Nortel Secure Network Access Switch 4050, 4070 network access switch, Ethernet Routing Switch 8300, 5510, 5520, 5530 User manual
Below you will find brief information for network access switch Secure Network Access Switch 4050, network access switch Secure Network Access Switch 4070, Ethernet Routing Switch Ethernet Routing Switch 8300. This document describes the configuration and management of Nortel Secure Network Access Switch 4050 and 4070. It is a clientless solution that provides seamless, secure access to the corporate network from inside or outside that network. The Nortel SNAS combines multiple hardware devices and software components to support the following features: Partitions the network resources into access zones (authentication, remediation, and full access). Provides continual device integrity checking using Nortel Health Agent. Supports both dynamic and static IP clients.
Advertisement
Advertisement
Nortel Secure Network Access Switch
Configuration — Using BBI
Release: 2.0
Document Revision: 03.02
www.nortel.com
.
NN47230-500
323857-B
.
Nortel Secure Network Access Switch
Release: 2.0
Publication: NN47230-500
Document release date: 24 October 2008
Copyright © 2007, 2008 Nortel Networks
All Rights Reserved.
Sourced in Canada, the United States of America, and India
LEGAL NOTICE
While the information in this document is believed to be accurate and reliable, except as otherwise expressly agreed to in writing NORTEL PROVIDES THIS DOCUMENT "AS IS "WITHOUT WARRANTY OR CONDITION OF
ANY KIND, EITHER EXPRESS OR IMPLIED. The information and/or products described in this document are subject to change without notice.
Nortel, the Nortel logo, and the Globemark are trademarks of Nortel Networks.
All other trademarks are the property of their respective owners.
.
.
Contents
Software license
New in this release
Introduction
Browser-based interface
Basics of the browser-based interface 23
Overview
Elements of the Nortel SNAS 32
Nortel SNAS configuration and management tools 40
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
31
3
9
13
15
21
4
Nortel SNAS configuration roadmap 41
Management of network access devices
Manage network access devices 46
Manage network access devices navigation 46
Adding a network access device 47
Deleting a network access device 49
Configuring the network access devices 49
Controlling communication with the network access devices 59
Configuration of system settings
Configuring the cluster navigation 62
Configuring system settings 62
Configuring a Nortel SNAS host 63
Configuring host interfaces 66
Rebooting or halting a host 70
Configuring the access list 78
Managing date and time settings 80
Configuring administrative settings 94
Configuring SRS control settings 94
Configuring Nortel SNAS host SSH keys 95
Importing an SSH key from a known host 96
Adding an SSH key for a known host 97
Managing RADIUS authentication of system users 98
Configuring auto blacklisting 102
Configuring harden password 108
Configuration of the domain
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
45
61
111
5
Configuring domain parameters 121
Configuring the Nortel Health Agent check 133
Configuring the SSL server 138
Configuring RADIUS accounting 145
Configuration of location navigation 150
Configuring Lumension PatchLink integration 154
Deleting a patch link server 155
Configuring advanced settings 158
Configuration of Microsoft NAP Interoperability
Overview of NAP interoperability 159
Configuring NAP navigation 161
Configuring windows system health validators 161
Creating a remote policy server 164
Creating a system health validator 167
Configuration of RADIUS server
Configuring RADIUS server navigation 172
Creating an authentication method 178
Creating an EAP authentication method 180
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
159
171
6
Configuration of groups and profiles
Overview of groups, profiles, and access rules 189
Overview of groups, profiles, and access rules navigation 189
Nortel Health Agent SRS rule 191
Configuring groups and extended profiles 193
Using Guest Provisioning Wizard 198
Configuring client filters 201
Configuring extended profiles 205
Mapping linksets to a group or profile 208
Configuration of authentication
Configuring authentication 221
Configuring authentication navigation 222
Configuring authentication methods 222
Configuring RADIUS authentication 224
Configuring LDAP authentication 234
Configuring NTLM authentication 247
Configuring SiteMinder authentication 252
Configuring ClearTrust authentication 255
Configuring local database authentication 260
Specifying authentication fallback order 270
Viewing and managing MAC entries 271
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
189
219
.
Configuring RADIUS attributes 273
Management of system users and groups
User rights and group membership 275
Managing system users and groups 276
Managing system users and groups navigation 276
Changing another users password 281
Setting the certificate export passphrase 282
Configuring system credentials 283
Customization of the portal and user logon
Captive portal and Exclude List 286
Managing the end user experience 294
Customize the portal and logon 295
Customize the portal and logon navigation 295
Configuration of the captive portal 296
Configuration of the captive portal 300
Changing the portal language 303
Exporting or importing cluster configuration 307
Configuring the portal display 309
Changing the portal colors 314
Configuring custom content 316
Configuration of Nortel SNAS scheduler
Configuring the scheduler task 327
Viewing or searching a scheduled task 332
Configuration of SNMP
Configuring SNMP settings navigation 333
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
7
275
285
327
333
8
Configuring SSCP-Lite navigation 348
Management of certificates
Key and certificate formats 354
Installing certificates and keys 355
Saving or exporting certificates and keys 355
Management of private keys and certificates 357
Management of private keys and certificates navigation 357
Generating and submitting a CSR 359
Importing a certificate or key 363
Displaying or saving a certificate and key 365
Exporting a certificate and key from the Nortel SNAS 366
Viewing certificate information 368
Importing a revocation list 369
View system information and performance statistics
Monitor system information and performance statistics 371
Viewing cluster information 372
Viewing authentication statistics 378
Viewing IP or MAC session information 385
Viewing group session information 387
Importing or exporting switch templates 389
Maintenance and management of the system
Manage and maintain the system 395
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
353
371
395
.
