Configuring Secrets Management on the Avaya G250 and G350 Media Gateways - Issue 1.0

Transcription

1 Avaya Solution & Interoperability Test Lab Configuring Secrets Management on the Avaya G250 and G350 Media Gateways - Issue 1.0 Abstract Previous releases of the Avaya G250 and G350 Media Gateways maintained secret materials in local FLASH memory, and never output secrets to the management terminal or to the startup configuration file. These Application Notes present a mechanism in release 4.0 of Avaya Communication Manager that encrypts all secrets saved in the startup and running configuration files. This new approach prevents an unauthorized person from observing the device secrets and enables complete restore of the device configuration from the startup configuration saved in a USB flash drive or a remote file server. 1 of 18

2 CO MPA CT SPEAKER PH ONE /EXIT PAGE LEFT ABC HEADSET MUTE GH I JK L M NO PQR S TUV WXYZ REDI AL # * PAGE RI GHT DE F DROP TRANSFER CONFER ENC E OPTIONS HOLD V6 V2 V1 V7 ALM TST AC T ALM TST AC T OK TO REMOVE ETR ALM TST ACT SI SI ALM LN K COL Tx Rx FDX FC Hspd LAG PoE ALM AV AYA TST MM72 2 BR I V5 AC T V LI NE T RUN K 7 8 ALM Remove before removing or inserting S8300 module TST V4 AC T AV AYA ICC SH UT DO WN MODUL E USB 1 USB 2 ALM SO EI SM EM SI EO SE R VICE S TST AC T V3 SIG T RUNK L INE LI NE CCA ETH W A N ETH L AN MD M CONSOLE ALM US B CPU PWR RS T A S B SYSTEM G350 AV AYA AN ALOG MODULE AV AYA MM712 DC P VH 3 AV AYA E1/T1 MODULE PHONE /EXIT PAGE LEFT SPEAKER ABC HEADSET MUTE GHI JKL MN O PQRS TU V WXYZ REDIAL # * PAGE RI GHT DE F DROP OPTIONS TRANSFER CONFERENCE HOLD 1. Introduction Previous releases of the Avaya G250 and G350 Media Gateways maintained secret materials in local FLASH memory, and never output secrets to the management terminal or to the startup configuration file. The administrator can overwrite secrets but cannot read old secrets entered. This approach generates maximum security at the price of forcing a user to manually re-enter secret materials when a Media Gateway is replaced. The mechanism in release 4.0 of Avaya Communication Manager encrypts all secrets saved in the startup and running configuration files. This new approach prevents an unauthorized person from observing the device secrets and enables complete restore of the device configuration from the startup configuration saved in a USB flash drive or a remote file server. Figure 1 is the network diagram used for the verification of these Application Notes. Three offices shown in Figure 1 are connected via a Wide Area Network (WAN). T1/PPP is used in each office for the WAN connection. A full-mesh VPN (any-to-any), Generic Routing Encapsulation (GRE) tunnles and OSPF routing protocol are configured among the three offices. MD5 authentication is used for the OSPF routing protocol configuration. The Main Office contains an Avaya S8500 Media Server and an Avaya G650 Media Gateway. The Branch Office 1 contains an Avaya G250L-DS1 Media Gateway and the Branch Office 2 contains an Avaya G350L Media Gateway. Main Office Branch Office 1 Microsoft windows 2000 Server Microsoft DHCP Server Microsoft Information Server (FTP Server) Microsoft IAS Avaya TFTP Server Apache HTTP Server Avaya G650 Media Gateway Avaya G250L-DS1 Media Gateway (SLS) USB Flash Drive T1/PPP Avaya 4610 IP Telephone Avaya S8500 Media Server L3 Switch Cisco 3725 Access Router T1/PPP WAN T1/PPP Avaya 6210 Analog Phone Branch Office 2 Avaya 9620 IP Telephone Avaya 4610 IP Telephone GRE/ VPN Tunnels OSPF (MD5 Authentication) Avaya G350L Media Gateway (SLS) 9620 IP Telephone USB Flash Drive Avaya 6210 Analog Phone Figure 1: Configuration for Secrets Management 2 of 18

