User`s guide

ManualsBrandsEnterasys ManualsComputer equipmentANG-7000

Rel. 3.5 Release Notes Page 1 of 30

Release Notes

Release 3.5 Enhanced Support for VPN Clients

Overview

This document describes Aurorean System Software Release 3.5 support for

Microsoft Windows XP VPN clients and enhanced ANG-1100 connectivity.

Features of the release include:

! Remote access inter-operability between Windows XP/2000 clients and

Aurorean Network Gateways, with support for:

– Layer 2 Tunnel Protocol (L2TP)/IPSec with IKE

– PPP Extensible Authentication Protocol (EAP)

– RADIUS extensions for EAP

– Certificate support within IKE/IPSec

– Certificate enrollment with Microsoft Windows 2000 Certificate

Authorities on the Aurorean Policy Server-3000/7000

! Network Extension Mode (NEM) for routing of the trusted subnet

connected to an ANG-1100 making those attached devices available to the

corporate network

! Peer to Peer Mode for tunneling between ANG-1100s to connect nodes on

both attached subnets

! Site to Site inter-operability with Cisco, Nortel and Nokia/Checkpoint

gateways

! RiverMaster tunnel configuration of L2TP and EAP protocols

! Resolved issues since the last release

! Known issues with this release

Aurorean Release 3.5 enhancements broaden the VPN options for clients, whether

they are operating on Windows XP/2000 platforms or connecting to an

ANG-1100/3000/7000. Network administrators and users are required to

perform some level of configuration to enable these enhancements, either on the

Command Line Interface to the ANG-3000/7000, the RiverMaster management

application, or the ANG-1100’s Web Config on-line tool, depending on which

options are implemented.

Also, administrators are required to upgrade their APS, ANG-3000/7000 and

RiverMaster software, install Microsoft Internet Explorer 5.5, configure the

Microsoft RADIUS server plugin on the APS, and set up L2TP and EAP protocols.

Instructions for network administrators and users to configure these

enhancements (or where directions can be found in associated documents), as

well as caveats to consider during configuration, are detailed in subsequent

sections of this document.

Summary of content (30 pages)