.
Software license
This section contains the Nortel Networks software license.
Nortel Networks software license agreement
This Software License Agreement ("License Agreement") is between you, the end-user ("Customer") and Nortel Networks Corporation and its subsidiaries and affiliates ("Nortel Networks"). PLEASE READ THE
FOLLOWING CAREFULLY. YOU MUST ACCEPT THESE LICENSE
TERMS IN ORDER TO DOWNLOAD AND/OR USE THE SOFTWARE.
USE OF THE SOFTWARE CONSTITUTES YOUR ACCEPTANCE OF
THIS LICENSE AGREEMENT. If you do not accept these terms and conditions, return the Software, unused and in the original shipping container, within 30 days of purchase to obtain a credit for the full purchase price.
"Software" is owned or licensed by Nortel Networks, its parent or one of its subsidiaries or affiliates, and is copyrighted and licensed, not sold.
Software consists of machine-readable instructions, its components, data, audio-visual content (such as images, text, recordings or pictures) and related licensed materials including all whole or partial copies. Nortel
Networks grants you a license to use the Software only in the country where you acquired the Software. You obtain no rights other than those granted to you under this License Agreement. You are responsible for the selection of the Software and for the installation of, use of, and results obtained from the Software.
1.
Licensed Use of Software. Nortel Networks grants Customer a nonexclusive license to use a copy of the Software on only one machine at any one time or to the extent of the activation or authorized usage level, whichever is applicable. To the extent Software is furnished for use with designated hardware or Customer furnished equipment ("CFE"), Customer is granted a nonexclusive license to use Software only on such hardware or CFE, as applicable. Software contains trade secrets and Customer agrees to treat Software as confidential information using the same care and discretion Customer uses with its own similar information that it does not wish to disclose, publish or disseminate. Customer will ensure that anyone who
9
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
10
Software license uses the Software does so only in compliance with the terms of this
Agreement. Customer shall not a) use, copy, modify, transfer or distribute the Software except as expressly authorized; b) reverse assemble, reverse compile, reverse engineer or otherwise translate the
Software; c) create derivative works or modifications unless expressly authorized; or d) sublicense, rent or lease the Software. Licensors of intellectual property to Nortel Networks are beneficiaries of this provision. Upon termination or breach of the license by Customer or in the event designated hardware or CFE is no longer in use, Customer will promptly return the Software to Nortel Networks or certify its destruction. Nortel Networks may audit by remote polling or other reasonable means to determine Customer’s Software activation or usage levels. If suppliers of third party software included in Software require Nortel Networks to include additional or different terms,
Customer agrees to abide by such terms provided by Nortel Networks with respect to such third party software.
2.
Warranty. Except as may be otherwise expressly agreed to in writing between Nortel Networks and Customer, Software is provided
"AS IS" without any warranties (conditions) of any kind. NORTEL
NETWORKS DISCLAIMS ALL WARRANTIES (CONDITIONS)
FOR THE SOFTWARE, EITHER EXPRESS OR IMPLIED,
INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
AND ANY WARRANTY OF NON-INFRINGEMENT. Nortel Networks is not obligated to provide support of any kind for the Software. Some jurisdictions do not allow exclusion of implied warranties, and, in such event, the above exclusions may not apply.
3.
Limitation of Remedies. IN NO EVENT SHALL NORTEL
NETWORKS OR ITS AGENTS OR SUPPLIERS BE LIABLE FOR ANY
OF THE FOLLOWING: a) DAMAGES BASED ON ANY THIRD PARTY
CLAIM; b) LOSS OF, OR DAMAGE TO, CUSTOMER’S RECORDS,
FILES OR DATA; OR c) DIRECT, INDIRECT, SPECIAL, INCIDENTAL,
PUNITIVE, OR CONSEQUENTIAL DAMAGES (INCLUDING LOST
PROFITS OR SAVINGS), WHETHER IN CONTRACT, TORT OR
OTHERWISE (INCLUDING NEGLIGENCE) ARISING OUT OF
YOUR USE OF THE SOFTWARE, EVEN IF NORTEL NETWORKS,
ITS AGENTS OR SUPPLIERS HAVE BEEN ADVISED OF THEIR
POSSIBILITY. The foregoing limitations of remedies also apply to any developer and/or supplier of the Software. Such developer and/or supplier is an intended beneficiary of this Section. Some jurisdictions do not allow these limitations or exclusions and, in such event, they may not apply.
4.
General
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Nortel Networks software license agreement
11
a.
If Customer is the United States Government, the following paragraph shall apply: All Nortel Networks Software available under this License Agreement is commercial computer software and commercial computer software documentation and, in the event Software is licensed for or on behalf of the United States
Government, the respective rights to the software and software documentation are governed by Nortel Networks standard commercial license in accordance with U.S. Federal Regulations at 48 C.F.R. Sections 12.212 (for non-DoD entities) and 48 C.F.R.
227.7202 (for DoD entities).
b.
Customer may terminate the license at any time. Nortel Networks may terminate the license if Customer fails to comply with the terms and conditions of this license. In either event, upon termination,
Customer must either return the Software to Nortel Networks or certify its destruction.
c.