3 The Avaya G250 and G350 Media Gateway are configured as the DHCP and TFTP servers for the Avaya IP telephones in the branch offices. The Microsoft DHCP server and Avaya TFTP server installed on the Microsoft Windows 2000 Server in the Main Office are used for the Avaya IP telephones in the Main Office. The Apache HTTP Server installed on the Microsoft Windows 2000 Server is used for the Avaya 9600 IP telephones. For the sample configuration, 802.1X is enabled on the Avaya G250 and G350 Media Gateways and the Avaya IP telephones in the branch offices. The Microsoft Internet Authentication Service (IAS) installed on the Microsoft Windows 2000 Server in the Main Office is used as a Radius Server. The Microsoft Information Server is used as a FTP server. 2. Equipment and Software Validated Table 1 below shows the versions verified in these Application Notes. Equipment Software Avaya Communication Manager Avaya S8500 Media Server 4.0 (load 727) Avaya G650 Media Gateway IPSI (TN2312AP) C-LAN (TN799DP) MEDPRO (TN2302AP) HW12 FW031 HW01 FW017 HW11 FW107 Avaya G250L-DS1 Media Gateway Avaya G350L Media Gateway Avaya 4610 Series IP Telephones (H.323) 2.60 Avaya 9620 Series IP Telephone (H.323) 1.20 Avaya TFTP Server Apache HTTP Server Microsoft Internet Authentication Service Windows 2000 Server (SP 4) Microsoft DHCP Server Windows 2000 Server (SP 4) Microsoft Information Server (FTP Server) Windows 2000 Server (SP 4) Cisco 3725 Access Router 12.4(10a) Table 1: Software Versions 3 of 18

4 3. Configuration of the Avaya Media Gateway The following secrets were verified in these Application Notes. User Name and Password A user name and password is created in the Avaya G250 and G350 Media Gateway. Radius Secret The Radius Server in Main Office is used for 802.1X authentication of the Avaya IP telephones in Branch Office 1 and Branch Office 2. Refer to [1] for details. Station Passwords The Avaya G250-DS1 and G350 Media Gateways are configured with the Standard Local Survival Processor (SLS). IP station extensions and passwords are configured in the Branch Offices. VPN Shared Secret Pre-shared keys are configured for VPN tunnels. Refer to [2] for details. OSPF Shared Secrets Message Digest 5 (MD5) authentication is configured for the OSPF routing protocol. Refer to [2] for details. Encryption of secrets is performed using 128-bit user defined Master Configuration Key (MCK). The Media Gateway is shipped with an Avaya Default Master Config Key (ADMCK) as a default hardcode secret value common to all Gateways. The ADMCK can be used for decryption of a configuration file on initial installation or when customers are not interested in maintaining user defined MCK. Avaya recommends changing the ADMCK to a user defined MCK for greater security. Use the command key config-key password-encryption <master passphrase> to configure a MCK. The following screen shows a command to configure a MCK. Use the command copy running-config startup-config to commit the new MCK. The command will encrypt the startup configuration with the new MCK G350-SLS(super)# key config-key password-encryption GoodBye2005Welcom2006 Warning: Use copy running to startup config to commit new configuration master key The secret management engine in the Media Gateway reuses the startup-config concept by modeling existing CLI commands for secret configurations with new commands that accept encrypted secret parameters. For example, the Media Gateway will support the new command encrypted-pre-shared-key <encrypted-key-string> that extends functionality of existing preshared-key <key-string>. The startup or the running configuration can be copied to a file server or a USB flash drive. The USB flash drive can connect to the USB port on the media gateway. The file server can be a TFTP, HTTP or SCP server. To copy the configuration file back from the saved configuration, the current MCK on the Avaya Media Gateway must match the MCK in the saved configuration. 4 of 18