PAGE 1
Release Notes Release 3.5 Enhanced Support for VPN Clients Overview This document describes Aurorean System Software Release 3.5 support for Microsoft Windows XP VPN clients and enhanced ANG-1100 connectivity.
PAGE 2
Overview Release Notes Release 3.5 Enhanced Support for VPN Clients NOTE All Aurorean documentation can be found at the following URL: http://www.enterasys.com/support/manuals Figure 1 displays a varied topology of ANG-1100 connection options.
PAGE 3
Release Notes Release 3.5 Enhanced Support for VPN Clients Configuring VPN Inter-operability ! Example 5: An ANG-1100 is connected to a Nortel, Cisco or Nokia/Checkpoint router by a Peer to Peer tunnel. Configuring VPN Inter-operability Aurorean Release 3.5 provides seamless VPN inter-operability with Microsoft Windows XP and Windows 2000 desktops featuring support for the L2TP/IPSec tunneling protocol, EAP and Microsoft’s Certificate Authority (PKI).
PAGE 4
Upgrading to Aurorean Release 3.5 Release Notes Release 3.5 Enhanced Support for VPN Clients ! If EAP and MS-Chap are both enabled then the ANG unconditionally will prefer EAP over MS-Chap. It will request EAP authentication and then allow the client to alternately select MS-Chap if it so chooses. Upgrading to Aurorean Release 3.5 Upgrading your Aurorean software involves installing new certificates and upgrading to IE version 5.5 to ensure smooth and secure communications with a Microsoft XP VPN client.
PAGE 5
Release Notes Release 3.5 Enhanced Support for VPN Clients Upgrading to Aurorean Release 3.5 ! Aurorean_3.5.00-/Aurorean 3.5 System Software/Network Gateway/rts-3.5.00-.i386.rpm ! Aurorean_3.5.00-/Aurorean 3.5 System Software/Policy Server/setup.exe ! Aurorean_3.5.00-/Aurorean 3.5 System Software/RiverMaster/setup.exe Installing Internet Explorer Version 5.5 on APS-3000/7000 You can install Internet Explorer version 5.
PAGE 6
Upgrading to Aurorean Release 3.5 Release Notes Release 3.5 Enhanced Support for VPN Clients Figure 2 Windows IE Internet Options Window 4. Click on the Content tab. Page 6 of 30 Rel. 3.
PAGE 7
Release Notes Release 3.5 Enhanced Support for VPN Clients Upgrading to Aurorean Release 3.5 5. Click on the Certificates button. The Certificate Manager window appears as shown in Figure 3. Figure 3 Windows IE Certificate Manager Window 6. Click on the Intermediate Certification Authorities tab. 7. Select all authorities displayed and remove them. 8. Repeat the step in the Trusted Root Certification Authorities tab.
PAGE 8
Upgrading to Aurorean Release 3.5 Release Notes Release 3.5 Enhanced Support for VPN Clients and press ENTER. The VNC Authentication window appears as shown in Figure 4. The IP address you typed includes the port number (5800) with which to access the APS. Figure 4 Starting VNC Remote Control 2. Type welcome in the Password field and click OK. The APS desktop appears. 3. On the APS, open another Web browser and point it at your Microsoft Certification Authority.
PAGE 9
Release Notes Release 3.5 Enhanced Support for VPN Clients Upgrading to Aurorean Release 3.5 Figure 5 Network Password Window 4. Enter your network User Name and Password. The Domain name should already be entered. Press OK. The Microsoft Certificate Services Welcome window appears as shown in Figure 6. Rel. 3.
PAGE 10
Upgrading to Aurorean Release 3.5 Release Notes Release 3.5 Enhanced Support for VPN Clients Figure 6 Microsoft Certificate Services Welcome Window 5. Choose Request a Certificate and click Next. The Advanced Certificate Requests window appears as shown in Figure 7. Figure 7 Advanced Certificate Requests Window Page 10 of 30 Rel. 3.
PAGE 11
Release Notes Release 3.5 Enhanced Support for VPN Clients Upgrading to Aurorean Release 3.5 6. Select Submit a certificate request to this CA using a form and press Next. The Advanced Certificate Request window appears as shown in Figure 8. Figure 8 Advanced Certificate Request Window Rel. 3.
PAGE 12
Upgrading to Aurorean Release 3.5 Release Notes Release 3.5 Enhanced Support for VPN Clients 7. Make the following selections: – – – – – – – – From the Certificate Template pull-down menu, choose User. From the Key Options CSP pull-down menu, choose Microsoft Base Cryptographic Provider v1.0. For Key Usage, select Both. For Key Size, enter 1024 Select Create new key set Select Use local machine store From the Additional Options pull-down menu, select SHA1 as the Hash Algorithm. Click Submit.
PAGE 13
Release Notes Release 3.5 Enhanced Support for VPN Clients Upgrading to Aurorean Release 3.5 To issue the ipsecDefault command, perform the following: 1. Log into the ANG-3000/7000 with the login and password netadmin (default) and press ENTER. 2. At the command prompt, change directory to usr/indus/ipsec. 3. Type ipsecDefault and press ENTER. 4. Reboot the ANG-3000/7000.
PAGE 14
Using Network Extension Mode for ANG-1100 Tunnels Release Notes Release 3.5 Enhanced Support for VPN Clients Figure 10 Configuring the Microsoft RADIUS Plugin on RiverMaster Using Network Extension Mode for ANG-1100 Tunnels Network Extension Mode (NEM) is designed to open up network resources situated behind ANG-1100s.
PAGE 15
Release Notes Release 3.5 Enhanced Support for VPN Clients Using Network Extension Mode for ANG-1100 Tunnels provide a path to remotely manage the ANG-1100 over the tunnel). The new rule automatically secures data to whatever subnet is configured on the ANG-1100's trusted interface. ! RIP packets sent from the ANG-1100 into the tunnel broadcast reachability to the ANG-1100's trusted subnet. Routing protocols on the ANG-3000/7000, if enabled, then relay those routes into the intranet routing fabric.
PAGE 16
Using Network Extension Mode for ANG-1100 Tunnels Release Notes Release 3.5 Enhanced Support for VPN Clients Caveats If you configure NEM, be aware that: ! The subnet attached to the remote ANG-1100’s trusted interface is the only subnet routed across the tunnel to the central ANG-3000/7000. Other subnets connected via routers to the ANG-1100’s trusted interface are not routed.
PAGE 17