Customer is responsible for payment of any taxes, including personal property taxes, resulting from Customer’s use of the
Software. Customer agrees to comply with all applicable laws including all applicable export and import laws and regulations.
d.
Neither party may bring an action, regardless of form, more than two years after the cause of the action arose.
e.
The terms and conditions of this License Agreement form the complete and exclusive agreement between Customer and Nortel
Networks.
f.
This License Agreement is governed by the laws of the country in which Customer acquires the Software. If the Software is acquired in the United States, then this License Agreement is governed by the laws of the state of New York.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
12
Software license
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
New in this release
The following sections detail what’s new in Nortel Secure Network Access
Switch Configuration — Using the BBI () (NN47230-500) for Release 2.0.
•
•
13
Features
This is the second standard release of the document. See the following sections for information, which are added in this Release.
•
“Configuring auto blacklisting” (page 102)
•
“Nortel SNAS TPS Interface” (page 107)
•
“Configuring harden password” (page 108)
•
“Redistributing switches” (page 110)
•
“Configuration of location” (page 150)
•
“Configuring Lumension PatchLink integration” (page 154)
•
“Configuration of Microsoft NAP Interoperability” (page 159)
•
“Configuration of RADIUS server” (page 171)
•
“802.1x functionality” (page 171)
•
“Using Guest Provisioning Wizard” (page 198)
•
“Self Service Portal ” (page 291)
•
“Configuration of Nortel SNAS scheduler” (page 327)
•
“Configuring SSCP-Lite” (page 347)
•
•
“Viewing the connected client list” (page 375)
•
“Viewing IP or MAC session information” (page 385)
•
“Viewing group session information” (page 387)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
14
New in this release
•
•
•
“Viewing log browser statistics” (page 402)
On-the-fly SRS Policy Change—When a security policy is modified on the SNAS using the administrative tool the policy is updated on the
Nortel Health Agent running on the logged in operating systems. For more
information, See the “Configuring the Nortel Health Agent check” (page
.
Multi-OS Applet Support—The Nortel Health captive portal applet supports Windows and non-Windows operating systems. For non-Windows operating systems the applet supports collecting operating systems information and VLAN transition.
Other changes
Access Control List Id Parameter's explanationenhanced to reflect the changes for CR Q01941018.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Introduction
Nortel Secure Network Access Solution (Nortel SNAS) is a clientless solution that provides seamless, secure access to the corporate network from inside or outside that network. The Nortel SNAS combines multiple hardware devices and software components to support the following features:
• partitions the network resources into access zones (authentication, remediation, and full access)
• provides continual device integrity checking using Nortel Health Agent
• supports both dynamic and static IP clients
The Nortel Secure Network Access Switch 4050 or 4070 (Nortel SNAS
4050 or 4070) controls operation of the Nortel SNAS.
This guide covers the process of implementing the Nortel SNAS using the Nortel SNAS 4050 or 4070 for Nortel Secure Network Access Switch
Software Release 2.0. The document includes the following information about:
• the overall role of the Nortel SNAS in the Nortel SNAS
• configuring authentication, authorization, and accounting (AAA) features
• managing system users
• customizing the portal
• upgrading the software
• logging and monitoring
The document provides instructions for initializing and customizing browser-based interface (BBI).
The BBI is a graphical user interface (GUI) that runs in an online, interactive mode. You can use BBI to manage only one SNAS device on each browser session.
15
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
16
Introduction
Prerequisites
This guide is intended for network administrators who have the following background:
• basic knowledge of networks, Ethernet bridging, and IP routing
• familiarity with networking concepts and terminology
• experience with windowing systems or GUIs
• basic knowledge of network topologies
Before using this guide, you must complete the following procedure for a new switch:
Procedure steps
Step Action
1
2
Install the switch.
For installation instructions, see Nortel Secure Network Access
Switch 4050 Installation Guide () (NN47230-300).
Connect the switch to the network.
For more information, see Nortel Secure Network Access Switch
Using the Command Line Interface () (NN47230-100).
--End--
Text conventions
This guide uses the following text conventions: angle brackets (< >)
Enter text based on the description inside the brackets. Do not type the brackets when entering the command.
bold text
Example: If the command syntax is
ping <ip_address>
, enter:
ping 192.32.10.12
Objects such as window names, dialog box names, and icons, as well as user interface objects such as buttons, tabs, and menu items.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
bold Courier text
braces ({}) brackets ([ ]) ellipsis points (. . .)
italic text
plain Courier text
Text conventions
17
Command names, options, and text that you must enter.
Example: Use the
dinfo
command.
Example: Enter
show ip {alerts|routes}
.
Required elements in syntax descriptions where more than one option exists. You must choose only one of the options. Do not type the braces when you enter the command.
Example: If the command syntax is
show ip {alerts|routes}
, you must enter either
show ip alerts
or
show ip routes
, but not both.
Optional elements in syntax descriptions. Do not type the brackets when you enter the command.
Example: If the command syntax is
show ip interfaces [-alerts]
, you can enter either
show ip interfaces
or
show ip interfaces -alerts
.
Repeat the last element of the command as needed.
Example: If the command syntax is
ethernet/2/1 [ <parameter> <value> ]...
, you enter
ethernet/2/1
and as many parameter-value pairs as needed.
Variables in command syntax descriptions. Italics also indicate new terms and book titles. Where a variable is two or more words, the words are connected by an underscore.
