Configuration Using the Avaya Health Agent

Transcription

1 Configuration Using the Avaya Health Agent 5.0 NN _2.0, December 2010

2 2010 Avaya Inc. All Rights Reserved. Notice While reasonable efforts have been made to ensure that the information in this document is complete and accurate at the time of printing, Avaya assumes no liability for any errors. Avaya reserves the right to make changes and corrections to the information in this document without the obligation to notify any person or organization of such changes. Documentation disclaimer Avaya shall not be responsible for any modifications, additions, or deletions to the original published version of this documentation unless such modifications, additions, or deletions were performed by Avaya. End User agree to indemnify and hold harmless Avaya, Avaya's agents, servants and employees against all claims, lawsuits, demands and judgments arising out of, or in connection with, subsequent modifications, additions or deletions to this documentation, to the extent made by End User. Link disclaimer Avaya is not responsible for the contents or reliability of any linked Web sites referenced within this site or documentation(s) provided by Avaya. Avaya is not responsible for the accuracy of any information, statement or content provided on these sites and does not necessarily endorse the products, services, or information described or offered within them. Avaya does not guarantee that these links will work all the time and has no control over the availability of the linked pages. Warranty Avaya provides a limited warranty on this product. Refer to your sales agreement to establish the terms of the limited warranty. In addition, Avaya s standard warranty language, as well as information regarding support for this product, while under warranty, is available to Avaya customers and other parties through the Avaya Support Web site: Please note that if you acquired the product from an authorized Avaya reseller outside of the United States and Canada, the warranty is provided to you by said Avaya reseller and not by Avaya. Licenses THE SOFTWARE LICENSE TERMS AVAILABLE ON THE AVAYA WEBSITE, ARE APPLICABLE TO ANYONE WHO DOWNLOADS, USES AND/OR INSTALLS AVAYA SOFTWARE, PURCHASED FROM AVAYA INC., ANY AVAYA AFFILIATE, OR AN AUTHORIZED AVAYA RESELLER (AS APPLICABLE) UNDER A COMMERCIAL AGREEMENT WITH AVAYA OR AN AUTHORIZED AVAYA RESELLER. UNLESS OTHERWISE AGREED TO BY AVAYA IN WRITING, AVAYA DOES NOT EXTEND THIS LICENSE IF THE SOFTWARE WAS OBTAINED FROM ANYONE OTHER THAN AVAYA, AN AVAYA AFFILIATE OR AN AVAYA AUTHORIZED RESELLER, AND AVAYA RESERVES THE RIGHT TO TAKE LEGAL ACTION AGAINST YOU AND ANYONE ELSE USING OR SELLING THE SOFTWARE WITHOUT A LICENSE. BY INSTALLING, DOWNLOADING OR USING THE SOFTWARE, OR AUTHORIZING OTHERS TO DO SO, YOU, ON BEHALF OF YOURSELF AND THE ENTITY FOR WHOM YOU ARE INSTALLING, DOWNLOADING OR USING THE SOFTWARE (HEREINAFTER REFERRED TO INTERCHANGEABLY AS YOU AND END USER ), AGREE TO THESE TERMS AND CONDITIONS AND CREATE A BINDING CONTRACT BETWEEN YOU AND AVAYA INC. OR THE APPLICABLE AVAYA AFFILIATE ( AVAYA ). protected by copyright and other intellectual property laws including the sui generis rights relating to the protection of databases. You may not modify, copy, reproduce, republish, upload, post, transmit or distribute in any way any content, in whole or in part, including any code and software. Unauthorized reproduction, transmission, dissemination, storage, and or use without the express written consent of Avaya can be a criminal, as well as a civil, offense under the applicable law. Third-party components Certain software programs or portions thereof included in the Product may contain software distributed under third party agreements ( Third Party Components ), which may contain terms that expand or limit rights to use certain portions of the Product ( Third Party Terms ). Information regarding distributed Linux OS source code (for those Products that have distributed the Linux OS source code), and identifying the copyright holders of the Third Party Components and the Third Party Terms that apply to them is available on the Avaya Support Web site: Trademarks The trademarks, logos and service marks ( Marks ) displayed in this site, the documentation(s) and product(s) provided by Avaya are the registered or unregistered Marks of Avaya, its affiliates, or other third parties. Users are not permitted to use such Marks without prior written consent from Avaya or such third party which may own the Mark. Nothing contained in this site, the documentation(s) and product(s) should be construed as granting, by implication, estoppel, or otherwise, any license or right in and to the Marks without the express written permission of Avaya or the applicable third party. Avaya is a registered trademark of Avaya Inc. All other trademarks are the property of their respective owners. Downloading documents For the most current versions of documentation, see the Avaya Support Web site: Contact Avaya Support Avaya provides a telephone number for you to use to report problems or to ask questions about your product. The support telephone number is in the United States. For additional support telephone numbers, see the Avaya Web site: support Copyright Except where expressly stated otherwise, no use should be made of materials on this site, the Documentation(s) and Product(s) provided by Avaya. All content on this site, the documentation(s) and the product(s) provided by Avaya including the selection, arrangement and design of the content is owned either by Avaya or its licensors and is 2 Configuration Using the Avaya Health Agent December 2010

