Document Outline

• User Guide
  • Contents
  • Export
  • Licensing
  • Preface
    • Who Should Use This Book
    • Related documentation
    • Product Names
    • How This Book Is Organized
      • Users Guide
        • Appendices
    • Typographic Conventions
    • How to Get Help
      • Getting help from the Nortel Web site
      • Getting help over the phone from a Nortel Solutions Center
      • Getting help from a specialist by using an Express Routing Code
      • Getting help through a Nortel distributor or reseller
  • Introducing the VPN Gateway
    • SSL Acceleration
    • VPN
    • Hardware Platforms
    • Feature List
      • Software Features
        • Web Portal
        • Transparent Mode Access
        • User Authentication
        • User Authorization
        • Client Security
        • Accounting and Auditing
        • Networking
        • Secure Service Partitioning
        • Branch Office Tunnels
        • Portal Guard
        • SSL Acceleration
        • Scalability and Redundancy
        • Certificate and Key Management
        • Public Key Infrastructure
        • Supported Key and Certificate Formats
        • Supported Handshake Protocols
        • Hash Algorithms
        • Cipher Suites
        • Management
        • Statistics
        • Virtual Desktop
        • Secure Portable Office (SPO) Client
  • Introducing the ASA 310-FIPS
    • HSM Overview
    • Extended Mode vs. FIPS Mode
      • FIPS140-1 Level 3 Security
    • The Concept of iKey Authentication
      • Types of iKeys
      • Wrap Keys for ASA 310-FIPS Clusters
      • Available Operations and iKeys Required
    • Additional HSM Information
  • Initial Setup
    • Clusters
      • New and Join
      • Configuration is Replicated among Master NVGs
      • Clustering Over Multiple Subnets
    • IP Address Types
      • Host IP Address
      • Management IP Address (MIP)
      • Virtual IP Address (VIP)
      • Portal IP Address
      • Real Server IP Address (RIP)
    • Ports
    • Interfaces
      • One-Armed Configuration
      • Two-Armed Configuration
    • Configuration at Boot Up
      • The Setup Menu
    • Installing an NVG in a New Cluster
      • Setting Up a One-Armed Configuration
      • Setting Up a Two-Armed Configuration
      • Complete the New Setup
      • Settings Created by the VPN Quick Setup Wizard
        • Basic VPN Setup
        • Default Network
        • Default Services
    • Joining a VPN Gateway to an Existing Cluster
      • Setting up a One-Armed Configuration
      • Setting up a Two-Armed Configuration
      • Complete the Join Setup
    • Installing an ASA 310-FIPS
      • Installing an ASA 310-FIPS in a New Cluster
      • Adding an ASA 310-FIPS to an Existing Cluster
    • Reinstalling the Software
  • Upgrading the NVG Software
    • Performing Minor/Major Release Upgrades
      • Activating the Software Upgrade Package
  • Managing Users and Groups
    • User Rights and Group Membership
    • Adding a New User
      • Adding Users through RADIUS
    • Changing a Users Group Assignment
    • Changing a Users Password
      • Changing Your Own Password
      • Changing Another Users Password
    • Deleting a User
  • Certificates and Client Authentication
    • Generating and Submitting a CSR Using the CLI
    • Adding Certificates to the NVG
      • Copy-and-Paste Certificates
      • Copy-and-Paste Private Key
      • Using TFTP/FTP/SCP/SFTP to add Certificates and Keys
    • Update Existing Certificate
      • Create a New Certificate
    • Configure a Virtual SSL Server to Require a Client Certificate
    • Generating client certificates
      • Export Client Certificate
      • Transmit Private Key and Certificate to User
    • Managing Revocation of Client Certificates
      • Revoking Client Certificates Issued by an External CA
      • Revoking Client Certificates Issued within your Own Organization
      • Creating Your Own Certificate Revocation List
      • Automatic CRL Retrieval
    • Client certificate support
    • Signing CSRs
    • Generate Test Certificate
    • General Commands
      • Show Certificate Information
      • Show Subject Information
      • Check if Key and Certificate Match
      • Show Key Size
      • Show Key Information
  • Virtual Desktop
    • Running the Virtual Desktop on Client Computers
      • Licensing vdesktop
      • Launch Vdesktop from Portal
      • Virtual Desktop Operations
  • The Command Line Interface
    • Connecting to the VPN Gateway
      • Establishing a Console Connection
        • Requirements
        • Procedure
      • Establishing a Telnet Connection
        • Enabling and Restricting Telnet Access
        • Running Telnet
      • Establishing a Connection Using SSH (Secure Shell)
        • Enabling and Restricting SSH Access
        • Running an SSH Client
    • Accessing the NVG Cluster
    • CLI vs. Setup
    • Command Line History and Editing
    • Idle Timeout
  • Troubleshooting the NVG
    • Cannot Connect to VPN Gateway through Telnet or SSH
      • Verify the Current Configuration
      • Enable Telnet or SSH Access
      • Check the Access List
      • Check the IP Address Configuration
