanager for SSL
  • Installing the issuer’s certificate in the policy server and the VPNmanager Console
    • Windows NT and Windows 2000 Computers
    • Solaris OS Computers
  • Installing the Issuer’s Certificate into a security gateway
• Appendix B: Firewall rules template
  • General
  • Public zone firewall templates
  • Private zone firewall templates
  • Semi-private zone firewall templates
  • DMZ zone firewall templates
  • Management zone security
  • Converged Network Anaylyzer template
• Glossary
  • A
  • B
  • C
  • D
  • E
  • F
  • H
  • L
  • M
  • N
  • O
  • P
  • R
  • S
  • Syslog
  • T
  • U
  • V
• Index
  • Numerical
  • A
  • B
  • C
  • D
  • E
  • F
  • G
  • H
  • I
  • K
  • L
  • M
  • N
  • P
  • Q
  • R
  • S
  • T
  • U
  • V
  • W
  • X
  • Z