3 Contents Chapter 1: New in this Release...5 Navigation...5 Features...5 Other changes...5 Document changes...5 Chapter 2: Introduction...7 Before you begin...7 Text conventions...7 Acronyms...8 Related publications...9 Customer Service...9 Getting technical documentation...10 Getting product training...10 Getting help from a distributor or reseller...10 Getting technical support from the Avaya Web site...10 Chapter 3: Installing the Avaya Health Agent...11 Navigation...11 Avaya Health Agent...11 Avaya Health Agent icons...12 Supported platforms...13 Installing the Avaya Health Agent...13 Java Runtime Environment (JRE) Selection...13 Installation kits...14 Customizable installation kit...14 Standard installation kit...14 Command line and silent installation...15 Custom installation...15 Modify installation properties...15 Change default JRE...15 Change Avaya Health Agent icon...16 Modify Agent.properties...16 Customizing Login dialog box image...17 Customizing About dialog box image...18 Customizing Connection dialog box icon...18 System preferences...18 Custom install options...18 Avaya Health Agent system tray icon...19 Avaya Health Agent logs...19 No or limited pop-up messages...20 Clickable link in Avaya Health Agent...20 Recovery from initial check failure...20 Avaya Health Agent additional features...21 Windows 802.1x Supplicant...21 Multi-OS Applet Support...21 NAP interoperability...22 Configuration Using the Avaya Health Agent December

4 Chapter 4: Configuring the Avaya Health Agent...23 Navigation...23 Logging on to NSNA...23 Variable definition...24 Managing profiles...24 Managing profiles navigation...24 Managing user profiles...25 Managing system profiles...27 Managing global user profiles...29 Settings of Avaya Health Agent...32 Settings of Avaya Health Agent navigation...32 Certificate management...32 Configuring the Avaya Health Agent...32 Variable definition...33 Viewing the Avaya Health Agent status...34 Index Configuration Using the Avaya Health Agent December 2010

5 Chapter 1: New in this Release The following sections detail what s new in Avaya Health Agent Configuration Using the Avaya Health Agent, NN for Release 5.0. Navigation Features on page 5 Other changes on page 5 Features See the Avaya Health Agent additional features on page 21 for information about feature changes. Other changes No changes. Document changes This document is reformatted to comply with the Avaya Customer Documentation Standards. For more information, see Secure Network Access Switch Documentation Roadmap, NN Configuration Using the Avaya Health Agent December

6 New in this Release 6 Configuration Using the Avaya Health Agent December 2010

7 Chapter 2: Introduction This guide introduces the installation procedures for the Avaya Health Agent. Topics include: Installing the Avaya Health Agent on page 11 Configuring the Avaya Health Agent on page 23 This guide is intended for network managers who are setting up Installable Avaya Health Agent software. This guide assumes that you have experience with windowing systems or Graphical User Interfaces (GUIs) and familiarity with network management. Before you begin The minimum PC requirements for running the NSNAS Installable Avaya Health Agent are: Windows 2000, XP, Vista or Windows Server MHz Pentium 64 MB memory 10 MB free hard disk space Java Virtual Machine (JVM) or later if you have the install kit without the JVM Text conventions This guide uses the following text conventions: angle brackets (< >) bold text bold Courier text Enter text based on the description inside the brackets. Do not type the brackets when entering the command. Example: If the command syntax is ping <ip_address>, enter: ping Objects such as window names, dialog box names, and icons, as well as user interface objects such as buttons, tabs, and menu items. Command names, options, and text that you must enter. Example: Use the dinfo command. Example: Enter show ip {alerts routes}. Configuration Using the Avaya Health Agent December

8 Introduction braces ({}) brackets ([ ]) ellipsis points (...) italic text plain Courier text Required elements in syntax descriptions where more than one option exists. You must choose only one of the options. Do not type the braces when you enter the command. Example: If the command syntax is show ip {alerts routes}, you must enter either show ip alerts or show ip routes, but not both. Optional elements in syntax descriptions. Do not type the brackets when you enter the command. Example: If the command syntax is show ip interfaces [-alerts], you can enter either show ip interfaces or show ip interfaces - alerts. Repeat the last element of the command as needed. Example: If the command syntax is ethernet/2/1 [ <parameter> <value> ]..., you enter ethernet/ 2/1 and as many parameter-value pairs as needed. Variables in command syntax descriptions. Italics also indicate new terms and book titles. Where a variable is two or more words, the words are connected by an underscore. Example: If the command syntax is show at <valid_route>, valid_route is one variable, and you substitute one value for it. Command syntax and system output, for example, prompts and system messages. Example: Set Trap Monitor Filters separator ( > ) vertical line ( ) Menu paths. Example: Protocols > IP identifies the IP command on the Protocols menu. Options for command keywords and arguments. Enter only one of the options. Do not type the vertical line when you enter the command. Example: If the command syntax is show ip {alerts routes}, you enter either show ip alerts or show ip routes, but not both. Acronyms This guide uses the following acronyms: SRS Software Requirement Set 8 Configuration Using the Avaya Health Agent December 2010