Example: If the command syntax is
show at <valid_route>
,
valid_route
is one variable, and you substitute one value for it.
Command syntax and system output, for example, prompts and system messages.
Example:
Set Trap Monitor Filters
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
18
Introduction separator ( > ) vertical line ( | )
Menu paths.
Example: Protocols > IP identifies the IP command on the Protocols menu.
Options for command keywords and arguments.
Enter only one of the options. Do not type the vertical line when you enter the command.
Example: If the command syntax is
show ip {alerts|routes}
, you enter either
show ip alerts
or
show ip routes
, but not both.
Related information
This section lists information sources that relate to this document.
Publications
For information on the Nortel SNAS, see the following publications:
•
Nortel Secure Network Access Switch 2.0 Solution Guide ()
(NN47230-200)
•
Nortel Secure Network Access Switch 4050 Installation Guide ()
(NN47230-300)
•
Nortel Secure Network Access Switch Using the Command Line
Interface () (NN47230-100)
•
Installing and Using the Security and Routing Element Manager ()
(NN47230-301)
•
Release Notes for Nortel Ethernet Routing Switch 5500 Series,
Software Release 5.0.1
•
Release Notes for the Ethernet Routing Switch 8300, Software
Release 2.2.8
•
Nortel Secure Network Access Switch Release Notes — Software
Release 2.0 () (NN47230-400)
•
Release Notes for Enterprise Switch Manager, Software Release 5.2
•
Using Enterprise Switch Manager Release 5.1 ()
Online
To access Nortel technical documentation online, go to the Nortel Web site: www.nortel.com/support
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Acronyms
19
You can download current versions of technical documentation. To locate documents, browse by category or search using the product name or number.
You can print technical manuals and release notes for free of cost directly from the Internet. Use Adobe* Reader* to open the manuals and release notes, search for the sections you need, and print them on most standard printers. Go to the Adobe Systems site at www.adobe.com
to download a free copy of Adobe Reader.
How to get help
If you purchased a service contract for your Nortel product from a distributor or authorized reseller, contact the technical support staff for that distributor or reseller for assistance.
If you purchased a Nortel service program, use the www.nortel.com/help Web page to locate information to contact Nortel for assistance:
•
To obtain Nortel Technical Support contact information, click the
CONTACT US link on the left side of the page.
•
To call a Nortel Technical Solutions Center for assistance, click the
CALL US link on the left side of the page to find the telephone number for your region.
An Express Routing Code (ERC) is available for many Nortel products and services. When you use an ERC, your call is routed to a technical support person who specializes in supporting that product or service. To locate the ERC for your product or service, go to the www.nortel.com/help Web page and follow these links:
Procedure steps
Step
1
2
3
Action
On the left side of the HELP Web page, click CONTACT US.
On the CONTACT US Web page, click Technical Support.
On the TECHNICAL SUPPORT Web page, click Express
Routing Codes.
--End--
Acronyms
This guide uses the following acronyms:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
20
Introduction
BBI
CLI
DHCP
TCP
UDP
SSL
TLS
EPM
SREM
RSA
DLLs
USM
AAA
MIP
NAP
FTP
GUI
SSH
FTP
TFTP
SFTP
SCP
SSCP
VLAN
SRS
LDAP
NHA
SNAS
Browser-Based Interface
Command Line Interface
File Transfer Protocol
Graphical User Interface
Secure Shell
File Transfer Protocol
Trivial File Transfer Protocol
Secure File Transfer Protocol
Switch to SNAS Communication Protocol
Virtual Local Area Network
Software Requirement Set
Lightweight Directory Access Protocol
Nortel Health Agent
Secure Networks Access Switch
Dynamic Host Configuration Protocol
Transmission Control Protocol
User Datagram Protocol
Secure Sockets Layer
Transport Layer Security
Enterprise Policy Manager
Security & Routing Element Manager
Dynamic Link Libraries
Authentication, Authorization and Accounting
Management IP address
Network Access Protection
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Browser-based interface
This chapter provides a general introduction to the browser-based interface (BBI), including global commands, general site navigation, and online help.
Navigation
•
•
•
“Basics of the browser-based interface” (page 23)
21
Web browser setup
After you configure your system for Web access, you can connect to the
BBI through a properly configured Web browser. To display the BBI, you must configure the browser to work with frames and JavaScript. Both the
Netscape and Internet Explorer browsers that are verified to work with the
BBI, are default-configured to work with frames and JavaScript, and they require no additional setup. However, check the features and configuration of your Web browser to make sure frames and JavaScript are enabled.
Starting the BBI
After you complete the necessary setup procedures, use the following procedure to launch the BBI:
1
2
Procedure steps
Step Action
3
Start your Web browser.
For https connections, enter https://(host IP:port number) in the browser URL field.
Log on to the BBI.
The Logon page is displayed.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
22
Browser-based interface
4
5
Enter the user ID and password.
Click Login or press Enter.
The Wizards screen appears in your browser’s viewing area.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Basics of the browser-based interface
23
GUI lock
The GUI lock warning message displayed at the top of the screen is only displayed immediately after logon. If you switch to another BBI screen without clicking the GUI lock, the message disappears.
On the GUI Lock page, you can lock the current BBIsessions by clicking
Lock. This step ensures that you own the BBI session and nobody else can make changes to the Secure Networks Access Controller through the
BBI. The padlock symbol at the top right changes from blue to green.