    • Cannot Add an NVG to a Cluster
    • Cannot Contact the MIP
      • Check the Access List
      • Add Interface 1 IP Addresses and MIP to Access List
    • The NVG Stops Responding
      • Telnet or SSH Connection to the Management IP Address
      • Console Connection
    • A User Password is Lost
      • Administrator User Password
      • Operator User Password
      • Root User Password
      • Boot User Password
    • An ASA 310-FIPS Stops Processing Traffic
    • Resetting HSM Cards on the ASA 310-FIPS
    • AnASA 310-FIPS Cluster Must be Reconstructed onto New Devices
    • A User Fails to Connect to the VPN
      • aaa
      • dns
      • ike
      • ipsec
      • ippool
      • ssl
      • tg
      • upref
      • smb
      • ftp
      • netdirect
      • netdirect_packet
    • User Unable to Connect to the VPN Gateway through the Net Direct
    • Cannot download the NetDirect Zipped file from client PC
    • System Diagnostics
      • Installed Certificates and Virtual SSL Servers
      • Network Diagnostics
      • Active Alarms and the Events Log File
      • Error Log Files
      • Unable to download NetDirect from VPN server
  • Appendix Supported Ciphers
    • Cipher List Formats
    • Modifying a Cipher List
    • Supported Cipher Strings and Meanings
  • Appendix The SNMP Agent
    • Supported MIBs
      • SNMPv2-MIB
      • SNMP-MPD-MIB
      • SNMP-FRAMEWORK-MIB
      • The SNMP-TARGET MIB
      • SNMP-NOTIFICATION-MIB
      • SNMP-VIEW-BASED-ACM-MIB
      • SNMP-USER-BASED-SM-MIB
      • S5-ETH-MULTISEG-TOPOLOGY-MIB
      • SYNOPTICS-ROOT-MIB
      • S5-TCS-MIB
      • S5-ROOT-MIB
      • IF-MIB
        • Limitations
      • IP-MIB
      • IP-FORWARD-MIB
      • ENTITY-MIB
      • DISMAN-EVENT-MIB
      • ALTEON-ISD-PLATFORM-MIB
      • ALTEON-ISD-SSL-MIB
      • ALTEON-SSL-VPN-MIB
      • IANAifType-MIB
    • Supported Traps
  • Appendix Syslog Messages
    • List of Syslog Messages
      • Operating System (OS) Messages
      • EMERG
      • CRITICAL
      • ERROR
      • System Control Process Messages
      • INFO
      • ALARM
      • EVENT
      • Traffic Processing Messages
      • CRITICAL
      • ERROR
      • WARNING
      • INFO
      • Startup Messages
      • INFO
      • Configuration Reload Messages
      • INFO
      • AAA Subsystem Messages
      • ERROR
      • WARNING
      • INFO
        • Log functionality
      • IPsec Subsystem Messages
      • ERROR
      • WARNING
      • NOTICE
      • INFO
    • Syslog Messages in Alphabetical Order
      • Appendix License Information
  • Appendix HSM Security Policy
    • Rainbow Technologies CryptoSwift® HSM Cryptographic Accelerator
    • Scope
    • 2.0 Applicable Documents
    • 3.0 Overview
    • 4.0 Capabilities
    • 5.0 Physical Security
    • 7.1 Module Interfaces
      • 6.1 USB (Universal Serial Bus) Interface
      • 6.2 Status LED (Light Emitting Diode) Interface
      • 6.3 Serial Interface
      • 6.4 PCI Interface
      • 6.5 Backup Battery Interface
      • 6.6 PCI Power Interface
    • 7.1 Components
      • 7.1 Bulk Crypto
      • 7.2 Power Management and Tamper Detect
      • 7.3 FastMap Processor
      • 7.4 Flash
      • 7.5 SRAM
      • 7.6 Real Time Clock/Battery Powered RAM (RTC/BBRAM)
      • 7.7 Programmable Logic Device (PLD)
      • 7.8 USB (Universal Serial Bus) Controller
      • 7.9 Universal Asynchronous Receiver Transmitter (UART)
      • 7.10 33MHz Clock
    • 8.0 Definition of Security Relevant Data Items
    • 9.0 Roles and Services
      • 9.1 Roles
        • 9.1.1 User
        • 9.1.2 Security Officer
      • 9.2 Authentication
      • 9.3 Initialization
      • 9.4 User Creation
      • 9.5 Services
    • 10.0 Key Management
      • 10.1 Key Generation
      • 10.2 Key Storage
      • 10.3 Key Entry and Output
      • 10.4 Key Distribution
      • 10.5 Key Destruction
      • 10.6 Key Archiving
    • 11.0 Modes
      • 11.1 FIPS 140-1 Mode
      • 11.2 Non-FIPS 140-1 Mode
    • 12.0 Self-Tests
    • 13.0 Conclusion
  • Appendix Definition of Key Codes
    • Syntax Description
      • Allowed Special Characters
      • Redefinable Keys
      • Example of a Key Code Definition File
  • Appendix SSH host keys
    • Methods for Protection
    • The VPN Gateway
  • Appendix Adding User Preferences Attribute to Active Directory
    • Install All Administrative Tools (Windows 2000 Server)
    • Register the Schema Management dll (Windows Server 2003)
    • Add the Active Directory Schema Snap-in (Windows 2000 Server an
      • Create a Shortcut to the Console Window
    • Permit Write Operations to the Schema (Windows 2000 Server)
    • Create a New Attribute (Windows 2000 Server and Windows Server 2
    • Create New Class
      • Add isdUserPrefs Attribute to nortelSSLOffload Class
      • Add the nortelSSLOffload Class to the User Class
  • Appendix Using the Port Forwarder API
    • General
    • Creating a Port Forwarder
    • Demo Application
    • Creating a Port Forwarder Authenticator
      • Example
    • Adding a Port Forwarder Logger
      • Example
    • Connecting Through a Proxy
    • Monitoring the Port Forwarder
      • Status
      • Statistics
  • Glossary
  • Export
  • Licensing