9 Related publications LDAP AHA SNAS VM JVM DLL JRE VPN CLI VLAN NAP NPS Lightweight Directory Access Protocol Avaya Health Agent Secure Network Access Switch Virtual Machine Java Virtual Machine Dynamic-link library Java Runtime Environment Virtual Private Network Command Line Interface Virtual Local Area Network Network Access Protection Network Policy Server Related publications For more information about SNAS, see the following publications: Secure Network Access Solution Guide Secure Network Access Switch 4050 Installation Guide Secure Network Access Switch 4050 User Guide for the CLI Release Notes for Avaya Ethernet Routing Switch 5500 Series, Software Release Release Notes for the Ethernet Routing Switch 8300, Software Release Release Notes for the Secure Network Access Solution, Software Release Release Notes for Enterprise Switch Manager, Software Release 5.2 Using Enterprise Switch Manager Release 5.1 To print selected technical manuals and release notes, go to find the product for which you need documentation, then locate the specific category and model or version for your hardware or software product. Use Adobe Reader to open the manuals and release notes, search for the sections you need, and print. To download Adobe Reader, go to the Adobe Web site Customer Service Configuration Using the Avaya Health Agent December

10 Introduction Visit the Avaya Web site to access the complete range of services and support that Avaya provides. Go to or go to one of the pages listed in the following sections. Navigation Getting technical documentation Getting product training Getting help from a distributor or reseller Getting technical support from the Avaya Web site Getting technical documentation To download and print selected technical publications and release notes directly from the Internet, go to Getting product training Ongoing product training is available. For more information or to register, you can access the Web site at From this Web site, you can locate the Training contacts link on the left-hand navigation pane. Getting help from a distributor or reseller If you purchased a service contract for your Avaya product from a distributor or authorized reseller, contact the technical support staff for that distributor or reseller for assistance. Getting technical support from the Avaya Web site The easiest and most effective way to get technical support for Avaya products is from the Avaya Technical Support Web site at 10 Configuration Using the Avaya Health Agent December 2010

11 Chapter 3: Installing the Avaya Health Agent Avaya Health Agent enables you to impose a security policy on the client PC when it is connected to the corporate network through the Secure Network Access Switch (N SNAS). This policy defines the firewall and security software, or Software Requirement Set (SRS), that must be installed and activated on the client PC while the PC is connected to the gateway. Avaya Health Agent is comprised of the following components: Avaya Health Desktop Agent is the desktop application running on client desktop PCs that connect to Secure Network. This application monitors the state of rules on desktops that are enforced by Avaya Health Agent daemon and reports their status back to Secure Network. The installable Avaya Health Agent is installed on the end user's system as a Windows System Service. The Avaya Health Agent provides single sign-on and machine authentication functions. Software Requirement Set (SRS) builder provides an interface for administrators to create and modify Software Requirement Sets (SRS) and rules. These requirements and rules are assigned to groups of users and enforced on client PCs connecting to either VPN Router or SNAS. Navigation Avaya Health Agent on page 11 Avaya Health Agent icons on page 12 Supported platforms on page 13 Installing the Avaya Health Agent on page 13 Java Runtime Environment (JRE) Selection on page 13 Installation kits on page 14 Avaya Health Agent additional features on page 21 NAP interoperability on page 22 Avaya Health Agent The Avaya Health Agent runs on the client desktop PC and is responsible for processing and checking the SRS rules. For example, the Avaya Health Agent checks that the required components (executable files, DLLs, configuration files), which are necessary to comprise a personal firewall are installed and active. Configuration Using the Avaya Health Agent December

12 Installing the Avaya Health Agent The Avaya Health Agent features are: starts at bootup remains inactive till a connection is established. Once connection established, it remains in listening state. once connection is torn down, it becomes passive. NSNAS AHA can be used in three different states: Avaya Health Agent This agent contains two individual entities that are, a system service and the user interface application that is accessible through Windows system tray. It is installed as Windows system service. The advantages of using the Avaya Health Agent are system and user authentication, and single sign-on in Microsoft and Novell environments. Avaya Health Desktop Agent This agent is installed through the SNAS captive portal as a JAVA Webstart application on the Windows platform and runs as Windows system tray application. The advantages of using the Avaya Health Desktop Agent are "user authentication" and "device compliance checking". Avaya Health Browser Applet This applet is a JAVA applet in the web browser that runs on Windows and non-windows operating systems. Avaya Health Agent icons There is an icon defined for each of the three Avaya Health Agent states. The following table shows the color and state of each icon. Table 1: Avaya Health Agent icons Color Gray Green Green with red color X Blue Blue with red color X State There is no connection to the server. Avaya Health Agent is in an idle state. Avaya Health Agent is connected to the server and compliant to policies. Compliance has failed and a new error is reported. The system session is logged on to SNAS and the system policies are compliant. The system session is logged on and the system policies have failed. 12 Configuration Using the Avaya Health Agent December 2010

