Nokia IP VPN Gateway Getting Started Guide. Version 6.3

Transcription

1 Nokia IP VPN Gateway Getting Started Guide Version 6.3 Part No. N Rev A Published June 2005

2 COPYRIGHT 2005 Nokia. All rights reserved. Rights reserved under the copyright laws of the United States. RESTRICTED RIGHTS LEGEND Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software, the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted Rights clause at FAR IMPORTANT NOTE TO USERS This software and hardware is provided by Nokia Inc. as is and any express or implied warranties, including, but not limited to, implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage. Nokia reserves the right to make changes without further notice to any products herein. TRADEMARKS Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document are trademarks or registered trademarks of their respective holders Nokia IP VPN Gateway Getting Started Guide

3 Nokia Contact Information Corporate Headquarters Web Site Telephone or Fax Mail Address Nokia Inc. 313 Fairchild Drive Mountain View, California USA Regional Contact Information Americas Nokia Inc. 313 Fairchild Drive Mountain View, CA USA Tel: Outside USA and Canada: Europe, Middle East, and Africa Nokia House, Summit Avenue Southwood, Farnborough Hampshire GU14 ONG UK Tel: UK: Tel: France: Asia-Pacific 438B Alexandra Road #07-00 Alexandra Technopark Singapore Tel: Nokia Customer Support Web Site: Americas Europe Voice: or Voice: +44 (0) Fax: Fax: +44 (0) Asia-Pacific Voice: Fax: Nokia IP VPN Gateway Getting Started Guide 3

4 4 Nokia IP VPN Gateway Getting Started Guide

5 Contents About This Guide In This Guide Conventions This Guide Uses Notices Text Conventions IP Address Notation Related Software Documentation Related Hardware Documentation Introducing the Nokia IP VPN Gateway Nokia VPN Manager Software Configuring the Nokia IP VPN Gateway Installing Nokia VPN Manager Supported Software System Requirements Installing Nokia VPN Manager onto a Windows System Installing Nokia VPN Manager onto a Red Hat Linux System Performing the Initial Gateway Configuration Before You Begin Nokia 5i Gateway Configuration Limitations Configuring the Initial Gateway Settings Configuring a Static Gateway Configuring a Dynamic Gateway Requirements for Installing a Dynamic Gateway Configuring a Management Proxy Upgrading an Existing Management Proxy to v Advantages to Upgrading the Management Proxy to v Turning On Power to the Dynamic Gateway Deploying the Initial Gateway Configuration Deploying the Initial Gateway Configuration by using the Console Port Deploying the Initial Gateway Configuration by using Completing the Pending Installation Nokia IP VPN Gateway Getting Started Guide 5

6 3 Installing Multiple Gateways Using the Nokia VPN Import Gateways Feature Installation Script Format CSV Grammar for Configuration Settings CSV Grammar Installation Script with Configuration Settings Example Installation Script A Configuring a Syslog Server Index Nokia IP VPN Gateway Getting Started Guide

7 Tables Table 1 Text Conventions Table 2 Gateway Settings Table 3 Key to Symbols in CSV Grammer Nokia IP VPN Gateway Getting Started Guide 7

8 8 Nokia IP VPN Gateway Getting Started Guide

9 About This Guide This guide is written for system administrators and describes how to setup and configure the Nokia IP VPN Gateway, including how to install Nokia VPN Manager v6.3 and how to initially configure your gateway. For information about how to configure and manage the Nokia IP VPN Gateway by using the Nokia VPN Manager software, see the Nokia IP VPN Gateway Configuration Guide v6.3, available on the CD-ROM provided with your product. For information about configuring and managing the gateway using the command-line interface (CLI), see the Nokia IP VPN Command-Line Summary v6.3. This preface provides the following information: In This Guide Conventions This Guide Uses Related Software Documentation In This Guide This guide is organized into the following chapters and appendixes: Chapter 1, Introducing the Nokia IP VPN Gateway provides an overview of the Nokia IP VPN gateway. Chapter 2, Configuring the Nokia IP VPN Gateway describes how to install Nokia VPN Manager and perform the initial gateway configuration. Chapter 3, Installing Multiple Gateways describes the installation of multiple gateways by reading in a set of files in a simple text format that can be manually or automatically created by the administrator. Appendix A, Configuring a Syslog Server describes how to configure the syslog server. Nokia IP VPN Gateway Getting Started Guide 9

10 Conventions This Guide Uses Notices The following sections describe the conventions this guide uses, including notices, text conventions, and IP address notation. Warning Warnings advise the user that bodily injury might occur because of a physical hazard. Caution Cautions indicate potential equipment damage, equipment malfunction, loss of performance, loss of data, or interruption of service. Note Notes provide information of special interest or recommendations. Text Conventions Table 1 describes the text conventions this guide uses. Table 1 Text Conventions Convention monospace font bold monospace font Key names Menu commands Description Indicates command syntax, or represents computer or screen output, for example: Log error Indicates text you enter or type, for example: # configure nat Keys that you press simultaneously are linked by a plus sign (+): Press Ctrl + Alt + Del. Menu commands are separated by a greater than sign (>): Choose File > Open. 10 Nokia IP VPN Gateway Getting Started Guide

11 Related Software Documentation Table 1 Text Conventions (continued) Convention The words enter and type Italics Description Enter indicates you type something and then press the Return or Enter key. Do not press the Return or Enter key when an instruction says type. Emphasizes a point or denotes new terms at the place where they are defined in the text. Indicates an external book title reference. Indicates a variable in a command: delete interface if_name IP Address Notation Nokia VPN Manager software uses standard notation for identifying IP addresses and subnet masks. IP addresses followed by a slash and a number specify an IP network number and network mask (where the number following the slash indicates the number of bits in the network portion of the address). For example, /24 indicates that the first three octets (bytes) represent the network number and the last octet represents the host number. Addresses in this network can vary from to In this example, /24 is equivalent to the address with a network mask of Related Software Documentation In addition to this guide, documentation for this product includes the following: Nokia IP VPN Gateway Configuration Guide v6.3 Nokia IP VPN Command-Line Summary v6.3 Nokia IP VPN Gateway Routing Administration Guide v6.3 Release Notes are available in ASCII-text file format on the CD-ROM provided with your product. Nokia VPN Manager includes a comprehensive help system that provides GUI-based procedures and an online version of the Nokia IP VPN Gateway Configuration Guide. Related Hardware Documentation Nokia 5i and 10i Installation Guide Nokia 50i Installation Guide Nokia 100i Installation Guide Nokia 500i Installation Guide Nokia IP VPN Gateway Getting Started Guide 11

12 12 Nokia IP VPN Gateway Getting Started Guide

13 1 Introducing the Nokia IP VPN Gateway For mid-size enterprises that require a secure connectivity backbone to connect their employees and partners to their corporate information and applications, Nokia provides a full solution for workers in the office through site-to-site VPN connections and for remote workers through mobile connectivity. A key component of the Nokia IP VPN solution is the high-performance, fully integrated gateways, configured to ensure full connectivity to employees, partners, and customers. The Nokia IP VPN solution includes: Nokia IP VPN Gateway provides full, secure connectivity between sites, within sites, and between clients and sites. Nokia VPN Manager provides a centralized management tool for Nokia IP VPN Gateways and Nokia Mobile VPN Clients. Using Nokia VPN Manager, enterprises can easily create and update gateway configurations and policies through an easy-to-use graphical interface. Nokia Mobile VPN Client an IPSec VPN application developed by Nokia for Symbian operating systems-based mobile devices. For information about the Nokia Mobile VPN Client, see the Nokia Client User s Guide and Nokia Security Service Manager Administration Guide. Each Nokia IP VPN Gateway, with the exception of the Nokia 5i, has identical features, including fully clustered routing, VPN, firewalls, and DHCP server technologies. IP clustering is a feature patented by Nokia, which improves availability, reliability, and performance by allowing multiple gateways to work as a single gateway. You can also create firewall and VPN clusters that provide fault tolerance and dynamic load balancing. You can set up and deliver Nokia IP VPN gateways to the customer in the following ways: Centralized provisioning the administrator plugs the gateway into a local network, connects to Nokia VPN Manager and configures the gateway. When the gateway is fully operational, the administrator ships the gateway to the end-user. Remote provisioning the administrator generates a policy and s it to the person who is configuring the gateway. This person uses the policy to configure the gateway located at the remote site. Split provisioning the administrator initially configures the gateway at a central location and ships the gateway to the receiving site destination. At the destination, the customer connects to the gateway and completes the installation by using Nokia VPN Manager. Nokia IP VPN Gateway Getting Started Guide 13