To provide a message to other administrators who log on to the BBI while it is locked by you, enter a message in the User Message field. For these users, the padlock symbol is red.
To lock or unlock, click Take The Lock/Release The Lock.
ATTENTION
Another operator can make changes by using the CLI even if the GUI lock is activated.
Basics of the browser-based interface
The following sections provide a general introduction to the navigation pane of the BBI.
System tree view
The system tree view consists of items (Cluster, Secure Access Domain, and so on) that represent the main categories for viewing information and configuring the system. By expanding an item, new items for the category available forms are displayed. You can expand several items at the same time, which gives you a good overview when configuring the system.
Setup wizards
You can setup wizards to create, customize, and launch a working portal in a few steps.
•
Portal Linkset Wizard—The Portal Linkset wizard helps you to create a portal link group, such as a set of hypertext links that you can access from the home tab of the portal.
•
Nortel Health Agent Wizard—The Nortel Health Agent wizard helps you to enable Nortel Health Agent and to configure global Nortel Health
Agent settings for the selected domain.
•
Authentication Wizard—The Authentication wizard helps you to create different types of authentication servers.
•
Domain Wizard—The Domain wizard helps you to create secure access domains.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
24
Browser-based interface
•
DHCP Wizard—The DHCP wizard helps you to configure the local
DHCP services.
•
Switch Wizard—The Switch wizard helps you to configure a switch.
•
User Group Wizard—The User Group wizard helps you to configure user access groups for mobile users.
•
Guest Provisioning Wizard—The Guest Provisioning wizard helps you to configure guest users.
Basic operation
You can administer the Secure Network Access Controller software using the BBI in the following manner. To access the full functionality of the BBI, you must log on as administrator:
•
Select from a series of pages and sub-pages and modify fields to create the desired configuration.
•
When you finish making changes on any given page, submit the form using the appropriate Update buttons. If you select a new screen or end the session without submitting the information, the changes are lost. Most submitted changes are considered pending and are not immediately put into effect or permanently saved. Only a few types of changes take effect as soon as the form is submitted, such as changes to users and passwords.
•
Use the global Apply screen to save changes and to make them take effect. The administrator can use the Apply screen to make an entire series of updates on multiple screens and then put them into effect all at once.
•
Use the global Diff screen to view pending changes before they are applied.
•
Use the global Revert screen to clear all pending changes, and then continue the configuration session or use the global Logout screen to exit from the system. Logging out manually is preferred, though closing your browser manually or through inactivity (browser sessions automatically close after five minutes of inactivity) also discards pending changes.
ATTENTION
When multiple CLI or BBI administrator sessions are open at the same time, only the pending changes made during your current session are affected by the Diff, Revert, or Logout commands. However, if multiple CLI or BBI administrators apply changes to the same set of parameters concurrently, the latest applied changes take precedence.
If the BBI is locked, another operator cannot make any change using the BBI.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Basics of the browser-based interface
25
Global commands
The global command links are always available at the top of each screen.
The
Figure 1 "Global Command Links screen" (page 25)
shows the global command links.
Figure 1
Global Command Links screen
These links summon pages that are used for logging out, saving, examining, or aborting configuration changes, and for displaying help information. Each global command page provides options to verify or cancel the command as appropriate.
Apply
The global Apply command is used for checking the validity of the current pending configuration changes and for saving the configuration changes and putting them into effect.
The
Figure 2 "Apply Pending Configuration Changes screen" (page
shows the changes that are applied.
Figure 2
Apply Pending Configuration Changes screen
The Apply Pending Configuration Changes screen includes the following items:
•
Apply Changes button—applies the pending changes
•
Back button—returns the previously viewed screen
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
26
Browser-based interface
CAUTION
The global Revert command clears pending changes. It cannot be used to restore the old configuration after the Apply Changes command is issued.
Diff
The global Diff command provides a list of the current pending configuration changes.
The
Figure 3 "Pending Configuration Changes screen" (page 26)
shows the changes that are remaining to save.
Figure 3
Pending Configuration Changes screen
The list of the pending configuration changes of current session displays a change record for each submitted update. Each record can include many modifications, depending upon the complexity of the screens, and the changes submitted. Modifications are color coded:
•
Green: New items that are added to the configuration when the global
Apply command is given and verified.
•
Blue: Existing items that are modified when the global Apply command is given and verified.
•
Red: Configuration items that are deleted when the global Apply command is given and verified.
The Diff list is cleared when configuration changes are applied or reverted, or when the administrator logs out or closes the browser window.
The Diff command does not include pending changes made in other open
CLI or BBI sessions.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Basics of the browser-based interface
27
Revert
The global Revert command is used to cancel pending configuration changes.
The
Figure 4 "Remove Pending Configuration Changes screen" (page
shows the changes that needs to be reverted.
Figure 4
Remove Pending Configuration Changes screen
This command includes the following items:
•
Revert button: This button cancels the pending configuration changes.
Applied changes are not affected. Pending changes made in other open CLI or BBI sessions are not affected.
•
Back button: This button returns the previously viewed form without canceling pending changes.
Logout
The global Logout command is used to terminate the current user session.
The
Figure 5 "Logout screen" (page 28)
shows the Logout screen.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
28
Browser-based interface
Figure 5
Logout screen
The Logout screen includes the following items:
•
Logout button: This button terminates the current user session. Any configuration changes made during this session that are not applied are lost. This command has no effect on pending changes in other open CLI or BBI sessions.