13 Supported platforms Supported platforms Avaya Health Agent is supported on the following operating system platforms: Windows 2000 Windows XP Windows 2003 Server Windows Vista Installing the Avaya Health Agent Avaya Health Agent installation kits are provided on the NSNAS portal/ Avaya Health Agent CD in the Avaya Health Agent directory. Important: You require administrative rights to install the Avaya Health Agent. Java Runtime Environment (JRE) Selection There are two installation kits provided, one with the Java virtual machine (VM) (1.6.0_01) bundled, one without VM bundled. NoVM installation kit is provided to minimize the size of the kit for downloading. JRE (or later versions) is required for Avaya Health Agent installation. The VM version of Avaya Health Agent installation allows you to install bundled VM (which is 1.6.0_01) with Avaya Health Agent. The VM is installed under the <NHA install dir>\ jre directory. This JRE is local to the Avaya Health Agent and is only used by Avaya Health Agent. Web browsers are not affected by it. The Select JVM" dialog box allows users to select: bundled JVM (not available for NoVM kit) JVM installed on local machine (with version greater than or equal to 1.5.0) If you select a bundled JVM, a jre directory is installed under the installation directory and is used to launch the Avaya Health Agent application. If you select JVM installed on the local machine, the jre directory is not installed. The selected local JVM is used. Configuration Using the Avaya Health Agent December

14 Installing the Avaya Health Agent Installation kits Two kits are provided for Avaya Health Agent installation: a customizable installation kit and a standard installation kit. Each kit has two versions. The VM version of Avaya Health Agent gives you the option of installing the bundled JVM or using a version already installed on your PC such as JRE or later. If download time (size of the kit) is not a concern, deploy the VM version. If you have an older version of JRE installed and want to keep that version (for example, JRE 1.3.1), you can install the bundled JVM and limit the use of that JVM to Avaya Health Agent. The NoVM version has no bundled JVM, thus the kit is smaller and downloads faster. You must have JRE installed on your PC. Customizable installation kit Customizable VM kit: The customizable VM Avaya Health Agent installation kit is bundled with JRE 1.6.0_01. Launch NhaVm_5_0.exe if there is no correct version of Windows MSI service on the target machine (such as a Windows 98 machine). After you install MSI service, NhaVm_5_0.msi is automatically launched. NhaVm_5_0.msi can be launched directly if there is a correct version of Windows MSI on the machine. It can be customized using tools such as ORCA. See Custom installation on page 15 for more information. Customizable NoVM kit: The customizable NoVM Avaya Health Agent installation kit does not have JRE bundled. Launch NhaNoVm_5_0.exe if there is no correct version of Windows MSI service on the machine. After you install MSI service, NhaNoVm_5_0.msi is automatically launched. Launch NhaNoVm_5_0.msi directly if there is a correct version of Windows MSI on the machine. It can be customized using tools such as ORCA. See Custom installation on page 15 for more information. Standard installation kit Standard VM kit NhaVm_5_0.exe is a single file installer. It installs MSI if it is not on the machine. JRE 1.6.0_01 is included. Standard NoVM kit NhaNoVm_5_0.exe is a single file installer. It installs MSI if it is not on the machine. No JRE is included. 14 Configuration Using the Avaya Health Agent December 2010

15 Command line and silent installation Command line and silent installation Msiexec.exe can be used for installation from the command line. The command line switch / qn is used to indicate a silent install. For silent installation, the reboot dialog box is not necessary as a reboot is performed automatically. The property NN_CVC701PATH can be set as an installation parameter. For example: Msiexec NN_CVC701FORCEREBOOT=1 /I nhaexevm.msi /qn More examples: Msiexec /I nhaexevm.msi /qn Msiexec /I nhaexenovm.msi /qn Other switches include: /I - install /X - uninstall Custom installation Avaya Health Agent installation uses Microsoft Installer, in MSI file format. A number of tools are available to modify the MSI database, such as ORCA. With an MSI installation file, you can customize installation by changing the title, changing the icon, or changing the files to be installed. Here are examples of how to make some of these changes using ORCA: Important: All commands are case sensitive. Modify installation properties Change default JRE Property NN_JREPATH can be used to set the JRE path. If NN_JREPATH is set, the "Select JVM" dialog box is not shown. JVM represented by NN_JREPATH is used. Configuration Using the Avaya Health Agent December

16 Installing the Avaya Health Agent In silent mode, if NN_JREPATH is provided, the corresponding JRE is used. If NN_JREPATH is not provided for a VM kit, the default bundled JRE is installed and used. If NN_JREPATH is not provided for a NoVM kit in silent mode, the installation fails. Change Avaya Health Agent icon The Avaya Health Agent displays an icon in the Windows system tray. The icon indicates Avaya Health Agent status. This icon also appears in the About dialog box of the Avaya Health Agent. To change the icons for the Avaya Health Agent: Modify the MSI files to replace the files under [INSTALLDIR]\resources\*.ico with these icon files. [*] To change the icons for the Avaya Health Agent, use the following naming conventions: icongray.ico: Avaya Health Agent inactive; normally gray iconnormal.ico: Avaya Health Agent user compliant; normally green iconerror.ico: Avaya Health Agent user compliant; normally green with red color X iconactive.ico: Avaya Health Agent system compliant; normally blue iconwarning.ico: Avaya Health Agent system compliant; normally blue with red X Modify Agent.properties The Agent.properties file has settings for how the Avaya Health Agent runs. Administrators can customize it and include it in the custom installation. To change Agent.properties, do the following: Procedure steps 1. Do an installation or extract the Agent.properties from MSI. 2. Modify Agent.properties according to your requirements. 3. Modify MSI file to replace Agent.properties under [INSTALLDIR]\resources with the modified file. [*] Example of modifying Avaya Health Agent MSI installation file Use the following steps to modify the MSI file, replace icon, and property files. The Microsoft SDK tools ORCA and cabarc.exe are used to extract the cab file and rebundle cab files. Here are the sample steps with NhaExeVm.ms: 16 Configuration Using the Avaya Health Agent December 2010