14 1 Introducing the Nokia IP VPN Gateway You can configure and manage the Nokia IP VPN gateway by using one of the following tools: Nokia VPN Manager a secure GUI-based software management application. For information about how to install Nokia VPN Manager software, see Chapter 2, Configuring the Nokia IP VPN Gateway. Command-line interface (CLI) an SSH, Telnet, or serial interface that enables you to configure the gateway from the command line. You can use the CLI to perform any management or configuration tasks that you perform with Nokia VPN Manager. Note You can manage the gateway by using either the CLI or Nokia VPN Manager, but not both. Nokia VPN Manager will overwrite any configuration task done from the CLI. For information about the CLI, see the Nokia IP VPN Command-Line Summary v6.3. Nokia VPN Manager Software Nokia VPN Manager is a secure GUI-based software management application. The administrator uses Nokia VPN Manager to add a new gateway. The administrator specifies the hardware type and any hardware options present on the device. Use Nokia VPN Manager to do the following: Configure a minimum of one internal interface and one external interface by using the installation wizard. You can have multiple internal interfaces, but only one primary external interface. Other external interfaces are for backup only. If you are configuring a single-interface gateway, configure an external interface only and configure it as static. Select which physical interface is designated as the internal interface and which interface is designated as the external interface. The rest of the interfaces are marked as available (not configured). The installation wizard stores the configuration in the VPN Manager database. After the gateway is installed, the administrator can access the gateway properties and complete the gateway configuration. Configure the gateway to work in a standalone mode or clustered mode. Clustered mode is used to install multiple gateways in parallel that act as a single device on the network. Configure a standalone or cluster gateway with a single static external interface. This is referred to as a single-interface VPN, because you configure only an external interface. This allows a VPN gateway to be placed in a network with minimal interruption since no network segmentation is needed to add VPN support. 14 Nokia IP VPN Gateway Getting Started Guide

15 2 Configuring the Nokia IP VPN Gateway After installing the hardware, you need to establish a secure VPN environment. First install the Nokia VPN Manager software, then perform the initial configuration to your gateway. This chapter describes how to configure the basic settings for the Nokia IP VPN gateway and includes: Installing Nokia VPN Manager Performing the Initial Gateway Configuration Installing Nokia VPN Manager The Nokia VPN Manager software is located on the Nokia IP VPN v6.3 CD-ROM supplied with the gateway. Note If you have an existing management proxy that is running a version of Nokia VPN Manager earlier than v6.3, it is necessary to upgrade the management proxy to v6.3. See Upgrading an Existing Management Proxy to v6.3 on page 40. Supported Software Nokia IP VPN gateways support the following: Operating Systems Windows 2000 Windows 2003 Server Windows XP Professional Red Hat Enterprise Linux 3.0 Java Runtime Environment JRE 1.5.0_01 (ships with Nokia VPN Manager) Nokia IP VPN Gateway Getting Started Guide 15

16 2 Configuring the Nokia IP VPN Gateway System Requirements Nokia VPN Manager has the following minimum system and memory requirements: System Requirements Minimum 12 MB of free disk space Minimum monitor resolution of 1024 x MB of RAM, with 512 MB recommended Minimum Memory Requirements 256 MB for a 200 gateway database 512 MB for a 350 gateway database 768 MB for a 500 gateway database Installing Nokia VPN Manager onto a Windows System Nokia VPN Manager was tested and verified to work with Windows 2000, Windows 2003 Server, and Windows XP Professional. To install Nokia VPN Manager software onto a Windows system 1. Insert the Nokia IP VPN v6.3 CD-ROM into your CD-ROM drive. 2. Double-click the VPN Manager software executable file (.exe). The filename is NokiaVPNManager_6.3_<timestamp>.exe, where <timestamp> is the date and software build number. The Welcome window opens. 3. Click Next. Follow the setup wizard directions until the installation is complete. 4. When the installation is complete, click Finish to exit. Installing Nokia VPN Manager onto a Red Hat Linux System Nokia VPN Manager was tested and verified to work with the Red Hat Enterprise Linux operating system. You can install VPN Manager onto a Linux system by using the console command line or by using the file manager. After you complete the installation, start Nokia VPN Manager by launching the program from the file manager in Linux. 16 Nokia IP VPN Gateway Getting Started Guide

17 Performing the Initial Gateway Configuration To install Nokia VPN Manager by using the command line 1. Locate the VPN Manager software for Linux on the Nokia IP VPN v6.3 CD-ROM. The filename is NokiaVPNManager_6.3_<timestamp>_Linux.bin, where <timestamp> is the date and software build number. 2. Log in as root. 3. Launch the binary file (.bin) by using the following command: # /<directory>/nokiavpnmanager_6.3_<timestamp>_linux.bin where <directory> specifies the directory that contains the binary file. The console window opens and displays the following text: Initializing InstallShield Wizard... Launching InstallShield Wizard... The Welcome window opens. 4. Click Next. The default installation path is /opt/nokia/nokia_vpn_manager_6.3. Use the default path or click Browse to install the application in a different directory. Follow the setup wizard directions until the installation is complete. 5. When the installation is complete, click Finish to exit. Performing the Initial Gateway Configuration After the gateway is physically in place and the Nokia VPN Manager software is installed, begin the initial gateway configuration. This process includes: Installing the initial configuration for a static or dynamic gateway Configuring a management proxy (necessary for dynamic gateways) Deploying the initial gateway configuration Completing the pending installation Nokia IP VPN Gateway Getting Started Guide 17

18 2 Configuring the Nokia IP VPN Gateway Before You Begin Before you begin installing and configuring a Nokia IP VPN Gateway, gather the following information that you will need to complete the installation: Table 2 Gateway Settings Standalone Gateway Settings Gateway description text to describe the gateway use, location, and other information Internal network IP address and subnet mask External network IP address and subnet mask Fully qualified domain name (FQDN) of the gateway Next hop toward the workstation hosting the VPN Manager software Management proxy necessary if you have a dynamic gateway using Dynamic Host Configuration Protocol (DHCP) or Point-to-Point Protocol over Ethernet (PPPoE) in your VPN. Internal Certificate Authority (CA) Default filter mode Clustered Gateway Settings The settings for a clustered gateway are the same as those for a standalone gateway but require the following additional information: Internal and external cluster IP addresses, network masks, and the cluster name. Host names and internal and external IP addresses for each individual node within the cluster. Nokia 5i Gateway Configuration Limitations The Nokia 5i has the following configuration limitations. You cannot use the Nokia 5i in a cluster. The Nokia 5i does not support VRRP or BGP. The Nokia 5i has a maximum IKE SA tunnel limit of 25. Configuring the Initial Gateway Settings You can configure the initial gateway settings by using the Nokia VPN Manager installation wizard. Using the installation wizard you can: Configure static or dynamic gateways. A static gateway has all statically addressed Ethernet interfaces and does not have any backup interfaces, does not reside behind a NAT device, and does not have VRRP configured. You can configure a static gateway to be either a standalone or clustered gateway. See Configuring a Static Gateway on page 19. A dynamic gateway is any gateway where the address used for IPSec communication may be unknown during deployment or may change at any time. A dynamic gateway 18 Nokia IP VPN Gateway Getting Started Guide

19 Performing the Initial Gateway Configuration must communicate with a statically-addressed gateway and is required to be a spoke in a hub-and-spoke partition. See Configuring a Dynamic Gateway on page 38. Specify a standalone or clustered gateway. A clustered gateway behaves as a single network entity, even under failures of individual nodes. Specify network interfaces, including the serial interface. You can configure internal, external, or backup interfaces. Use various interface address schemes including static addressing, DHCP addressing, and PPPoE. Configure a WAN backup. A WAN backup is an alternative connection for the primary external interface. If the primary connection fails, the gateway attempts to communicate on the backup interface. Configure a VRRP backup gateway (dynamic gateways only). You can configure a VRRP backup gateway to provide failover protection for a Nokia IP VPN Gateway in the event of a failure. Specify protected host groups for your network or VPN. Host groups allow you to combine sets of IP addresses and subnets together under a particular name, and to associate the gateway designated to protect them. Specify templates to define various default gateway configurations that you can apply on an individual basis. Deploy the gateway configuration and security policy to the gateway through a serial port or by . Note A gateway must be fully installed before the administrator can access the Gateway Properties window. Configuring a Static Gateway A static gateway has all statically addressed Ethernet interfaces and does not have any backup interfaces, does not reside behind a NAT device, and does not have VRRP configured. You can configure a static gateway to be either a: Standalone gateway has at least two Ethernet interfaces that connect to an inside and outside network. A static gateway or a dynamic gateway can have multiple internal interfaces defined. Nokia IP VPN Gateway Getting Started Guide 19