5 The MCK must be saved in a secure place. If the Media Gateway needs to be replaced, the MCK must be configured on the new Media Gateway in order to restore the original configuration on the new media gateway. The following screen shows the command Syntax to copy the startup configuration to a file server or a USB flash drive. G250-DS1-011(super)# copy startup-config? Copy startup-config commands: copy startup-config ftp Upload startup configuration to a file (using ftp) copy startup-config scp Upload startup configuration to a file (using scp) copy startup-config tftp Upload startup configuration to a file (using tftp) copy startup-config usb Upload startup configuration to a file (using usb A similar command can be used to copy the configuration from a file server or a USB flash drive to the startup-config. Backup and Restore operation can also be used, Refer to [3] for details on the backup and restore operations. The following screen shows the annotated startup-config file on the Avaya G250 Media Gateway, which is encrypted with the user defined MCK. Note that all the encrypted secrets in the startup-config are shown with the encrypted prefix appended to the command user enters via the CLI. The configuration for the Avaya G350 Media Gateway is similar and is not shown. G250-DS1-011(super)# show startup-config! version ! The following line shows the information on the GW. Config info release time "19:05:18 29 JAN 2007 " serial_number 03IS ! The following shows the encrypted usernames and passwords. encrypted-username zdemqsjbbvuy/d1yognzag== password zv9lefjr7hocgf+btlqosvny7ve XN6LI4hgIZBNKRdw= access-type naxzrzkck9s25x8jdchjbq== encrypted-username hkq02cqfwoqyx1c5w3i1kg== password qpapp/j4+mxxr3022tzkbavny/i z4owt7pvo62rr82e= access-type TyJcVqMQcKlp9f83Wxs3FQ==! The following lines show the radius server configuration and encrypted RADIUS! authentication secret. set radius authentication enable set radius authentication server primary set encrypted-radius authentication secret AAFaCBGLH0rYjScBoU9xHdqclJ2mXFcvpOmHb esxpf0= set dot1x system-auth-control enable! The following lines show the VPN configuration ip crypto-list 901 local-address Serial 2/1:1.0 ip-rule 1 protect crypto map 1 source-ip host destination-ip host ip-rule 2 5 of 18

6 protect crypto map 2 source-ip host destination-ip host crypto ipsec transform-set H2 esp-aes esp-sha-hmac mode transport set pfs group2 crypto isakmp policy 1 description "Phase 1 Proposal" encryption aes hash md5 group 2 authentication pre-share crypto isakmp peer address " "! The following line shows the encrypted VPN shared secret with the Main Office encrypted-pre-shared-key jlxkdhiglpotdg0dqfrj0a== isakmp-policy 1 initiate mode aggressive keepalive 10 retry 2 on-demand crypto isakmp peer address " "! The following line shows the encrypted VPN shared secret with the Branch Office 2 encrypted-pre-shared-key w/gm0lvsdn5qmjb3ai+m2zw9ak80cfuajub8pxwmvug= isakmp-policy 1 initiate mode aggressive keepalive 10 retry 2 on-demand crypto map 1 description "Phase 2 Proposal" set peer " " set transform-set H2 crypto map 2 description "Phase 2 Proposal" set peer " " set transform-set H2 interface Tunnel 1 tunnel source tunnel destination ip address ! The following line shows the encrypted OSPF MD5 key configuration ip ospf authentication message-digest ip encrypted-ospf message-digest 1 md5 +eh75vdqxti1k2rx83jmoq== interface Tunnel 2 tunnel source tunnel destination ip address ! The following line shows the encrypted OSPF MD5 key configuration ip ospf authentication message-digest ip encrypted-ospf message-digest 1 md5 meoqo1joam3khi5kpukblq== interface Serial 2/1:1 encapsulation ppp ip crypto-group of 18

7 ip address router ospf network area network area network area survivable-call-engine! The following line shows the encrypted password for an IP station. station ip set cor unrestricted set encrypted-password "6935CBjd+4pTpNg1LS7K5w=="! The following line shows the SLS is enabled. set survivable-call-engine enable!#!# End of configuration file. Press Enter to continue. 7 of 18

