HP TMS zl Module Security Administrator's Guide

4-40
Configuring a VPN on the HP TMS zl Module
Configure an IPsec Client-to-Site VPN
address and create a separate IPsec policy for each remote client. Other
clients (such as the Mac IPSecuritas) can send an entire subnet. Do one
of the following to specify addresses:
• Manually type an IP address, IP address range, or network address in
CIDR format
• Select a single-entry IP, range, or network address object.
•Select Any to permit any IP address.
Caution The remote addresses in combination with the local addresses must not
include management traffic to the TMS zl Module. If you violate this rule, you
first must configure a Bypass policy with top priority that selects the manage-
ment traffic, or NIM will lose contact with the module and you will be locked
out of the Web browser interface.
If you do cause NIM to lose contact with the TMS zl Module, follow this
procedure:
1. Access the module and delete the IPsec policy:
• If the module has multiple IP addresses in its management-access
zone, you might be able to contact the module’s Web browser inter-
face at one of the other addresses. You can then delete the faulty IPsec
policy from the VPN > IPsec > IPsec Policies window (the policy will
be labeled with the deployment name that you specified in the wiz-
ard).
• If you cannot reach the module’s Web browser interface, you can use
the CLI to delete the faulty IPsec policy. Access the host switch CLI
and enter these commands:
hostswitch(config)# services <slot ID> name tms-module
hostswitch(tms-module-<slot ID>)# config
hostswitch(tms-module-<slot ID>:config) no ipsec policy
<policy name>
Replace <slot ID> with the ID of the slot in which the TMS zl
Module is installed. Replace <policy name> with the deployment
name that you specified in the wizard. (You can also use the show
ipsec policy command to view the name.)
2. NIM should now be able to contact the TMS zl Module. It is best practice
to synchronize the TMS properties before you continue configuring.