20 2 Configuring the Nokia IP VPN Gateway Clustered gateway uses a cluster communication protocol to provide failover and load balancing between a number of physical devices on a network. Although the cluster contains a number of nodes, it is treated as a single gateway from the point of view of routing and IPSec. Note Clustered gateways can only include Ethernet interfaces with static addresses. For instructions on how to install a standalone gateway, see To configure a standalone static gateway on page 20. For instructions on how to install a clustered gateway, see To install a clustered static gateway on page 29. To configure a standalone static gateway 1. From Microsoft Windows: Double-click the Nokia VPN Manager icon on your desktop, or choose Start > Programs > Nokia > Nokia VPN Manager 6.3 > Nokia VPN Manager 6.3. From Red Hat Linux GUI: Open your file manager. From the root directory, locate the Nokia VPN Manager application and launch it. From Red Hat Linux console: Launch the application by using the following command: # /<directory>/nokiavpnmanager_6.3 where <directory> specifies the directory that contains the application. The console window opens and displays the following text: Initializing MultiPlatform Application... Launching Launcher... The Logon information window opens. By default, the software uses a built-in administrator account that allows full administrator privileges. 2. Enter and confirm the password for the Administrator account. Passwords are case sensitive, must be between 8 and 32 characters long, and can contain any combination of characters. The username and password cannot be the same. Note Always keep track of your account passwords. If you cannot remember the username and password for at least one administrator account and have no backup, you must reinstall your entire VPN. 3. Click OK. 20 Nokia IP VPN Gateway Getting Started Guide

21 Performing the Initial Gateway Configuration The Installation Wizard window opens. If you are installing multiple gateways and want to use the Nokia VPN Import Gateways feature, click Cancel and see Chapter 3, Installing Multiple Gateways. This feature allows the deployment of initial configuration to multiple new gateways by reading in a set of files in a text format. 4. Click Static gateway. 5. Click Next. The Hardware Identity window opens. Nokia IP VPN Gateway Getting Started Guide 21

22 2 Configuring the Nokia IP VPN Gateway 6. Select the gateway model from the Hardware type drop-down list. The default gateway is Nokia 50i. 7. Select Standalone. 8. Enter a descriptive name for the gateway. For example, Engineering Gateway. 9. Click Continue. The Gateway Identity window opens. 22 Nokia IP VPN Gateway Getting Started Guide

23 Performing the Initial Gateway Configuration 10. Configure the interface settings. a. Select the interface you want to configure and click Edit, or double-click the Ethernet connection from the interfaces list box. The Edit Ethernet Configuration window opens. Nokia IP VPN Gateway Getting Started Guide 23

24 2 Configuring the Nokia IP VPN Gateway b. Select the interface type from the Type drop-down list to configure the first interface. Internal interface is the default. You must configure one internal interface and one external interface. If you are configuring a single-interface VPN, you need to configure an external interface only and it must be configured as static. c. Enter the IP address and subnet mask. All internal interfaces require a static IP address. d. Enter the maximum transmission unit (MTU). The MTU is the largest physical packet size, measured in bytes, that a network can transmit. The default value is 1500 for 10 Base-T and 100 Base-T connections. e. (Optional.) To enable flow control, check the Ethernet Flow Control check box. The default is unchecked. Flow control regulates the transfer of data between devices and is most often needed when a speed differential exists between sender and receiver. f. Choose the type of connection from the drop-down list. The default is Auto Detect. Auto Detect automatically detects the speed and duplex between the two connected ports, selecting the lower speed and half-duplex if any of the ports do not support fullduplex. g. (Optional.) Enter comments in the Comments text box. For example, a comment that describes the interface purpose and physical connection information. h. Click OK. The static internal interface is configured. You are returned to the Gateway Identity window. 24 Nokia IP VPN Gateway Getting Started Guide

25 Performing the Initial Gateway Configuration 11. Repeat step 10 to configure the static external interface. 12. (Optional) From the Gateway Identity window, enter the domain name. For example, engineering.nokia.com. A domain name is optional for a static gateway but required for a dynamic gateway. 13. Enter the default route back to the VPN Manager. The default route is the next hop to the gateway and is needed to deliver the initial security policy to the gateway you are configuring. 14. Click Next. The VPN Participation window opens. Nokia IP VPN Gateway Getting Started Guide 25

26 2 Configuring the Nokia IP VPN Gateway 15. To assign a VPN partition, select a partition from the Select VPN Partition drop-down list. A partition is a group of gateways that share a common security policy or tunnel configuration. The VPN partition where the gateway resides controls the tunnel security policy. The installation wizard defaults to the VPN default partition. If you plan to install dynamic gateways, you must have a hub-and-spoke partition. If this is desired, select the Hub and Spoke Partition. 16. Click New to create a new host group. The New Host Group window opens. A default host group description is assigned. You can change the description or keep the assigned description. 26 Nokia IP VPN Gateway Getting Started Guide

27 Performing the Initial Gateway Configuration Note If a host group is already created, click Select to specify a host group that this gateway protects. To protect no host groups, check Gateway Protects No Host Groups, then click Next. a. Click New. b. Enter the IP address and subnet mask, or IP address range for the new host group and click OK. c. Click OK again. You are returned to the VPN Partition participation window. 17. (Optional) To configure NAT Before IPSec, click Configure. NAT Before IPSec is used if the customer VPN has gateways (spokes) that are performing NAT and are using the same address space behind them. For information about configuring NAT Before IPSec, see the Nokia IP VPN Gateway Configuration Guide v Click Next. If you are installing the first gateway, the Certification Authority (CA) window opens. You are asked to configure a CA only when you install the first gateway. To continue, proceed to step 19. If this is not the first gateway you are installing, proceed to step 21. Nokia IP VPN Gateway Getting Started Guide 27

28 2 Configuring the Nokia IP VPN Gateway Note If this is not the first gateway you are installing, you are prompted to deliver the configuration to the gateway. Click Yes and continue to Deploying the Initial Gateway Configuration on page Configure an internal certification authority. a. To create an internal CA, select Yes. b. To change the policy from IKE public key to the newly created CA, select Yes. c. Specify the default filter for the VPN. The default is Use Bypass mode. d. Click Next. 20. Enter the identity information for the new internal CA root certificate. a. Specify a validity period for the certificate by using the up and down arrows. b. Click Next. 21. Create an IPSec device certificate. a. Select Yes. b. Select the gateway information for the SubjectAltName to contain. The defaults are: FQDN Static Outside IP Address c. Click Next. d. Enter the information for the new device certificate. e. Specify the validity period by using the up and down arrows. 22. Click Finish. You are prompted to deliver the configuration to the gateway. 23. Click Yes to deploy the security policy and gateway configuration to the gateway. See Deploying the Initial Gateway Configuration on page 50. To add additional gateways, choose Install > Install New Gateway from the VPN Manager main window. Note If you are installing more than one gateway, you can use a template to configure the gateway settings. For more information about how to configure templates, see the Nokia IP VPN Gateway Configuration Guide v Nokia IP VPN Gateway Getting Started Guide

29 Performing the Initial Gateway Configuration To install a clustered static gateway Note Clustered gateways can only include Ethernet interfaces with static addresses. 1. From Microsoft Windows: Double-click the Nokia VPN Manager icon on your desktop, or choose Start > Programs > Nokia > Nokia VPN Manager 6.3 > Nokia VPN Manager 6.3. From Red Hat Linux: Open your file manager. From the root directory, locate the Nokia VPN Manager file and launch it. The Logon information window opens. By default, the software uses a built-in administrator account that allows full administrator privileges. 2. Enter and confirm password for the Administrator account. Passwords are case sensitive, must be between 8 and 32 characters long, and can contain any combination of characters. The username and password cannot be the same. Note Always keep track of your account passwords. If you cannot remember the username and password for at least one administrator account and have no backup, you must reinstall your entire VPN. 3. Click OK. The Installation Wizard window opens. Nokia IP VPN Gateway Getting Started Guide 29

30 2 Configuring the Nokia IP VPN Gateway If you are installing multiple gateways and want to use the Nokia VPN Import Gateways feature, click Cancel and see Chapter 3, Installing Multiple Gateways. This feature allows the deployment of initial configuration to multiple new gateways by reading in a set of files in a text format. 4. Click Static gateway. 5. Click Next. The Hardware Identity window opens. 30 Nokia IP VPN Gateway Getting Started Guide