Release Notes Release 3.5 Enhanced Support for VPN Clients Network A 192.168.1.0 Network B 192.168.2.0 Network C 192.168.3.0 Using Network Extension Mode for ANG-1100 Tunnels ANG-1100 ANG-7000 Router ANG-1100 ANG-7000 ANG-1100 Network Extension Mode tunnel Figure 13 Multiple Network Extension Mode Tunnels CAUTION Be sure no central ANG-3000/7000 virtual subnet pools overlap with this range of network addresses. 2.
PAGE 18
Using Network Extension Mode for ANG-1100 Tunnels Release Notes Release 3.5 Enhanced Support for VPN Clients 10. Create an IPSec rule. Type ./ipsecRule -a -n ezipsec -s ezipsec -w process -b spd -e tunnel -p ezipsec and press ENTER. 11. Type ./ipsecRule -L and press ENTER to display and verify the rule was added. 12. Type ./ipsecSpd -n external -r 'gre;ike;ezipsec;pptpIn; pptpOut;irppIn;irppOut;https;l2tpIntout’ and press ENTER.
PAGE 19
Release Notes Release 3.5 Enhanced Support for VPN Clients Using Peer to Peer Tunnels Using Peer to Peer Tunnels Aurorean Release 3.5 introduces Peer to Peer tunnel mode, which is designed to connect ANG-1100s in remote branch offices, giving a device on one remote network access to a device on another remote network as well as connect to a central ANG-3000/7000 or third-party VPN gateway (refer to Figure 14).
PAGE 20
Using Peer to Peer Tunnels Release Notes Release 3.5 Enhanced Support for VPN Clients ! The Security Policy used by a Peer to Peer networking tunnel is identical to that used by EZ-IPSec, the streamlined implementation of IPSec on the ANG-1100.
PAGE 21
Release Notes Release 3.5 Enhanced Support for VPN Clients Inter-operability with Third-Party VPN Gateways CAUTION NEM tunnels can not be mixed with Peer to Peer tunnels. ! Remote peers must not have dynamically assigned IP addresses because preshared key authentication (if selected) uses IKE Main Mode. The security policy database on each peer must also contain a fixed IP address of the remote peer.
PAGE 22
Inter-operability with Third-Party VPN Gateways 5. Release Notes Release 3.5 Enhanced Support for VPN Clients In the add Security Association window, enter the following values: – – – – – – – – – – – – – – – Enter an SA Name Select From Rule (default) as the granularity of this SA. Select ESP/SHA/HMAC-160 as the Authentication Algorithm from the pull-down menu. Select the Encryption Algorithm 3DES-168 from the pull-down menu. Select Tunnel as the Encapsulation Mode.
PAGE 23
Release Notes Release 3.5 Enhanced Support for VPN Clients Inter-operability with Third-Party VPN Gateways ! Enter Cisco_Peer in the VPN Connection Name field. ! Set the public IP address of the Cisco device. Type 146.115.206.35 in the Gateway IP address field. ! Enter testing as a Password. This value must match the value configured for the Cisco device. ! Select Peer to Peer Mode. ! Type 10.120.54.0/24 in the first Peer Subnet address and Mask fields.
PAGE 24
Inter-operability with Third-Party VPN Gateways Release Notes Release 3.5 Enhanced Support for VPN Clients 13. RIP is enabled by default. You may want to change this selection. 14. Click OK. Configuring VPN Settings on the ANG-1100 To configure the ANG-1100 to connect with the Nortel 600, enter the following values in the VPN Setup window of the Web Config utility of the ANG-1100. For more information on configuring the ANG-1100, refer to the ANG-1100 User’s Guide.
PAGE 25
Release Notes Release 3.5 Enhanced Support for VPN Clients Inter-operability with Third-Party VPN Gateways Connecting to the Checkpoint 4.1 Firewall This sample configuration demonstrates how to create an IPSec tunnel with preshared keys between two private networks: a private network inside the ANG-1102 (192.168.1.1) and a private network inside the Checkpoint (10.120.54.x). Hardware and Software Versions ! Checkpoint 4.1 Firewall ! ANG-1102 - V3.
PAGE 26
Inter-operability with Third-Party VPN Gateways Release Notes Release 3.5 Enhanced Support for VPN Clients 4. Enter a Network Object for the ANG-1102 Private Address. Select Manage > Network objects > New (or Edit) >. – – – Enter the name of the Network Object (reference only). Enter the Private Address/Mask of the ANG-1102 network. (192.168.1.0/24). Set the location = External. 5. Enter a Network Object for the ANG-1102. Select Manage > Network objects > New > Workstation.
PAGE 27
Release Notes Release 3.5 Enhanced Support for VPN Clients 9. Resolved Issues from the Last Release Configuration - the Phase II Security Action. – – – – – – – – Click the Green Encrypt icon under the Action heading. Select Edit to Configure. Select IKE, and then click Edit. Select Encryption + Data Integrity (ESP). Set the the Encryption Algorithm = 3DES. Set Date Integrity = SHA1. Set Allowed Peer Gateway = External ANG-1102 Gateway (configured in Step 4). Click OK.
PAGE 28
Known Issues With This Release Release Notes Release 3.5 Enhanced Support for VPN Clients It has not been verified that SecurID authentication operates for native clients using EAP. ! IE v.6 Does Not Run with the ANG-3000/7000 Web Config WebConfig on the ANG-3000/7000 does not display using Internet Explorer v. 6 with Windows XP. Bug # 3328.
PAGE 29
Release Notes Release 3.5 Enhanced Support for VPN Clients Known Issues With This Release Since IPSec default values were removed from the APS database, Floppy Configuration does not run correctly. To set these defaults, you must run the ipsecDefault script using the CLI on the remote ANG receiving the configuration via a floppy disk. CAUTION This script first erases all IPSec configuration settings and then reloads it with the factory default. Any configurations you added earlier are lost.
PAGE 30
Contacting Enterasys Networks Release Notes Release 3.5 Enhanced Support for VPN Clients Contacting Enterasys Networks For general information on Enterasys Networks products, access the company’s Web site at www.enterasys.com or write/call the company at: Enterasys Networks 35 Industrial Way Rochester, NH 03866 Phone: (877)-641-7400 To reach an Enterasys Networks Sales representative, call 1 (877) 641-7400, or send E-mail to www.enterasys.com.