17 Customizing Login dialog box image Procedure steps 1. Open NhaExeVm.msi with ORCA. In the Cabs table, export the cab file that contains the icon files and property file to a file such as mycab.cab. 2. At the command prompt (make sure cabarc.exe is in your path), go to the directory where mycab.cab is saved. 3. Run command: cabarc L mycab.cab > list.txt 4. Modify text file list.txt, so that it only contains a list of file names. It can look like: log4j1.2.3.jar Nortel Health Agent.jar AgentTerminator.exe NHAIconApp.EXE NHAIcon.DLL ProcessInfoWIN.DLL PartnerAPI.DLL NHAIconAppRC.DLL Agent.properties CueAgent_srv.exe CueAgent_app.exe curves.jar1 EccpressoCore.jar2 EccpressoJcae.jar3 license.txt iconerror.ico iconnormal.ico 5. Run command: cabarc X mycab.cab to extract all the files from the cab file. 6. Replace the icon files and Agent.properties file with the files you have customized. Make sure the file names are not changed. 7. Run command: cabarc n 8. In the ORCA Cabs table, import mynewcab.cab. NhaExeVm.msi is now successfully updated with the new files. Customizing Login dialog box image To customize the Login dialog box Image, use the following steps: Procedure steps 1. Create an 100x200 BMP graphic named LoginImage.bmp. 2. Place the graphic in the directory named as %INSTALL_DIR%\resources\. Configuration Using the Avaya Health Agent December

18 Installing the Avaya Health Agent Customizing About dialog box image To customize the About dialog box image, use the following steps: Procedure steps 1. Create an 170x350 BMP graphic named AboutImage.bmp. 2. Place the graphic in the directory named as %INSTALL_DIR%\resources\. Customizing Connection dialog box icon To customize the Connection dialog box icon, use the following steps: Procedure steps 1. To simulate animation you can use up to 10 custom icons using this naming convention (connect0... connect9) ico. You can use up to 10, 48x48 custom icons. 2. Place the graphic in the directory named as %INSTALL_DIR%\resources\. System preferences When you distribute a profile.ini with the install package, you can hide the System Profiles and Global User Profile from the end user by editing the profile.ini manually and adding the following section: [ Preferences ] HideGlobalProfiles=1 HideSystemProfiles=1 Custom install options Currently Avaya Health Agent installs Avaya Health Agent Service as well as Desktop Application to monitor and report SRS Rule failures as one feature. This release separates Avaya Health Agent core functionality from desktop monitoring application. Custom install options provide the end user with two features: Avaya Health Agent Core Desktop Monitor This separation allows the administrator to configure MSI installer to provide customized installer to the end user. Avaya Health Agent Core contains all of the Avaya Health Agent 18 Configuration Using the Avaya Health Agent December 2010

19 Avaya Health Agent system tray icon functionality that includes Avaya Health Agent Service, but excludes the desktop monitoring application. The Desktop Monitor application includes an icon in the system tray and provides pop-ups for failures and menu options. If you are using Avaya Health Agent with SNAS, then you must install the Desktop Monitor component. The custom install options provide the following options to the end user: System tray icon Optional Avaya Health Agent logs No or limited pop-ups Clickable link in the Avaya Health Agent Avaya Health Agent system tray icon When the Avaya Health Agent is running on a system, the Avaya Health Agent icon appears in the system tray in the lower right corner of the window. This icon is used for configuration and failure notification. When you right-click on the Avaya Health Agent icon, the context menu shows these commands: About provides version and copyright information. Re-Check Now immediately rechecks if the system is policy compliant or not. Configure enables a user to configure logging settings. Status displays the Avaya Health Agent log. Manage NSNA Profiles enables a user to configure profiles. Login to NSNA enables a user to log on to NSNA. Avaya Health Agent logs The Avaya Health Agent log file is located in the <installdir> directory. This file contains the same alert information as the status display, as well as some additional information. Avaya Health Agent status log The Avaya Health Agent logs are an optional feature with Windows Installer. By default, logging is enabled for standard install. To view the Avaya Health Agent Status log, right-click the Avaya Health Agent icon in the system tray and select the Status menu option. You can modify the registry settings on the desktop PC to enable or disable Avaya Health Agent logging. To disable logs from being created on the desktop PC, configure DisableLogging to 1, as follows: Configuration Using the Avaya Health Agent December