31 Performing the Initial Gateway Configuration 6. Select the gateway model from the Hardware type drop-down list The default gateway is Nokia 50i. Note The Nokia 5i does not support IP clustering. 7. Select Cluster 8. Select the number of nodes. If you are configuring a cluster, the same type of gateway is required. For example, two Nokia 10i gateways in a cluster. You can select a maximum of 32 nodes. Performance levels off at five or six nodes in most configurations. 9. Enter a descriptive name for the gateway. For example, Engineering Gateway. 10. Click Continue. The Gateway Identity window opens. Nokia IP VPN Gateway Getting Started Guide 31

32 2 Configuring the Nokia IP VPN Gateway 11. Configure the interface settings. a. Select the interface you want to configure and click Edit, or double-click the Ethernet connection from the interfaces list box. The Edit Ethernet Configuration window opens. 32 Nokia IP VPN Gateway Getting Started Guide

33 Performing the Initial Gateway Configuration b. Select the interface type from the Type drop-down list to configure the first interface. You must configure one internal interface and one external interface. If you are configuring a single-interface VPN, you need to configure an external interface only and it must be configured as static. When you are configuring a cluster gateway, the first or earliest internal interface configured is the one defined for intracluster communication. c. Enter the IP address and subnet mask. All internal interfaces require a static IP address. d. (Optional.) Enter the keepalive IP address. The keepalive referee is an IP address used if the node loses connectivity. e. Enter the maximum transmission unit (MTU). The MTU is the largest physical packet size, measured in bytes, that a network can transmit. The default value is 1500 for 10 Base-T and 100 Base-T connections. f. (Optional.) To enable flow control, check the Ethernet Flow Control check box. The default is unchecked. Flow control regulates the transfer of data between devices and is most often needed when a speed differential exists between sender and receiver. g. Choose the type of connection from the drop-down list. The default is Auto Detect. Auto Detect automatically detects the speed and duplex between the two connected ports, selecting the lower speed and half-duplex if any of the ports do not support fullduplex. h. (Optional.) Enter comments in the Comments text box. For example, a comment that describes the interface purpose and physical connection information. i. Click OK. 12. Repeat step 10 to continue configuring the static external interface. 13. From the Gateway Identity window, enter the domain name, if desired. For example, engineering.nokia.com A domain name is optional for a static gateway but required for a dynamic gateway. 14. Enter the default route back to the VPN Manager. The default route is the next hop to the gateway and is needed to deliver the initial security policy to the gateway you are configuring. 15. Click Next. The VPN Participation window opens. Nokia IP VPN Gateway Getting Started Guide 33

34 2 Configuring the Nokia IP VPN Gateway 16. To assign a VPN partition, select a partition from the Select VPN Partition drop-down list. A partition is a group of gateways that share a common security policy or tunnel configuration. The VPN partition where the gateway resides controls the tunnel security policy. The installation wizard defaults to the VPN default partition. 17. Click New to create a new host group. The New Host Group window opens. A default host group description is assigned. You can change the description or keep the assigned description. 34 Nokia IP VPN Gateway Getting Started Guide

35 Performing the Initial Gateway Configuration Note If a host group is already created, click Select to specify a host group that this gateway protects. To protect no host groups, check Gateway Protects No Host Groups, then click Next. a. Click New. b. Enter the IP address and subnet mask, or IP address range for the new host group and click OK. c. Click OK again. You are returned to the VPN Partition Participation window. 18. (Optional.) To configure NAT Before IPSec, click Configure. NAT Before IPSec is used if the customer VPN has gateways (spokes) that are performing NAT and are using the same address space behind them. For information about configuring NAT Before IPSec, see the Nokia IP VPN Gateway Configuration Guide v Click Next. The Cluster Node Interfaces window opens. Nokia IP VPN Gateway Getting Started Guide 35

36 2 Configuring the Nokia IP VPN Gateway 20. Configure the Internet addresses for the first cluster node. Each cluster node in the gateway must have an address for load balancing and intracluster communication. You need to configure one interface as an external interface for the cluster. a. Enter the node hostname. b. Select an interface. c. Click Edit and enter an internal and external IP address for the cluster node. Repeat this step for each additional cluster node. You need to configure the Internet addresses for each cluster node. 21. Click Next. If you are installing the first gateway, the Certification Authority (CA) window opens. You are asked to configure a CA only when you install the first gateway. To continue, proceed to step 22. If this is not the first gateway you are installing, continue to step Configure an internal certification authority. a. To create an internal CA, select Yes. b. To change the policy from IKE public key to the newly created CA, select Yes. c. Click Next. 23. Enter the identity information for the new internal CA root certificate. a. Specify a validity period for the certificate by using the up and down arrows. b. Click Next. 24. Create an IPSec device certificate. a. Click Yes. b. Select the gateway information for the SubjectAltName to contain. The defaults are: FQDN Static Outside IP Address c. Click Next. d. Enter the information for the new device certificate. e. Specify the validity period by using the up and down arrows. 25. Click Next. If you have created a template, the Template window opens. 36 Nokia IP VPN Gateway Getting Started Guide

37 Performing the Initial Gateway Configuration A template is a collection of predefined gateway settings used to automate the process of configuring multiple gateways. For information about creating templates, see the Nokia IP VPN Gateway Configuration Guide v6.3. Note When you change a template, all gateways that use the template are affected by the changes. 26. Click Finish. You are prompted to deliver the configuration to the gateway. 27. Click Yes to deploy the security policy and gateway configuration to the gateway. See Deploying the Initial Gateway Configuration on page 50. To add additional gateways, choose Install > Install New Gateway from the VPN Manager main window. Nokia IP VPN Gateway Getting Started Guide 37

38 2 Configuring the Nokia IP VPN Gateway Configuring a Dynamic Gateway Note Before you install a dynamic gateway, you must configure a management proxy. See Configuring a Management Proxy on page 39. A dynamic gateway is any gateway where the address used for IPSec communication may be unknown during deployment or may change at any time. A dynamic gateway must communicate with a statically-addressed gateway and is required to be a spoke in a hub-and-spoke partition. It cannot be installed in any other partition types and it cannot be installed as a hub. A dynamic gateway is a gateway with any of the following characteristics or a combination of the following characteristics: Dynamically addressed interfaces. Backup interfaces configured Gateway resides behind a NAT device VRRP is configured During the installation, select dynamic gateway installation type if any of these configurations exist. Requirements for Installing a Dynamic Gateway Before you configure a dynamic gateway, these conditions must exist: A management proxy must be configured. For an installed gateway, the gateway must be a spoke in a Hub-and-Spoke partition. The gateway must have a DNS domain name. For a new gateway, there must be a valid partition configured. A valid partition is a Huband-Spoke partition with a managed, static v6.3 or later hub configured with at least one internal interface. After you install the dynamic gateway using the installation wizard, apply changes to the management proxy, and deploy the initial configuration to the dynamic gateway. This process advises the management proxy that the dynamic gateway exists and that the gateway has a security policy in place to communicate with the management proxy. If the dynamic gateway is shipped to a final destination, the end-user can power on the gateway at the final destination and will need to type in the password provided by the administrator. See Turning On Power to the Dynamic Gateway on page Nokia IP VPN Gateway Getting Started Guide

39 Performing the Initial Gateway Configuration Configuring a Management Proxy Note If you have an existing management proxy that is running an AOS kernel that is earlier than v6.3, it is necessary to upgrade the kernel on the management proxy to v6.3 before installing any new dynamic gateways. See Upgrading an Existing Management Proxy to v6.3 on page 40. You must use a management proxy to manage the deployment of your dynamic gateways, including gateways using DHCP, PPPoE, NAT traversal, and WAN backup. The management proxy is a statically addressed standalone or clustered gateway with an internal Certificate Authority (CA). You must configure the management proxy before you create dynamic gateways. The management proxy supports the dynamic gateways and all information to and from the dynamic gateways must pass through the management proxy. The management proxy is a VPN gateway that manages a number of gateways through an IPSec-based proxying scheme. To qualify as a management proxy, a gateway must have all statically addressed interfaces and access to an internal CA managed by a Nokia VPN gateway. The statically addressed management proxy uses IKE and IPSec dynamic-addressing support to proxy messages to the dynamic gateway. The management proxy acts as a central point of contact for managing the dynamically addressed gateways, utilizing IPSec to receive address updates from, and forwarding communication traffic to, the dynamic gateways. Because the IP address of a dynamic gateway can change at any time, Nokia VPN Manager cannot track which IP address a particular gateway is using. By using the management proxy, VPN Manager can communicate with these dynamic gateways, because they keep the management proxy updated with their current IP addresses. Whenever the Nokia VPN Manager contacts a dynamic gateway through a management proxy, it retrieves the current IP address of the gateway. The next time the Nokia VPN Manager needs to contact the dynamic gateway, it can try to use the last known IP address instead of going through the proxy. This can be enabled or disabled in the Preferences dialog. Since dynamic gateways need to be in a hub-and-spoke partition and also need a management proxy, the hub and the proxy can be the same gateway, if desired. The management proxy can also be on any other static gateway in the VPN. The management proxy can be: A hub A static gateway in the hub-and-spoke partition A static gateway in a different partition Note Before you install a management proxy, you must first configure a static gateway that has an internal CA and the default filter set to bypass all traffic. See Configuring a Static Gateway on page 19. Nokia IP VPN Gateway Getting Started Guide 39

