User's Manual

ManualsBrandsNortel Networks ManualsNetwork RouterNortel Networks Network Router 1050

RSA SecurID Ready Implementation Guide

Last Modified: September 30, 2005

Partner Information

Product Information

Partner Name

Nortel Networks

Web Site www.nortelnetworks.com

Product Name

Nortel VPN Router

Version & Platform

1050, 1740, 2700, 5000 Series

Product Description

Each Nortel VPN Router is a single hardware device that provides routing,

firewall, bandwidth management, encryption, authentication, and data

integrity for secure tunneling across managed IP networks and the Internet.

With Contivity VPN Switches, you can connect remote users, branch

offices, suppliers, and customers with the cost and performance

advantages of shared IP networks and the security and control you would

expect from private networks.

Product Category

Virtual Private Networking

Summary of content (12 pages)

PAGE 1
RSA SecurID Ready Implementation Guide Last Modified: September 30, 2005 Partner Information Product Information Partner Name Web Site Product Name Version & Platform Product Description Product Category Nortel Networks www.nortelnetworks.
PAGE 2
Solution Summary Partner Integration Overview Authentication Methods Supported RADIUS List Library Version Used N/A RSA Authentication Manager Name Locking No RSA Authentication Manager Replica Support No Secondary RADIUS Server Support Yes (3) Location of Node Secret on Agent ‘None stored’ RSA Authentication Agent Host Type Communication Server RSA SecurID User Specification Designated users RSA SecurID Protection of Administrative Users No RSA Software Token API Integration Yes Use of
PAGE 3
Product Requirements Partner Product Requirements: Nortel VPN Router Firmware Version V05_05.202 Partner Product Requirements: Nortel VPN Client Operating System Windows XP Windows 2000 Windows 98 Windows ME Required Patches Note: Nortel VPN Client Version 4.86 is the last release that provides support for the Windows NT operating system. Version 4.91 will be the last release that provides support for Windows 98 and Windows ME operating systems.
PAGE 4
Agent Host Configuration To facilitate communication between the Nortel VPN Router and the RSA Authentication Manager / RSA SecurID Appliance, an Agent Host record must be added to the RSA Authentication Manager database. The Agent Host record identifies the Nortel VPN Router within its database and contains information about communication and encryption. To create the Agent Host record, you will need the following information.
PAGE 5
Partner Authentication Agent Configuration Before You Begin This section provides instructions for integrating the Nortel VPN Router with RSA SecurID Authentication. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section.
PAGE 6
4. In the ‘RADIUS Servers’ section, fill out the info required. The Secret information for these servers should match the encryption key assigned in the Agent Host configuration. RADIUS Group Configuration Any user seeking RADIUS authentication must belong to a group specified by a group ID and password, configured in the Profiles > Groups > Edit > IPSec > Authentication > Configure page.
PAGE 7
IPSec Client configuration Upon first run of the Contivity VPN Client, you will be prompted to create a connection profile via the Connection Wizard. Use the screenshots below as a guide to setting up your connection for RSA SecurID authentication. For a detailed explanation of each configuration parameter, please reference the manuals from Nortel that comes with the client software.
PAGE 8
User ID for RSA SecurID Authentication Name/IP Address of switch Do you need to initiate a dial up connection first or are you already connected to the internet/network? Setup complete! Login screen 8
PAGE 9
Certification Checklist Date Tested: September 30, 2005 Product Name RSA Authentication Manager RSA Software Token RSA Authentication Utility Nortel VPN Router Certification Environment Version Information Operating System 6.1 3.0.5 1.0 Build 25 1050 Windows 2003 Server (SP1) Windows XP Professional (SP2) Windows XP Professional (SP2) Firmware V05_05.
PAGE 10
Known Issues RSA Software Token The Contivity VPN Client can be configured to detect the installation of the RSA Software Token through the presence of stauto32.dll. Users will then be prompted for their Pin only. The Tokencode displayed on the Software Token is automatically coupled with the Pin and passed along to the RSA ACE/Server.
PAGE 11
Alphanumeric PINS The Contivity VPN Client does not allow alphabetic characters to be entered in the Passcode field of the connection dialog box. There is a workaround for instances where alphanumeric PINs are allowed for SecurID users, the Contivity VPN Client must be configured to display separate Tokencode and PIN fields. This is achieved by clearing the Use Passcode Display checkbox in the Two-Factor Authentication Token Options dialog.
PAGE 12
RSA Authentication Utility (SID800 Integration) Authentication fails if user enters 0000 as permanent SecurID PIN. A user may not be able to authenticate when completing the New PIN procedure if the user enters four zeros (0000) as the permanent PIN. You cannot use 0000 as a permanent PIN.