8 4. Copy Configuration Files to/from the Media Gateway The CLI commands are the same for the Avaya G250 and G350 Media Gateways to copy the configuration files between the Avaya Media Gateway and a USB flash drive or a file server. Only the Avaya G250 Media Gateway is demonstrated in this Section. 4.1 Copy the Startup Configuration to a USB Flash Drive To back up the Avaya G250 Media Gateway, insert a USB flash drive into the USB port on the Avaya G250 Media Gateway. Use the command show usb all to verify that the Avaya G250 Media Gateway detects the USB flash drive. The Media Gateway supports FAT16 and FAT32 file systems on the USB flash drive. The flash drive needs to be formatted with one of these formats. The following shows the USB flash drive is formatted as FAT16 and the device name is usbdevice0. The device name will be used in the following configuration steps. G250-DS1-011(super)# show usb all USB Description Manufacturer USB Power Max Speed Dev Id Ver Mode Power(mA) Root Hub (OHCI) N/A 1.1 Self 0 Full 2 USB DRIVE SIMPTECH 1.1 Self 90 Full 257 Root Hub (EHCI) N/A 2.0 Self 0 High USB Vendor Product Device Serial Number FileSystem Storage Free FS Dev Id ID ID Ver (MB) (MB) x0 0x0 0.0 N/A N/A N/A N/A N/A 2 0x4e8 0x /usbdevice FAT x0 0x0 0.0 N/A N/A N/A N/A N/A Use the command copy running-config startup-config to copy the running-config to the startup-config using the current MCK. G250-DS1-011(super)# copy running-config startup-config Beginning copy operation... Done! Use the command copy startup-config usb <file name> usbdevice0 to copy the startup-config to the USB flash drive with the specified file name. G250-DS1-011(super)# copy startup-config usb G250-DS1-backup usbdevice0 Confirmation - do you want to continue (Y/N)? y Beginning upload operation... This operation may take up to 20 seconds. Please refrain from any other operation during this time. For more information, use 'show upload status 10' command 8 of 18

9 Use the command show upload status 10 to verify the upload status. The Running state idle means the upload is successfully. G250-DS1-011(super)# show upload status 10 Module #10 =========== Module : 10 Source file : startup-config Destination file : /usbdevice0/g250-ds1-backup Host : Running state : Idle Failure display : (null) Last warning : No-warning Attach the USB flash drive to a PC, and open the configuration file on the USB flash drive with the notepad or wordpad application, verify that all secrets in the configuration file are still encrypted. 4.2 Copy the Configuration from a USB Flash Drive to the Startup Configuration Use the command copy usb startup-config usbdevice0 <file name> to copy (or download) the specified file on the USB flash drive to the startup configuration on the Avaya Media Gateway. The following screen shows that the configuration can be copied from the USB flash drive to the Startup-config when the same MCK is used. G250-DS1-011(super)# copy usb startup-config usbdevice0 G250-DS1-backup Confirmation - do you want to continue (Y/N)? y Beginning download operation... This operation may take up to 20 seconds. Please refrain from any other operation during this time. For more information, use 'show download status 10' command 9 of 18