•
Back button: This button returns to the previously viewed screen without logging out.
CAUTION
For security reasons, close all BBI windows (including Help) after logging out.
Help
The global Help command provides assistance with screens in the BBI.
The help is context sensitive, which means that the help page displays detailed information about the screen that is presently displayed.
When you click the Help button, a new window appears with information appropriate to the current option.
The
Figure 6 "Help screen" (page 29)
shows the Help screen.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Figure 6
Help screen
Basics of the browser-based interface
29
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
30
Browser-based interface
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Overview
This chapter provides a general introduction to the Nortel Secure Network
Access Solution (Nortel SNAS).
Navigation
•
•
“Nortel SNAS configuration and management tools” (page 40)
•
“Nortel SNAS configuration roadmap” (page 41)
31
The Nortel SNAS
Nortel Secure Network Access Solution (Nortel SNAS) is a protective framework to completely secure the network from endpoint vulnerability.
The Nortel SNAS addresses endpoint security and enforces policy compliance. Nortel SNAS delivers endpoint security by enabling only trusted, role-based access privileges premised on the security level of the device, user identity, and session context. Nortel SNAS enforces policy compliance, such as for Sarbanes-Oxley and COBIT, to ensure that the required anti-virus applications or software patches are installed before users are granted network access.
For Nortel, success means delivering technologies that provide secure access to your information using security-compliant systems. Your success is measured by increased employee productivity and lower network operations costs. Nortel’s solutions provide your organization with the network intelligence required for success.
This section provides an overview of the Nortel SNAS:
The Nortel SNAS navigation
•
“Elements of the Nortel SNAS” (page 32)
•
“Supported software” (page 32)
•
“Role of the Nortel SNAS” (page 33)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
32
Overview
•
“Nortel SNAS clusters” (page 38)
•
“Interface configuration” (page 39)
Elements of the Nortel SNAS
ATTENTION
References to the acronym SSCP are made throughout this document. SSCP stands for Switch-SNAS Communication Protocol. This is the protocol used for communication between the Nortel SNAS and the various network access devices used in the overall solution.
The following devices are essential elements of the Nortel SNAS:
•
Nortel Secure Network Access Switch 4050 or 4070 (Nortel SNAS
4050 or 4070), which acts as the Policy Decision Point
• network access device, which acts as the Policy Enforcement Point:
—
Ethernet Routing Switch 8300
—
Ethernet Routing Switch 5510, 5520, or 5530
•
DHCP and DNS servers
The following devices are additional, optional elements of the Nortel
SNAS:
• remediation server
• corporate authentication services such as LDAP or RADIUS services
Each Nortel SNAS device can support up to five network access devices.
Supported software
The Nortel SNAS supports the following types of software:
•
PCs using the following operating systems:
—
Windows 2000 SP4
—
Windows XP SP2
—
MacIntosh
—
Linux
The Nortel SNAS supports the following browsers:
—
Internet Explorer version 6.0 or later
—
Netscape Navigator version 7.3 or later
—
Mozilla Firefox version 1.0.6 or later
Java Runtime Environment (JRE) for all browsers:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
The Nortel SNAS
33
—
JRE 1.5.0_04 or later
•
VoIP phones
—
Nortel IP Phone 2002
—
Nortel IP Phone 2004
—
Nortel IP Phone 2007
For the minimum firmware versions required for the IP Phones operating with different call servers, See Nortel Secure Network
Access Switch Release Notes — Software Release 2.0 () .
Each Nortel SNAS-enabled port on a network access devicecan support one PC (untagged traffic) and one IP Phone (tagged traffic). Softphone traffic is considered to be the same as PC traffic (untagged).
ATTENTION
Where there is both an IP Phone and a PC, the PC must be connected through the 3-port switch on the IP Phone.
Role of the Nortel SNAS
The Nortel SNAS helps to protect the network by ensuring endpoint compliance for devices that connect to the network.
Before allowing a device to have full network access, the Nortel SNAS checks user credentials and host integrity against predefined corporate policy criteria. Through tight integration with network access devices, the
Nortel SNAS can:
• dynamically move the user into a quarantine VLAN
• dynamically grant the user full or limited network access
• dynamically apply per port firewall rules that apply to a device connection
After a device is granted network access, the Nortel SNAS continually monitors the health status of the device to ensure continued compliance. If a device falls out of compliance, the Nortel SNAS can dynamically move the device into a quarantine or remediation VLAN.
Nortel SNAS functions
The Nortel SNAS performs the following functions:
•
Acts as a Web server portal, which is accessed by users in clientless mode for authentication and host integrity check, and which sends
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
34
Overview
.
remediation instructions and guidelines to endpoint clients if they fail the host integrity check.
•
Communicates with backend authentication servers to identify authorized users and levels of access.
•
Acts as a policy server, which communicates with the Nortel Health
Policy Administrator that verifies host integrity.
•
Instructs the network access device to move clients to the appropriate
VLAN and, if applicable, to apply additional filters.
•
Functions potentially as a DNS proxy in the Red VLAN when the Nortel
SNAS functions as a captive portal.
•
Acts as a DHCP server.
•
Performs session management.
•
Monitors the health of clients and switches.
•
Performs logging and auditing functions.
•
Provides High Availability (HA) through IPmig protocol.
Nortel SNAS VLANs and filters
There are four types of Layer 2 or Layer 3 VLANs in a Nortel SNAS network:
•
Red—extremely restricted access. If the default filters are used, the user can communicate only with the Nortel SNAS and the Windows domain controller network. There is one Red VLAN for each network access device.