40 2 Configuring the Nokia IP VPN Gateway For a gateway to be configured as a management proxy, these conditions must exist: The management proxy must be configured as a static gateway. The management proxy must have at least one internal interface configured (required for policy deployment). The management proxy must run kernel version 6.3. The management proxy must have access to an internal CA. A single-interface VPN cannot be configured as a management proxy since internal interfaces are needed for proxy communication. Single-interface VPNs are configured by using a single external interface only. In addition, a single-interface VPN cannot be a hub in a partition with dynamically addressed spokes. Depending on your requirements, you can place the management proxy in a variety of network locations. The two recommended configurations are: 1. Install a dedicated management proxy in a custom partition. This provides scalability and flexibility without the complexity of automatically generated selectors. Since the management proxy is designated to communicate only management traffic, this will serve a relatively large number of dynamic gateways without affecting site-to-site communication. 2. Configure the dynamic gateway hub to be the management proxy. While this does not provide the scalability of a dedicated management proxy, it avoids the requirement to configure an extra gateway to forward management communication traffic. This is recommended only with smaller installations because it will have an impact on site-to-site communication when forwarding management traffic. In both of these cases, the management proxy IKE and IPSec settings override the VPN, Partition, and Link settings for communication between the management proxy and the dynamic gateway. Upgrading an Existing Management Proxy to v6.3 Upgrading the management proxy to v6.3 allows the proxy to operate as a multi-threaded operation. This means that multiple gateway changes are no longer serialized, significantly reducing the time to run operations on more than one dynamic gateway and improving the reliability of all dynamic gateway communications. In addition, more services are added through the management proxy (including troubleshooting, monitoring, and logging services) and management traffic is now encrypted with TLS for the TCP connection in addition to being tunneled through IPSec, to bring it in sync with static gateway connections. If you have an existing management proxy that is running an AOS kernel earlier than v6.3, it is necessary to upgrade the management proxy to v6.3. To upgrade the kernel, see the Nokia IP VPN Gateway Configuration Guide v Nokia IP VPN Gateway Getting Started Guide

41 Performing the Initial Gateway Configuration Advantages to Upgrading the Management Proxy to v6.3 If you have an earlier AOS kernel version on your management proxy and upgrade to an AOS kernel v6.3, the following new features apply: Improved, faster communication between the management proxy and the dynamic gateways. Better scalability for multiple changes to the dynamic gateways. Improved troubleshooting and gateway monitoring. Encrypted internal traffic between the management proxy and dynamic gateways. To configure a management proxy 1. From the VPN Manager main window, select an existing static gateway. The gateway must meet the management proxy requirements. 2. Choose Gateway > Properties. The Gateway Properties window opens. 3. Choose Traffic Filters > Management Proxy. The Management Proxy window appears. 4. Check the Configure as Management Proxy check box. 5. From the drop-down list, select the internal CA to use for management traffic. 6. Click Settings to edit advanced IKE settings. 7. From the drop-down list, select the IPSec policy that management traffic will use. The default is Encryption and Integrity. Nokia IP VPN Gateway Getting Started Guide 41

42 2 Configuring the Nokia IP VPN Gateway 8. Close the Gateway Properties window. 9. Choose Actions > Apply Changes. When the Apply Changes has completed, your management proxy is installed. 10. Click Close. To configure a dynamic gateway 1. From the Nokia VPN Manager main window, choose Install > Install New Gateway. The Installation Wizard window opens. 2. Select Dynamic gateway. 3. Click Next. The Gateway Hardware Identity window opens. 42 Nokia IP VPN Gateway Getting Started Guide

43 Performing the Initial Gateway Configuration 4. Select the gateway model from the Hardware type drop-down list. The default gateway is the Nokia 50i. Note The CC legacy gateway cannot be configured as a dynamic gateway. 5. Select Standalone (default). 6. (Optional.) To configure a dynamic gateway with VRRP Backup, select VRRP. For information about how to configure VRRP, see the Nokia IP VPN Gateway Configuration Guide v Enter a descriptive name for the gateway. For example, Engineering Gateway. 8. Click Continue. The Gateway Identity window opens. Nokia IP VPN Gateway Getting Started Guide 43

44 2 Configuring the Nokia IP VPN Gateway 9. Configure the interface settings. a. Select the interface you want to configure and click Edit, or double-click the Ethernet connection from the interfaces list box. The Edit Ethernet configuration window opens. 44 Nokia IP VPN Gateway Getting Started Guide

45 Performing the Initial Gateway Configuration b. Select external from the Type drop-down list to configure the first interface. You must configure one external interface and one internal interface. If you are configuring a single-interface VPN, you need to configure an external interface only and configure it as static. c. Select the DHCP or PPPoE addressing scheme. Static type of interface in which you manually configure an IP address. A static IP address allows you to have the same IP address each time you access the Internet. All internal interfaces require a static IP address. DHCP allows for automatic IP address and subnet mask assignment. You can configure DHCP on both external and backup interfaces. PPPoE connects users on an Ethernet interface to the Internet through a common broadband medium such as a wireless device or cable modem. You can configure PPPoE on both external and backup interfaces. For questions about the addressing scheme to use, check with your Internet provider. If you select static addressing, you must enter the IP address and subnet mask for the gateway. If DHCP is selected, click OK and you are returned to the Install New Gateway window. For information about how to configure PPPoE, see the Nokia IP VPN Gateway Configuration Guide v Configure the internal interface settings. a. Select the interface you want to configure and click Edit, or double-click the Ethernet connection from the interfaces list box. The Edit Ethernet configuration window opens. b. Select Internal from the Type drop-down list. c. Select Static for the addressing scheme. All internal interfaces require a static IP address. If you select static addressing, you must enter the IP address and subnet mask for the gateway. d. Enter the IP address and subnet mask. e. Enter the MTU. The MTU is the largest physical packet size, measured in bytes, that a network can transmit. For 10 Base-T and 100 Base-T connections, the default value is f. (Optional.)To enable Ethernet flow control, check the check box. The default is unchecked. Flow control regulates the transfer of data between devices and is most often needed when a speed differential exists between sender and receiver. Nokia IP VPN Gateway Getting Started Guide 45

46 2 Configuring the Nokia IP VPN Gateway g. Choose Connection Type from the drop-down list. The default is Auto Detect. Auto Detect automatically detects the speed and duplex between the two connected ports, selecting the lower speed and half-duplex if any of the ports do not support fullduplex. h. (Optional.) Enter comments in the Comments text box. For example, a comment that describes the interface purpose and physical connection information. 11. Click OK. 12. From the Gateway Identity window, enter the domain name. A domain name and hostname is required for a dynamic gateway. Note The default route remains blank if the primary (external) interface is DHCP or PPPoE. 13. From the drop-down list, select a management proxy. 14. (Optional.) To configure WAN backup, click Advanced. For information about configuring WAN backup, see the Nokia IP VPN Gateway Configuration Guide v (Optional.) Check the check box for Gateway NAT Traversal Required. If the gateway is behind a NAT device, check the check box. If you are using NAT traversal, you need to define a management proxy. For more information, see Configuring a Management Proxy on page Click Next. The VPN Partition Participation window opens. 46 Nokia IP VPN Gateway Getting Started Guide

47 Performing the Initial Gateway Configuration 17. To assign a VPN partition, select a partition from the Select VPN Partition drop-down list. A partition is a group of gateways that share a common security policy or tunnel configuration. The VPN partition where the gateway resides controls the tunnel security policy. The installation wizard defaults to the Hub and Spoke partition. 18. Click New to create a new host group. The New Host Group window opens. Nokia IP VPN Gateway Getting Started Guide 47