20 Installing the Avaya Health Agent DisableLogging=1 The DisableLogging registry location is (HKEY_LOCAL_MACHINE\Software\Nortel \TunnelGuard). No or limited pop-up messages The Avaya Health Agent pops up a dialog window whenever there is an SRS check failure, regardless of the policy set on the SNAS for the rule. In some installation scenarios, this feature is not desirable. When SRS check failures are logged, the Detail switch reveals all of the information about rule contents and exactly what is expected on the system in order to be compliant. Some VPN administrators choose to hide some or all of this information from end users. You can hide pop-up messages in the following ways: Install Avaya Health Agent without Desktop Monitor feature. This ensures no pop-up messages are generated on the desktop PC. Install Avaya Health Agent with Installer property DisablePopup configured to 1. This ensures no pop-up messages are generated on the desktop PC, even when Desktop Monitor is installed. This feature works on registry settings on desktop PCs, so you can modify the registry settings to change the behavior. Install Avaya Health Agent with Installer property HideTaskbarIcon configured to 1. This ensures no pop-up messages are generated and no taskbar icon appears in the system tray, even when Desktop Monitor is installed and running on the system. This feature works on registry settings on desktop PCs, so you can modify the registry settings to change the behavior. Clickable link in Avaya Health Agent The Avaya Health Agent presents an error message on desktop PCs whenever an SRS rule fails. This error message is comprised of an SRS rule and an SRS comment. The SRS comment has clickable links that provide rule-specific locations to download information for compliance in cases where the user fails to comply. Any text that begins with or automatically transforms to a clickable link. Recovery from initial check failure Initial Failure Recovery Mode overcomes many situations that make you stay in restricted mode of tunnel for long durations. If the Avaya Health Agent detects SRS FAILURE/ UPDATE on the first check, it goes into Failure Recovery Mode. This mode enables a faster, more frequent SRS compliance checking by the Avaya Health Agent. The Avaya Health Agent 20 Configuration Using the Avaya Health Agent December 2010

21 Avaya Health Agent additional features does not engage the SNAS until there is a change in compliance. Once the system falls into compliance, or the Failure Recovery Mode interval expires, Avaya Health Agent comes out of Failure Recovery Mode. The default failure recovery interval is 10 seconds and is configured using Avaya Health Agent properties. The duration of Failure Recovery Mode is the length of the first intra-interval checking. Avaya Health Agent additional features The Avaya Health Agent supports the following features: Windows 802.1x Supplicant on page 21 Multi-OS Applet Support on page 21 Windows 802.1x Supplicant Integration of SNAS RADIUS server and Avaya Health Agent with MS Windows 802.1x EAP supplicant for user authentication and health assessment. Multi-OS Applet Support The Avaya Health captive portal applet supports Windows and non-windows operating systems. For non-windows operating systems the applet supports collecting operating systems information and VLAN transition. The Multi-OS support allows the Avaya Health Agent to identify Linux operating system or Macintosh operating system users and collect the necessary information. The Avaya Health Agent does not perform additional compliance checks for those operating systems. The following types of Linux operating system are supported: RedHat Enterprise Linux 4 RedHat Enterprise Linux 3 Fedora Core 5 and later SUSE Linux Enterprise 10 The following types of Macintosh operating system are supported: Mac OS X Server v10.5 Leopard Mac OS X Server v10.4 Tiger Mac OS X v10.3 Panther Mac OS X v10.2 Mac OS 9 Configuration Using the Avaya Health Agent December

22 Installing the Avaya Health Agent NAP interoperability Microsoft Network Access Protection (NAP), introduced with Windows Vista and Windows Server is a new set of operating system components that provides a platform for protected access to private networks. The NAP platform provides an integrated way of detecting the health state of a network client, which attempts to connect to a network and restricts the access of the network client until the policy requirements for connecting to the network are met. The NSNA NAP interoperability architecture allows you to deploy both the NSNA solution and the Network Access Protection (NAP) in a symbiotic manner. It also allows you to enforce security policies for network access using NSNA and NAP together, leveraging the strengths of both products. It also deploys the NAP clients with or without a Microsoft NPS server present on your network. If the Microsoft NPS server is available, it is consulted and it's response is used in a configurable way to enhance the access decision made by the NSNAS. If your system does not contain a Microsoft NPS server in place, it can still deploy clients with NAP support enabled and add a Microsoft NPS server later, if desired. 22 Configuration Using the Avaya Health Agent December 2010

23 Chapter 4: Configuring the Avaya Health Agent This chapter provides information about configuring the Avaya Health Agent. Navigation Logging on to NSNA on page 23 Managing profiles on page 24 Settings of Avaya Health Agent on page 32 Viewing the Avaya Health Agent status on page 34 Logging on to NSNA The Avaya Health Agent (AHA) provides the option of single sign-on logon. Every time a user logs on to the network domain the AHA collects the logon credentials of the user. The AHA forwards these logon credentials to the SNAS server as a part of the logon request. Additionally, the user can also log on using the Avaya Health Agent GUI. To log on to NSNA using the Avaya Health Agent, use the following procedure: Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya health Agent icon, and select Login. The Login to NSNA dialog box appears. Configuration Using the Avaya Health Agent December