•
Yellow—restricted access for remediation purposes if the client PC fails the host integrity check. Depending on the filters and Nortel Health
Agent rules configured for the network, the client can be directed to a remediation server participating in the Yellow VLAN. There can be up to five Yellow VLANs for each network access device. Each user group is associated with only one Yellow VLAN.
•
Green—full access, in accordance with the user’s access privileges.
There can be up to five Green VLANs for each network access device.
•
System Green—it is used by the Nortel Desktop Agent.
•
VoIP—automatic access for VoIP traffic. The network access device places VoIP calls in a VoIP VLAN without submitting them to the Nortel
SNAS authentication and authorization process.
When a client attempts to connect to the network, the network access device places the client in its Red VLAN. The Nortel SNAS authenticates the client and then downloads a Nortel Health Policy Administrator to
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
The Nortel SNAS
35
check the integrity of the client host. If the integrity check fails, the Nortel
SNAS instructs the network access device to move the client to a Yellow
VLAN, with the associated filter. If the integrity check succeeds, the Nortel
SNAS instructs the network access device to move the client to a Green
VLAN, with the associated filter. The network access device applies the filters when it changes the port membership.
The VoIP filters allow IP Phone traffic into one of the preconfigured VoIP
VLANs for VoIP communication only.
You can modify the default filters to accommodate network requirements, such as Quality of Service (QoS) or specific workstation boot processes and network communications.
For information about configuring VLANs and filters on the network access device, see Release Notes for Nortel Ethernet Routing Switch 5500 Series,
Software Release 5.0.1 () or Release Notes for the Ethernet Routing
Switch 8300, Software Release 2.2.8.
Groups and profiles
Users are organized in groups. Group membership determines:
• user access rights
Within the group, extended profiles further refine access rights, depending on the outcome of the Nortel Health Agent checks.
• number of sessions allowed
• the Nortel Health Agent Software Requirement Set (SRS) rule to be applied
• what displays on the portal page after the user is authenticated
For information about configuring groups and extended profiles on the
Nortel SNAS, see
“Configuration of groups and profiles” (page 189) .
Authentication methods
You can configure more than one authentication method within a Nortel
SNAS domain. Nortel Secure Network Access Switch Software Release
1.6.1 supports the following authentication methods:
• external: database
—
Remote Authentication Dial-In User Service (RADIUS)
—
Lightweight Directory Access Protocol (LDAP)
The Nortel SNAS authenticates the user by sending a query to an external RADIUS or LDAP server. This makes it possible to use authentication databases that already exist within the intranet. The
Nortel SNAS device includes username and password in the query and
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
36
Overview requires the name of one or more access groups in return. You can configure the name of the RADIUS and LDAP access group attribute.
• local database
The Nortel SNAS itself can store up to 1000 user authentication entries, each defining a username, password, and relevant access group. You can populate the database by manually adding entries on the Nortel SNAS, or you can import a database from a
TFTP/FTP/SCP/SFTP server.
Use the local authentication method if no external authentication databases exist: for testing purposes, for speedy deployment, or as a fallback for external database queries. You can also use the local database for authorization only, if an external server provides authentication services but cannot be configured to return a list of authorized groups.
For information about configuring authentication on the Nortel SNAS, see
“Configuration of authentication” (page 219)
. For more information about the Nortel SNAS and the way the Nortel SNAS controls network access, see Nortel Secure Network Access Switch 2.0 Solution Guide ()
(NN47230-200).
Nortel Health Agent host integrity check
The Nortel Health Agent application checks client host integrity by verifying that the components you specify are required for the firewall (executables,
DLLs, configuration files, and so on) and are installed and active on the client PC. You can specify the required component entities and engineering rules by configuring a software requirement set (SRS) rule and then mapping the rule to a user group.
After a client is authenticated, the Nortel SNAS downloads a Nortel
Health Agent as an applet to the client PC. The Nortel Health Policy
Administrator fetches the SRS rule that is applicable for the group to which the authenticated user belongs so that Nortel Health Agent can perform the appropriate host integrity check. The Nortel Health Policy Administrator reports the result of the host integrity check to the Nortel SNAS.
If the required components are present on the client system, Nortel Health
Agent reports that the SRS rule check succeeded. The Nortel SNAS then instructs the network access device to permit access to intranet resources in accordance with the access privileges of the user group. The Nortel
SNAS also requests the Nortel Health Policy Administrator to redo a DHCP request in order to renew the DHCP lease of the client with the network access device.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
The Nortel SNAS
37
If the required components are not present on the client system, Nortel
Health Agent reports that the SRS rule check failed. You can configure behavior following a host integrity check failure: the session can be torn down, or the Nortel SNAS can instruct the network access device to grant the client restricted access to the network for remediation purposes.
The Nortel Health Policy Administrator repeats the host integrity check periodically throughout the client session. If the check fails at any time, the client is either evicted or quarantined, depending on the behavior you configure. You can configure the recheck interval.
For information about configuring the Nortel Health Agent host integrity check, see
“Configuring the Nortel Health Agent check” (page 133) . For
information about configuring the SRS rules, see Nortel Health Policy
Administrator SRS Builder. For information about mapping an SRS rule to a group, see
“Configuring groups” (page 194) .
Communication channels
Communications between the Nortel SNAS and key elements of the
Nortel SNAS are secure and encrypted. The following table shows the communication channels in the network.