48 2 Configuring the Nokia IP VPN Gateway A default host group description is assigned. You can change the description or keep the assigned description. Note If a host group is already created, click Select to specify a host group that this gateway protects. To protect no host groups, check Gateway Protects No Host Groups, then click Next. a. Click New. b. Enter the IP address and subnet mask, or IP address range for the new host group and click OK. c. Click OK again. You are returned to the VPN Partition Participation window. 19. (Optional.) To configure NAT Before IPSec, click Configure. NAT before IPSec is used if the customer VPN has gateways (spokes) that are performing NAT and are using the same address space behind them. 20. Click Next. The IPSec Device Certificate window opens. 48 Nokia IP VPN Gateway Getting Started Guide

49 Performing the Initial Gateway Configuration 21. Create an IPSec device certificate. a. Select Yes. b. Select the gateway information for the SubjectAltName to contain. The default is FQDN. c. (Optional) Check Inside IP addresses. 22. Click Next. 23. Enter the information for the new device certificate. Specify the validity period by using the up and down arrows. 24. Click Next. If you have created a template, the Template window opens. A template is a collection of predefined gateway settings used to automate the process of configuring multiple gateways. Note When you change a template, all gateways that use the template are affected by the changes. Nokia IP VPN Gateway Getting Started Guide 49

50 2 Configuring the Nokia IP VPN Gateway 25. Click Finish. You are prompted to deliver the configuration to the gateway. 26. Click Yes to deploy the security policy and initial configuration to the gateway and continue with Deploying the Initial Gateway Configuration by using the Console Port on page 51. Turning On Power to the Dynamic Gateway After you deploy the initial configuration for a dynamic gateway over the serial port, power the gateway off and send the gateway to the final destination. The user can turn power on to the gateway at the final destination and type in the password that the administrator provides. When the gateway is powered on, it opens an IPSec tunnel to the management proxy. Nokia VPN Manager can then connect to the dynamic gateway through the management proxy to finish the installation. Each gateway can use a different proxy. Note If the default VPN mode is set to Drop, you must create a filter to bypass ICMP echoes and requests in order to ping the gateway after installation. For information about how to create a bypass filter for ICMP, see the Nokia IP VPN Gateways Configuration Guide v6.3. Deploying the Initial Gateway Configuration After you run the installation wizard, the wizard prompts you to deploy the security policy and the gateway configuration to the gateway. Deploying the gateway configuration allows the gateway to communicate with other members of the cluster, communicate with Nokia VPN Manager, and initialize the SSL certificate by using a security token. During the configuration process, each gateway is configured with a special management-only certificate. The steps for deployment vary, depending on the type of installation and whether you are installing a static gateway or dynamic gateway and includes the following components: Static gateway security policy includes the network configuration, such as security token, interface configuration for each node, hostname, domain name (if specified), and default route (if specified). Dynamic gateway security policy includes the same information as the static gateway security policy, in addition to the gateway device certificate and IPSec policy. During the deployment process, the initial gateway configuration is added to the nodes by using either the serial or deployment methods. An ASCII terminal or a computer with terminal-emulation software is required to complete this process. The configuration is applied by copying the information to a clipboard and using the Paste command to paste the information into the terminal window. 50 Nokia IP VPN Gateway Getting Started Guide

51 Deploying the Initial Gateway Configuration You can deploy the initial configuration to the gateway by using two methods. Deploying the Initial Gateway Configuration by using the Console Port initial gateway configuration is deployed to the gateway through the console port. Deploying the Initial Gateway Configuration by using initial gateway configuration is delivered to a specified address. The end-user connects to a console, copies the configuration information provided from the , and pastes it into the terminal emulation software. Use this method when the gateway is shipped directly to the end-user and the administrator does not have physical access to the gateway. For descriptions of the different shipping provisioning, see Chapter 1, Introducing the Nokia IP VPN Gateway. Deploying the Initial Gateway Configuration by using the Console Port When you deploy the gateway configuration by using the console port, the initial configuration data is generated, copied to the clipboard, and pasted into a console. Before you begin the following procedure, connect a console terminal to the gateway console port. An ASCII terminal or a computer with terminal-emulation software is required. To deploy the initial configuration by using the console port 1. From the Nokia VPN Manager main window, select the gateway to install. 2. Choose Install > Deploy Gateway Configuration. The Deploy Initial Configuration to Gateway window opens. Nokia IP VPN Gateway Getting Started Guide 51

52 2 Configuring the Nokia IP VPN Gateway 3. Select Console. 4. If you are deploying a dynamic gateway, enter and confirm the deployment password. This password is given to the end user and protects the gateway in transit for a remote deployment. This is a one-time password and must be eight characters or more. 5. Click Next. The gateway configuration data to be sent over the console port appears. 52 Nokia IP VPN Gateway Getting Started Guide

53 Deploying the Initial Gateway Configuration 6. Click Copy to clipboard, then click Next. When you click Next, VPN Manager contacts the certification authority (CA) and generates temporary certificates (7 days expiration) to complete the initial installation. Note Nokia recommends that the console window be open before you click Copy to clipboard. After you copy the gateway configuration to the clipboard, you must paste the information into a terminal-emulation program, such as HyperTerminal, and continue with the installation. 7. From the console window, press Enter or Return. The initial configuration setup appears. 8. Paste the initial configuration information into the terminal window. The contents include: Security token Internal IP address Internal subnet mask External IP address External subnet mask Default route (next hop) Hostname Nokia IP VPN Gateway Getting Started Guide 53

54 2 Configuring the Nokia IP VPN Gateway Certificates (dynamic gateway) IPSec policy (dynamic gateway) If you are installing a static gateway: a. Close the console window and continue configuring from the VPN Manager main screen. b. Remove the console cable, if desired. If you are installing a dynamic gateway: a. Enter the deployment password that was sent to you. This is the password that was entered and confirmed in step 4. b. If you are configuring PPPoE and the Nokia VPN Manager administrator did not configure the credentials, you are prompted to enter the user name and password. The syntax for advanced PPPoE settings from the CLI is as follows: pppoe profile <profile name> eth <interface> user <username> password <password> pppoe interface <profile name> For example: wizard# pppoe profile eng eth eth-2 user joe passwd password wizard# pppoe interface profilename eng 9. Click Next. The Deploy Initial Configuration to Gateway window opens. 10. If you are installing a dynamic gateway, check the Apply Policy to Proxy check box (default). This informs the management proxy about the dynamic gateway policy. Note If you have many dynamic gateways to install, you can wait until installing the last gateway to apply the policy to the proxy. 11. Click Finish. The Apply Changes window opens if you checked the Apply Policy to Proxy check box in step 10. Otherwise, you will need to choose Actions > Apply Changes. 12. Click Close. Continue to Completing the Pending Installation on page Nokia IP VPN Gateway Getting Started Guide

55 Deploying the Initial Gateway Configuration Deploying the Initial Gateway Configuration by using When you deploy the gateway configuration by using , the initial configuration data is generated, sent in a single to the specified address, copied to a clipboard, and pasted into a console. This method is especially convenient when sending initial configuration data to a remote location. Before you begin the following procedure, the person that you are ing the configuration to has to connect a console terminal to the gateway console port to deploy the initial gateway configuration. An ASCII terminal or a computer with terminal-emulation software is required. To deploy the initial gateway configuration by using 1. From the Nokia VPN Manager main window, select the gateway to install. 2. Choose Install > Deploy Gateway Configuration. The Deploy Initial Configuration to Gateway window opens. 3. Select If you are deploying a dynamic gateway, enter and confirm the deployment password. This password is given to the end user and protects the gateway in transit for a remote deployment. This is a one-time password and must be eight characters or more. Nokia IP VPN Gateway Getting Started Guide 55

56 2 Configuring the Nokia IP VPN Gateway 5. Click Next. 6. Enter the SMTP Server, To, From, and Subject text fields. 7. Click Next. The Deploy Initial Configuration to Gateway window opens. 8. If you are installing a dynamic gateway, check the Apply Policy to Proxy check box (default). This informs the management proxy about the dynamic gateway policy. Note If you have many dynamic gateways to install, you can wait until installing the last gateway to apply the policy to the proxy. 9. Click Finish. The Apply Changes window opens if you checked the Apply Policy to Proxy check box in step 8. Otherwise, you will need to choose Actions > Apply Changes. 10. Click Close. Continue to Completing the Pending Installation. 56 Nokia IP VPN Gateway Getting Started Guide