24 Configuring the Avaya Health Agent 2. Select the profile with which you want to log on or enter the logon credentials. 3. Click Connect. The Avaya Health Agent is connected to SNAS. Variable definition Use the data in the following table to log on. Variable Profile Server Username Password Value Specifies the user profile, which is used to log on to the Avaya Health Agent. Specifies the SNAS domain name. Specifies the user name. Specifies the password. Managing profiles You can create and maintain user profiles and configure them to logon to SNAS. You can also create and maintain system profiles to check for the credentials of the system that connects to SNAS. You can also create, maintain, and configure global profiles. This section contains information about User, System, and Global User profile procedures. Managing profiles navigation Managing user profiles on page 25 Managing system profiles on page 27 Managing global user profiles on page Configuration Using the Avaya Health Agent December 2010

25 Managing profiles Managing user profiles To manage the user profiles, do the following: create a user profile (Creating a user profile on page 25) modify a user profile (Modifying a user profile on page 26) delete a user profile (Deleting a user profile on page 26) Creating a user profile Use the following procedure to create a user profile. Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Manage NSNA Profiles. The Manage Profiles dialog box appears. 2. Select User Profiles. 3. Click New Profile. 4. Enter the user profile details. 5. Click Save Profile. 6. Click Done. Configuration Using the Avaya Health Agent December

26 Configuring the Avaya Health Agent Variable definition Use the data in the following table to create user profile. Variable Profile Name Use Domain User Information Use Profile Defined User Information Username Password Save Password Server Value Specifies the unique name assigned to the user profile. Specifies that AHA will take windows domain username when user log onto the PC. Specifies that the Avaya Health Agent uses the logon credentials that are given for the current profile. Specifies the username. You can specify the Username only when the Profile Defined User Information option is selected. Specifies the password assigned to the user. You can specify the Password only when the Profile Defined User Information and the Save Password options are selected. You can only select the Save Password when the Profile Defined User Information option is selected. Specifies the name of the server. Default Profile Specifies that the current profile is the default profile. Modifying a user profile Use the following procedure to modify a user profile. Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Manage NSNA Profiles. The Manage Profiles dialog box appears. 2. Select User Profiles. 3. Select the profile to be modified. 4. Modify the required details. 5. Click Save Profile. 6. Click Done. Deleting a user profile Use the following procedure to delete a user profile. 26 Configuration Using the Avaya Health Agent December 2010

27 Managing profiles Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Manage NSNA Profiles. The Manage Profiles dialog box appears. 2. Select User Profiles. 3. Select the profile to be deleted. 4. Click Delete Profile. A confirmation dialog box appears. 5. Click OK to delete the user profile. Managing system profiles System profiles allows you to configure a system with different sets of credentials for multiple locations. To configure, specify the server as a hostname rather than an IP address. The DNS server resolves the hostname to a different address. Each system profile has different credentials based on the DNS query result. For example, a DNS server at a Boston office resolves the hostname nsna.example.com as and the DNS server at a Los Angeles office resolves the same hostname as , as shown in the following table. Table 2: SNAS Address SNAS Mask System ID Password Boston PasswordX LosAngeles PasswordY To manage the system profiles, do the following: create a system profile (Creating a system profile on page 27) modify a system profile (Modifying a system profile on page 29) delete a system profile (Deleting a system profile on page 29) Note: If you do not want to use multiple system profiles, specify the SNAS Address and Mask as Creating a system profile Use the following procedure to create a system profile. Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Manage NSNA Profiles. The Manage Profiles dialog box appears. Configuration Using the Avaya Health Agent December

28 Configuring the Avaya Health Agent 2. Select System Profile. 3. Specify the name of the server. 4. Click Add. The Add New System Id dialog box appears. 5. Enter the system profile details. 6. Click OK. 7. Click Save Profile. The system profile is added to the Credentials table. Variable definition Use the information in the following table to create a system profile. Variable SNAS Network Address SNAS Network Mask System ID Value Specifies the network address of SNAS. Specifies the network mask of SNAS. Specifies the system ID. 28 Configuration Using the Avaya Health Agent December 2010

29 Managing profiles Password Variable Specifies the password. Value Modifying a system profile Use the following procedure to modify a system profile. Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Manage NSNA Profiles. The Manage Profiles dialog box appears. 2. Select System Profile. 3. Select the server for which you want to modify the details. 4. Click Modify. The existing credentials appear. 5. Modify the details. 6. Click OK to save the changes. 7. Click Save Profile to save the changes. Deleting a system profile Use the following procedure to delete the system profile. Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Manage NSNA Profiles. The Manage Profiles dialog box appears. 2. Select System Profile. 3. Select the system profile that you want to delete. 4. Click Delete. A confirmation dialog box appears. 5. Click OK. The selected system profile is deleted from the Credentials table. Managing global user profiles To manage the global user profiles, do the following: create a global user profile (Creating a global user profile on page 30) modify a global user profile (Modifying a global user profile on page 31) delete a global user profile (Deleting a global user profile on page 31) Configuration Using the Avaya Health Agent December