10 The following screen shows that the download is successful. The Running state idle means the download is successfully. Reset the Media Gateway to use the startup configuration copied from the USB flash drive. G250-DS1-011(super)# show download status 10 Module #10 =========== Module : 10 Source file : /usbdevice0/g250-ds1-backup Destination file : startup-config Host : Running state : Idle Failure display : (null) Last warning : No-warning Bytes Downloaded : 4267 Use the commands show startup-config and show running-config to verify that all secrets are still encrypted. If the MCK does not match the MCK in the configuration, the command copy usb startupconfig usbdevice0 <file name> will fail as shown in the following screen. G250-DS1-011(super)# copy usb startup-config usbdevice0 G250-DS1-backup Confirmation - do you want to continue (Y/N)? y Beginning download operation... This operation may take up to 20 seconds. Please refrain from any other operation during this time. For more information, use 'show download status 10' command G250-DS1-011(super)# Failed Testing Line 4 in /usbdevice0/g250-ds1-backup file: "encrypted-username zdemqsjbbvuy/d1yognzag== password zv9lefjr7hocgf+btlqosvny 7VEXN6LI4hgIZBNKRdw= access-type naxzrzkck9s25x8jdchjbq==" Failed Testing Line 5 in /usbdevice0/g250-ds1-backup file: "encrypted-username hkq02cqfwoqyx1c5w3i1kg== password qpapp/j4+mxxr3022tzkbavn y/iz4owt7pvo62rr82e= access-type TyJcVqMQcKlp9f83Wxs3FQ==" Failed Testing Line 11 in /usbdevice0/g250-ds1-backup file: "set encrypted-radius authentication secret AAFaCBGLH0rYjScBoU9xHdqclJ2mXFcvpO 10 of 18

11 4.3 Copy the Startup Configuration to a File Server The startup configuration on the Avaya Media Gateway can be copied to a file server, which can be a TFTP, HTTP or SCP server. The following screen shows the command to copy the startup configuration to a FTP server. G250-DS1-011(super)# copy startup-config ftp G250-DS Confirmation - do you want to continue (Y/N)? y Username: anonymous Password: Beginning upload operation... This operation may take up to 20 seconds. Please refrain from any other operation during this time. For more information, use 'show upload status 10' command The following screen shows that the upload is successful. The Running state idle means the upload is successfully. G250-DS1-011(super)# show upload status 10 Module #10 =========== Module : 10 Source file : startup-config Destination file : G250-DS1 Host : Running state : Idle Failure display : (null) Last warning : No-warning Open the configuration file on the file server with the notepad or wordpad application. Verify that all secrets in the configuration file are still encrypted. 11 of 18

12 4.4 Copy the Configuration From a File Server to the Startup Configuration The following shows that the configuration can be copied from the FTP server to the Startupconfig when the same MCK is used. G250-DS1-011(super)# copy ftp startup-config G250-DS Confirmation - do you want to continue (Y/N)? y Username: anonymous Password: Beginning download operation... This operation may take up to 20 seconds. Please refrain from any other operation during this time. For more information, use 'show download status 10' command The following screen shows that the upload is successful. The Running state idle means the download is successfully. Reset the Media Gateway to use the new startup configuration file. G250-DS1-011(super)# show download status 10 Module #10 =========== Module : 10 Source file : G250-DS1 Destination file : startup-config Host : Running state : Idle Failure display : (null) Last warning : No-warning Bytes Downloaded : 4267 Use the commands show startup-config and show running-config to verify that all secrets are still encrypted. 12 of 18

13 4.5 Restore the Configuration after NVRAM Initiation When the Media Gateway is replaced because of RMA or the nvram initialization (the vram initialize command will initialize the configuration to the factory default), the license is lost. The following screen shows the nvram initialize operation. G250-DS1-011(super)# nvram initialize This command will restore factory defaults and can disconnect your telnet session *** Reset *** - do you want to continue (Y/N)? y Done! G250-DS1-011(super)# Image Banks Integrity self-test passed Device is booting from bank:a Delete NVM ---- NVRAM integrity power-up self test passed X9.31 DRNG Known Answer power-up self test passed AES Known Answer power-up self test passed RSA Known Answer power-up self test passed TDES Known Answer power-up self test passed SHA-1 Known Answer power-up self test passed HMAC-SHA1 Known Answer power-up self test passed Generating DSA key, This command may take a few minutes Key was created! Key version: SSH2, DSA Key Fingerprint: 57:b6:7b:87:67:78:dc:e2:fe:df:a3:7b:3b:74:3b:fc Product type: Avaya G250-DS1 Media Gateway Release Login: root Password: **** Password accepted Enter new password: Confirm new password: The following shows that the license is lost after the nvram initialization. G250-DS1-???(super)# show license status No License installed. 13 of 18