57 Completing the Pending Installation Completing the Pending Installation After the initial configuration data is deployed to the gateway, the next step is to complete the pending installation. This process provides the gateway with a PIN and security certificate unique to that gateway and adds the gateway to a partition. To complete the pending installation 1. From the Nokia VPN Manager main window, select the gateway you just created. If a colored dot is next to the gateway name, either install the gateway, or apply the configuration changes. Orange apply changes. Blue complete pending installation. 2. Choose Install > Complete Pending Installation. VPN Manager downloads the initial configuration to the gateway and the gateway generates the PIN, which VPN Manager displays to the administrator. The gateway uses the PIN to secure the private key. The PIN: Encrypts private keys on the flash memory card and ensures that the possession of the flash memory card alone does not compromise security. Secures communication between cluster members. Note Always store a copy of the PIN in a safe location. If you lose the PIN, you might have to reinstall the gateway. From the CLI, use the pin show command to show the PIN. 3. Click Close. 4. Select the applicable gateway and choose Actions > Apply Changes. When you install a new gateway, apply changes to all gateways within the partition. Note When you install a dynamic gateway, it is also necessary to apply changes to the proxy. Your gateway is now operational. For further configuration information, see the Nokia IP VPN Gateway Configuration Guide v6.3 and the Nokia IP VPN Command-Line Summary v6.3. Nokia IP VPN Gateway Getting Started Guide 57

58 2 Configuring the Nokia IP VPN Gateway 58 Nokia IP VPN Gateway Getting Started Guide

59 3 Installing Multiple Gateways You can install the configuration for multiple gateways using the Nokia VPN Import Gateways feature. This feature allows the deployment of initial configuration to multiple new gateways by reading in a set of files in a simple text format. The files can be manually or automatically created by the administrator. Installing the configuration for multiple gateways consists of these steps: Import the text file that contains the gateway information. Using the wizard, generate the initial configuration for the gateways. There is a separate file for each gateway configuration and this file can optionally be ed if an address is provided. Complete pending installation. Apply changes to update the new gateways with remaining gateway settings. Using the Nokia VPN Import Gateways Feature If you do not have any gateways installed, the installation wizard for a single gateway automatically displays when you start Nokia VPN Manager. If you want to use the scripted installation wizard to install multiple new gateways, click Cancel to exit the window. During the installation of multiple gateways, using the scripted installation wizard, the initial configuration for each of the gateways is generated and stored either to a file (one for each gateway) in the specified directory or ed to a specified address. To make it easier to map the initial configuration file to the actual gateway, the filename of the initial configuration includes the gateway name and a time stamp. Prior to installing multiple gateways using the scripted installation wizard, you need to create the installation scripts. For information regarding the format of these scripts, see Installation Script Format on page 64. To install multiple gateways using the scripted installation wizard 1. From the Nokia VPN Manager main window, choose Install > Import New Gateways. The Import New Gateways window opens. Nokia IP VPN Gateway Getting Started Guide 59

60 3 Installing Multiple Gateways 2. Type the path to the installation script file in the text box, or click Browse to choose the path. Multiple paths can be specified by clicking Browse or by typing each path, separated by a semicolon, in the text box. 3. Click Next. The Import New Gateways selection window opens. 60 Nokia IP VPN Gateway Getting Started Guide

61 Using the Nokia VPN Import Gateways Feature Color coding in the Gateway Description column indicates the gateway status. Click on the color box to view status details. Green ready to install. Red errors exist in the installation script. Yellow configuration in the installation script is correct but another condition exists, such as a duplicate gateway already exists that might have the same gateway description name. The check boxes indicate which gateways will be installed when you click Next. The check boxes only show for gateways with valid configuration. The default is to have all of the gateways with valid configuration selected. You can select individual gateways to install if you do not want to install all of them at the same time. Brief descriptions are added to the Comments column. Click in the Comments box to view more information. 4. Click Next. The Import New Gateway Destination window opens. Nokia IP VPN Gateway Getting Started Guide 61

62 3 Installing Multiple Gateways 5. Type the path to the destination directory where you want the initial configuration files to be placed, or click Browse to choose the path. You can locate the configuration files in the directory you specify after the gateways have been successfully imported. Note If you requested in the installation script that the initial configuration be ed, it will be delivered to the address specified in the installation script. 6. Click Next to import the configuration of the selected gateways into the VPN Manager database. The Import Summary window opens. 62 Nokia IP VPN Gateway Getting Started Guide

63 Using the Nokia VPN Import Gateways Feature A summary displays the number of: Imported gateways Standalone gateways Clustered gateways Dynamic gateways Gateways of each hardware type Initial configuration files deployed To local directories Sent to addresses 7. Click Finish. Continue to Completing the Pending Installation on page 57 to update the new gateways with the remaining gateway settings Nokia IP VPN Gateway Getting Started Guide 63

64 3 Installing Multiple Gateways Installation Script Format The installation script needs to be in a comma-separated (CSV) format, which can be generated using a tool such as Microsoft Excel. The installation script can be created manually by the administrator or created as an Excel spreadsheet and exported as a CSV file. In addition, the installation script needs to follow these rules: Each installation script can include configuration for one or more gateways. The installation script of each gateway includes multiple lines of comma-separated fields. The number of lines can vary. The first field of each line should be a keyword and the remainder of the line are name-value pairs separated by commas. The keyword version must appear exactly once per file and must be set to 1. The keyword of the first line of the installation script should be gateway. Gateway appears only once in the first line of each gateway configuration. The keywords nodename and nodeinterface are required for multiple nodes. Other keywords include interface, routing, wanbackup, nat, partition, hostgroup, nodename, nodeinterface, devcert, and deploymethod. Keywords such as partition and deploymethod must be in the gateway configuration and appear only once. Keywords such as interface can appear more than once in the gateway configuration. Keywords such as nat and hostgroup are optional. CSV Grammar for Configuration Settings The following text shows the acceptable CSV grammar for the gateway configuration settings and lists all allowable values. The grammar is specified in the Backus-Naur form (BNF). For an actual installation script, see Example Installation Script on page 66. Table 3 on page 66 provides a key to the symbols specified in the grammer and notes identified by the superscript numbers. CSV Grammar Configuration := VersionLine Gateway_Conf+ Gateway_Conf := DescLine InterfaceLine+ RoutingLine [NATLine] PartitionLine HostGroupLine* (NodeNameLine 64 Nokia IP VPN Gateway Getting Started Guide

65 Installation Script Format NodeInterfaceLine+)* DevCertLine* DeployMethodLine VersionLine := version, NUMBER, DescLine := Gateway, name, STRING, hardward_type, 5i 10i 50i 100i 500i cc(legacy) cc100, nnodes, NUMBER [, default_route 1, IP ] [, proxy 2, STRING, hello_interval 2, NUMBER, password 2, STRING ] [behind_nat, true false, comments, STRING, ] InterfaceLine:=Interface, type, static dhcp pppoe, StaticIPConfPairs DHCPConfPairs PPPoEConfPairs StaticIPConfPairs:= name, eth-1 eth-2 eth-3 eth-4, exposeto, internal external, ip, IP, netmask, IP, [keepalive, IP,] mtu, NUMBER, flow_control, true false, connection_type, auto_detect 10base_t_half 10base_t_full 100base_tx_half 100base_tx_full, comments, STRING DHCPConfPairs:= name, eth-1 eth-2 eth-3 eth-4,] mtu, NUMBER, flow_control, true false, connection_type, auto_detect 10base_t_half 10base_t_full 100base_tx_half 100base_tx_full, comments, STRING NATLine:= nat, enable_firewall, true false, NATEntry* NATEntry:=nat_entry, translated_ip, IP, (any_inside, true,) (anyinside, false, single_ip, true false, source_ip, IP, network_mask, IP) PPPoEConfPairs:= name, eth-1 eth-2 eth-3 eth-4,] mtu, NUMBER, flow_control, true false, connection_type, auto_detect 10base_t_half 10base_t_full 100base_tx_half 100base_tx_full, comments, STRING, fromcli, true false, [username, STRING, password, STRING] RoutingLine:=routing, hostname, STRING, dn, STRING[, default_route, IP ] PartitionLine:=partition, NAME, STRING, NodeNameLine:= nodename, name, STRING NodeInterfaceLine:= nodeinterface, name, STRING, ip, IP, comment, STRING DeployMethodLine:=deploymethod, method, local DeployMethod Line DeployMethod Line:= , smtpserver,string,to,string,from,string,subject,string DevCertLine:=name, STRING, ca, STRING, [fqdn, true false, ] 3 [outsideipaddress, true false,] 4 [insideipaddress, true false], X500Fields X500Fields:=deptOrganizationalUnit, STRING, companyororganization, STRING, cityorlocality, STRING, stateorprovince, STRING, country, STRING, NotValidAfterYear, NUMBER, NotValidAfterMonth, NUMBER, NotValidAfterDay, NUMBER Nokia IP VPN Gateway Getting Started Guide 65