30 Configuring the Avaya Health Agent Creating a global user profile Use the following procedure to create a global user profile. Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Manage NSNA Profiles. The Manage Profiles dialog box appears. 2. Click the Global User Profiles tab. 3. Click New Profile. 4. Complete the global user profile details. 5. Click Save Profile. 6. Click Done. Variable definition Use the information in the following table to create a global user profile. Profile Name Variable Use Domain User Information Use Profile Defined User Information Value Specifies the unique name assigned to the user profile. Specifies that the Avaya Health Agent gets the logon credentials from the domain. Specifies that the Avaya Health Agent uses the logon credentials that are given for the current profile. 30 Configuration Using the Avaya Health Agent December 2010

31 Managing profiles Variable Username Password Save Password Server Value Specifies the username. You can specify the Username only when the Profile Defined User Information option is selected. Specifies the password assigned to the user. You can specify the Password only when the Profile Defined User Information and the Save Password options are selected. You can only select the Save Password when the Profile Defined User Information option is selected. Specifies the name of the server. Modifying a global user profile Use the following procedure to modify a global user profile. Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Manage NSNA Profiles. The Manage Profiles dialog box appears. 2. Click the Global User Profiles tab. 3. Select the profile to be modified. 4. Modify the required details. 5. Click Save Profile. 6. Click Done. Deleting a global user profile Use the following procedure to delete a global user profile. Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Manage NSNA Profiles. The Manage Profiles dialog box appears. 2. Click the Global User Profiles tab. 3. Select the profile to be deleted. 4. Click Delete Profile. A confirmation dialog box appears. 5. Click OK to delete the global user profile. Configuration Using the Avaya Health Agent December

32 Configuring the Avaya Health Agent Settings of Avaya Health Agent You can configure the Avaya Health Agent default setting. You can also configure the single sign-on option. Settings of Avaya Health Agent navigation Certificate management on page 32 Configuring the Avaya Health Agent on page 32 Certificate management Avaya Health Agent manages an individual Java based Keystore that is installed as <installdir>/resources/keystore file. You can prepopulate this certificate store by Installing Avaya Health Agent on a system and while attempting a User Session for SNAS. Avaya Health Agent prompts you with Certificate warning and when "Always" option is selected, the certificate is added to the specified keystore. This keystore can be used as a prepopulated keystore and deployed with Avaya Health Agent Installation, using MSI Customization. Alternatively, you can use the certificates that are already installed on your desktop in the MSCAPI Certificate stores. Note: To use MSCAPI Certificates, Avaya Health Agent must be installed with a bundled JRE or with JRE 6 or later. For JRE 6, Avaya Health Agent trusts all the certificates that are present in the ROOT Certificate store on your system. If the Trusted Certificate is not found in the AHA Keystore or MSCAPI ROOT Truststore on the system with JRE 6, System Profiles cannot log on to SNAS. If trusted certificate is not found in any of the truststores, User Profiles prompts the user with a Certificate warning. For Avaya Health Agent with an empty keystore using JRE 5 or earlier and no MSI Customization, you must attempt a User Session to accept SNAS Certificate with the "Always" option, before attempting a system session for the first time. Configuring the Avaya Health Agent Use the following procedure to configure the Avaya Health Agent. 32 Configuration Using the Avaya Health Agent December 2010

33 Settings of Avaya Health Agent navigation Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Configure. The Avaya Health Agent Configuration dialog box appears. 2. Complete the Avaya Health Agent configuration details. 3. Click OK to save the details. Variable definition Use the information in the following table to configure AHA. Variable Default User Profile Enable Single Sign-on Log Tunnel Up and Down Events Number of recent checking logs shown in status dialog Value Specifies the default user profile. Log All Check Results Check to register all checking results on the Avaya Health Agent. Check to enable single sign-on for the Avaya Health Agent. Check to log Avaya Health Agent up and down events. Specifies the total number of checking logs that are displayed in the Avaya Health Agent Status Logs dialog box. Configuration Using the Avaya Health Agent December

34 Configuring the Avaya Health Agent Java Runtime Variable Value Specify the default JRE version for the Avaya Health Agent. Viewing the Avaya Health Agent status This section provides information about viewing the current status of the Avaya Health Agent. You can view the current IP address of the system and the log file details such as number of checking results and Avaya Health Agent events. Use the following procedure to view the Avaya Health Agent status. Procedure steps 1. In the Windows taskbar notification area, right-click the Avaya Health Agent icon, and select Status. The Avaya Health Agent Status Logs dialog box appears. 2. Click the Policy tab, to view the policy details. 3. Click the SNAS Status tab, to view the SNAS status. 4. Click Clear Logs, to clear the logs. 5. Click OK to close the Avaya Health Agent Status Logs dialog box. 34 Configuration Using the Avaya Health Agent December 2010

35 Index C conventions, text...7 customer service...10 D distributor...10 documentation...10 R reseller...10 T text conventions...7 training...10 Configuration Using the Avaya Health Agent December

36 36 Configuration Using the Avaya Health Agent December 2010