14 Since the VPN license is needed for the sample configuration, the license must be installed before the configuration can be copied back successfully. The following screen shows the license on the USB flash drive is copied to the Avaya G250 Media Gateway. G250-DS1-???(super)# copy usb license-file usbdevice0 G250-DS1-011/vpn_license.cfg Confirmation - do you want to continue (Y/N)? y Beginning download operation... This operation may take a few minutes... Please refrain from any other operation during this time. For more information, use 'show download license-file status' command Use the command show download license-file status to verify the down status. G250-DS1-???(super)# show download license-file status Module #10 =========== Module : 10 Source file : /usbdevice0/g250-ds1-011/vpn_license.cfg Destination file : license-file Host : Running state : Idle Failure display : (null) Last warning : No-warning Bytes Downloaded : 953 Reset the Media Gateway to activate the VPN license. Verify that the VPN license is installed after its reset. G250-DS1-???(super)# show license status License was installed. Use the command key config-key password-encryption <master passphrase> to change the MCK to match the MCK in the backup configuration. G250-DS1-???(super)# key config-key password-encryption <master passphrase> Warning: Use copy running to startup config to commit new configuration master key 14 of 18

15 Copy the configuration to the startup configuration from the USB flash drive. If the backup configuration is on a file server, the Media Gateway must be configured to have network access to the file server before the configuration can be copied back to the Media Gateway. G250-DS1-???(super)# copy usb startup-config usbdevice0 G250-DS1-backup Confirmation - do you want to continue (Y/N)? y Beginning download operation... This operation may take up to 20 seconds. Please refrain from any other operation during this time. For more information, use 'show download status 10' command The following screen shows that the download is successful. Reset the Media Gateway to use the new startup configuration. G250-DS1-???(super)# show download status Module #10 =========== Module : 10 Source file : /usbdevice0/g250-ds1-backup Destination file : startup-config Host : Running state : Idle Failure display : (null) Last warning : No-warning Bytes Downloaded : 4267 Use the commands show startup-config and show running-config to verify that all secrets are still encrypted. 15 of 18

16 5. Verification Steps The administrator needs to make sure that the Media Gateway functions as expected with the new startup configuration copied from the USB flash drive or a file server. Based on the configuration in Figure 1, the following should be verified: VPN is up. The Avaya G350 Media Gateway registers to Avaya Communication Manager. IP telephone registers to Avaya Communication Manager. Calls can be made successfully between all locations. The IP telephone in a branch office can register to the Standard Local Survival Processor of the Media Gateway in that branch office when the connection between the branch office and the main office is out of service. 6. Conclusion These Application Notes illustrate that the Avaya G250 and G350 Media Gateways can encrypt all secrets using the MCK in the startup and running configuration files, which can be copied to an external file server or a USB flash drive. The Avaya G250 and G350 Media Gateways can also decrypt the configuration copied back from an external file server or a USB flash drive when the same MCK is used. The backup configuration file cannot be copied back if a different MCK is used. 16 of 18

17 7. Additional References The following Applications Notes can be found at [1] Configuring 802.1X Protocol on Avaya G250 and G350 Media Gateways For an Avaya IP Telephone With an Attached PC [2] Configuring a Generic Routing Encapsulation (GRE) Tunnel Over IPSec VPN Using Transport Mode with Open Shortest Path First (OSPF) Routing Protocol between an Avaya G250 Media Gateway and a Cisco Access Router [3] Configuring Backup and Restore Operations on the Avaya G250 and G350 Media Gateway 17 of 18

18 Avaya and the Avaya Logo are trademarks of Avaya Inc. All trademarks identified by and are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners. The information provided in these Application Notes is subject to change without notice. The configurations, technical data, and recommendations provided in these Application Notes are believed to be accurate and dependable, but are presented without express or implied warranty. Users are responsible for their application of any products specified in these Application Notes. Please any questions or comments pertaining to these Application Notes along with the full title name and filename, located in the lower right corner, directly to the Avaya Solution & Interoperability Test Lab at 18 of 18