66 3 Installing Multiple Gateways Table 3 Key to Symbols in CSV Grammer Symbol Definition + 1 or more occurrences * 0 or more occurrences Quotation marks surround values that include spaces 1 Not needed for DHCP 2 Needed for DHCP 3 Must be true for dynamic gateways 4 Must be false for dynamic gateways Installation Script with Configuration Settings Following is an example installation script in the CSV format and in a text file. Example Installation Script version,1, Gateway, name, baja1, hardware_type, 50i, nnodes, 1, default_route, ,comment, "Hoboken J-Mart", CA, name, vpn_ca, is_vpn_ike_policy, true,default_filter, drop, DEPT_ORGANIZATIONAL_UNIT, "DEPT ORGANIZATIONAL UNIT", COMPANY_OR_ORGANIZATION, "COMPANY OR ORGANIZATION", CITY_OR_LOCALITY, "CITY OR LOCALITY", STATE_OR_PROVINCE, "STATE OR PROVINCE", COUNTRY, usa, NOT_VALID_AFTER_YEAR, 2007, NOT_VALID_AFTER_MONTH, jan, NOT_VALID_AFTER_DAY, 17, devcert, NAME, foo, CA, "gwdesc Certification Authority", FQDN, true, OUTSIDE_IP_ADDRESS, false, INSIDE_IP_ADDRESS, true, DEPT_ORGANIZATIONAL_UNIT, "DeviceCert DEPT ORGANIZATIONAL UNIT", COMPANY_OR_ORGANIZATION, "DeviceCert COMPANY OR ORGANIZATION", CITY_OR_LOCALITY, "DeviceCert CITY OR LOCALITY", STATE_OR_PROVINCE, "DeviceCert STATE OR PROVINCE", COUNTRY, us, NOT_VALID_AFTER_YEAR, 2010, NOT_VALID_AFTER_MONTH, 7, NOT_VALID_AFTER_DAY, 21, deploymethod, method, local, Interface, type, static, name, eth-2, mtu,1500, exposeto, internal, ip, , netmask, , keepalive,,mtu, 1500 Interface, type, static, exposeto, external, name, eth-1, ip, , netmask, , keepalive, , mtu,1500, flow_control, false, connection_type, "auto detect",comments, "foo bar", Routing, hostname, baja1, dn, cips.nokia.com, default_route, Nokia IP VPN Gateway Getting Started Guide

67 Installation Script Format hostgroup, name, one, name, two Partition, name, "VPN Default Partition" Deploymethod, method, local nat, enable_firewall, true, nat_entry, translated_ip, , any_inside, false, single_ip, false, source_ip, , network_mask, , Gateway, name, baja2, hardware_type, 50i, nnodes,1, default_route, , comment, "Headquarters", Interface, type, static, exposeto, external, name, eth-1, ip, , netmask, , keepalive, , mtu,1500, flow_control, false, connection_type, "auto detect",comments, "foo bar", Interface, type, static, name, eth-2, mtu,1500, exposeto, internal, ip, , netmask, , keepalive,,mtu, 1502, flow_control, false, Routing, hostname, baja2, dn, somecompany.com, default_route, Partition, name, "Hub and Spoke - All Traffic To Hub" Deploymethod, method, , smtpserver, mail.somecompany.com, to, alice@somecompany.com, from, bob@foo.com, subject, îbaja csv Gateway, name, hilo-cluster, hardware_type, 500i, nnodes, 2, default_route, ,comment, "Rack Mount in the wiring closet", Deploymethod, method, local, Interface, type, static, name,eth-1, exposeto, external, ip, , netmask, , keepalive,, mtu, 1500, flow_control, false, Interface, type, static, name, eth-2, exposeto, internal, ip, , netmask, , keepalive,, mtu, 1500, flow_control, false, Routing, hostname, hilo, dn, cips.nokia.com, default_route, Partition, name, "VPN Default Partition" Nodename, name, hilo-cluster1 Nodeinterface, name, eth-1, ip, Nodeinterface, name, eth-2, ip, Nodename, name, hilo-cluster2 Nodeinterface, name, eth-1, ip, Nodeinterface, name, eth-2, ip, version, 1, Gateway, name, pppoenode, hardware_type, 50i, nnodes,1, proxy, gwdesc, hello_interval, 5, password, password, behind_nat, true, Interface, type, pppoe, name, eth-1, mtu,1500, flow_control, false, connection_type, "auto detect",comments, "this is a pppoe interface", fromcli, true, Interface, type, static, name, eth-2, mtu,1500, exposeto, internal, ip, , netmask, , keepalive,,mtu, 1500, flow_control, false, Partition, name, "Hub and Spoke - All Traffic To Hub" Nokia IP VPN Gateway Getting Started Guide 67

68 3 Installing Multiple Gateways Routing, hostname, pppoenode, dn, cips.nokia.com, devcert, NAME, foo, CA, "gwdesc Certification Authority", FQDN, true, OUTSIDE_IP_ADDRESS, false, INSIDE_IP_ADDRESS, true, DEPT_ORGANIZATIONAL_UNIT, "DeviceCert DEPT ORGANIZATIONAL UNIT", COMPANY_OR_ORGANIZATION, "DeviceCert COMPANY OR ORGANIZATION", CITY_OR_LOCALITY, "DeviceCert CITY OR LOCALITY", STATE_OR_PROVINCE, "DeviceCert STATE OR PROVINCE", COUNTRY, us, NOT_VALID_AFTER_YEAR, 2010, NOT_VALID_AFTER_MONTH, 7, NOT_VALID_AFTER_DAY, 21, Deploymethod, method, local version, 1, Gateway, name, dhcpnode, hardware_type, 50i, nnodes,1, proxy, gwdesc, hello_interval, 5, password, password, behind_nat, true, Interface, type, dhcp, name, eth-1, mtu,1500, flow_control, false, connection_type, "auto detect",comments, "this is a dhcp interface", Interface, type, static, name, eth-2, mtu,1500, exposeto, internal, ip, , netmask, , keepalive,,mtu, 1500, flow_control, false, Partition, name, "Hub and Spoke - All Traffic To Hub" Routing, hostname, dhcpnode, dn, cips.nokia.com, devcert, NAME, foo, CA, "gwdesc Certification Authority", FQDN, true, OUTSIDE_IP_ADDRESS, false, INSIDE_IP_ADDRESS, true, DEPT_ORGANIZATIONAL_UNIT, "DeviceCert DEPT ORGANIZATIONAL UNIT", COMPANY_OR_ORGANIZATION, "DeviceCert COMPANY OR ORGANIZATION", CITY_OR_LOCALITY, "DeviceCert CITY OR LOCALITY", STATE_OR_PROVINCE, "DeviceCert STATE OR PROVINCE", COUNTRY, us, NOT_VALID_AFTER_YEAR, 2010, NOT_VALID_AFTER_MONTH, 7, NOT_VALID_AFTER_DAY, 21, Deploymethod, method, local 68 Nokia IP VPN Gateway Getting Started Guide

69 A Configuring a Syslog Server This chapter describes how to configure a syslog server in a template so that all of your gateways will have syslog configured when they are installed. A template is a collection of predefined gateway settings used to automate the process of configuring multiple gateways. Templates remove the requirement to make changes to gateways individually. The logging subsystem can be configured to send error messages to a syslog server. The output stored on the server includes information about events such as administrative events, configuration changes, and tunnel events. Because your gateway is diskless, you need to configure a syslog server for logging to occur. For more information about configuring templates and syslog servers, see the Nokia IP VPN Gateway Configuration Guide v6.3. To configure the syslog server 1. From the Nokia VPN Manager main window, select the Templates tab. The Templates window opens. Nokia IP VPN Gateway Getting Started Guide 69

70 A Configuring a Syslog Server 2. Choose Templates > New to create a new template. The New Template window opens. 3. Enter a template name in the text box. 4. From the Templates tree view, select Services > Syslog. The Syslog window opens. 5. Click New. The New Syslog Server window opens. 70 Nokia IP VPN Gateway Getting Started Guide

71 6. Enter the IP address for the new syslog server. 7. To send syslog messages, check Syslog (default). 8. Click OK. The new server appears in the Syslog list box. The server is identified by its IP address, type of message, status (true or false), and bind type. For example, if you are sending syslog messages only and the server is bound to the internal IP address of the gateway, the syslog pane shows true and the bind type shows internal. If the server is bound to the external IP address of the gateway, the bind type shows default. Nokia IP VPN Gateway Getting Started Guide 71