Table 1
Communication channels in the Nortel SNAS network
Communication Communication protocol
Between Nortel SNAS and edge switches SSH
Between Nortel SNAS devices in a cluster TCP and UDP
Between Nortel SNAS and client PC
(Nortel Health Policy Administrator)
SSL/TLS
Between Nortel SNAS and BBI
From edge switch to EPM
From EPM to edge switch
SSH
SNMPv3 Inform
Telnet over SSH
From authorized endpoint to DHCP server UDP
You can use telnet or SSH to manage communications between remote
PCs and the Nortel SNAS devices.
About SSH
The Secure Shell (SSH) protocol provides secure and encrypted communication between the Nortel SNAS and the network access devices, and between Nortel SNAS devices and remote management PCs not using Telnet.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
38
Overview
The SSH uses either password authentication or public key authentication.
With public key authentication, pairs of public/private SSH host keys protect against man in the middle attacks by providing a mechanism for the SSH client to authenticate the server. SSH clients keep track of the public keys used to authenticate different SSH server hosts.
The SSH clients in the Nortel SNAS network do not silently accept new keys from previously unknown server hosts. Instead, they refuse the connection if the key does not match their known hosts.
The Nortel SNAS supports the use of three different SSH host key types:
•
RSA1
•
RSA
•
DSA
ATTENTION
SSH protocol version 1 always uses RSA1 keys. SSH protocol version 2 uses either RSA or DSA keys.
For management communications in the Nortel SNAS, the Nortel SNAS can act both as SSH server (when a user connects to the CLI using an
SSH client) and as SSH client (when the Nortel SNAS initiates file or data transfers by using the SCP or SFTP protocols).
For information about managing SSH keys for communication between the Nortel SNAS and the network access devices, see
.
For information about managing SSH keys for Nortel SNAS management communications, see
“Configuring Nortel SNAS host SSH keys” (page 95) .
Nortel SNAS clusters
For Release 1.6.1
A cluster is a group of Nortel SNAS 4050 devices that share the same configuration parameters. Nortel Secure Network Access Switch Software
Release 1.6.1 supports four Nortel SNAS 4050 devices, or nodes, in a cluster. A network can contain multiple clusters.
For Release 2.0
A cluster is a group of Nortel SNAS 4050 or 4070 devices that share the same configuration parameters. Nortel Secure Network Access Switch
Software Release 2.0 supports a combination of four Nortel SNAS 4050 and 4070 devices, or nodes, in a cluster. A Nortel SNAS network can contain multiple clusters.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
The Nortel SNAS
39
Clustering offers the following benefits:
• manageability—The cluster is a single, seamless unit that automatically pushes configuration changes to its members.
• scalability—The Nortel SNAS nodes in a cluster share the burden of resource-intensive operations. The cluster distributes control of the network access devices between the Nortel SNASnodes and distributes handling of session logon. As a result, Nortel SNASdevices in a cluster can control more switches and handle more user sessions.
• fault tolerance—If a Nortel SNASdevice fails, the failure is detected by the other node in the cluster, which takes over the switch control and session handling functions of the failed device. As long as there is one running Nortel SNAS, no sessions are lost.
The devices in the cluster can be located anywhere in the network and do not have to be physically connected to each other. All the Nortel
SNAS devices in the cluster must be in the same subnet. The cluster is created during initial setup of the second node, when you specify that the setup is a join operation and you associate the node with an existing
Management IP address (MIP).
For more information about performing the initial setup and adding a node to a cluster, see the initial setup details in Nortel Secure Network Access
Switch Using the Command Line Interface (NN47230-100).
Interface configuration
The Nortel SNAS must interface to two kinds of traffic: client and management. The interface to the client side handles traffic between the Nortel Health Policy Administrator on the client and the portal. The interface to the management side handles Nortel SNAS management traffic (traffic connecting the Nortel SNAS to internal resources and configuring the Nortel SNAS from a management station).
The following section describes the interface configuration method that the
Nortel SNAS uses. This method is known as a one armed configuration.
One armed configuration
In a one armed configuration, the Nortel SNAS has only one interface, which acts as both the client portal interface and the management traffic interface.
The
Figure 7 "One armed configuration" (page 40)
diagram illustrates a one armed configuration.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
40
Overview
Figure 7
One armed configuration
.
Nortel SNAS configuration and management tools
You can use a number of device and network management tools to configure the Nortel SNAS and manage the Nortel SNAS:
•
Command Line Interface (CLI)
You must use the CLI to perform initial setup on the Nortel SNAS and to set up the Secure Shell (SSH) connection between the Nortel SNAS and the network access devices, and between the Nortel SNAS and the GUI management tool. You can then continue to use the CLI to configure and manage the Nortel SNAS, or you can use the GUI.
For information about using the CLI to configure and manage the
Nortel SNAS, see Nortel Secure Network Access Switch Using the
Command Line Interface (NN47230-100).
•
Security & Routing Element Manager (SREM)
The SREMis a GUI application you can use to configure and manage the Nortel SNAS.
For general information about installing and using the SREM, see
Installing and Using the Security and Routing Element Manager () .
•
Enterprise Policy Manager (EPM) release 4.2
Enterprise Policy Manager (EPM) is a security policy and quality of service provisioning application. You can use EPM to provision filters on the Nortel SNAS network access devices. EPM 4.2 supports the preconfiguration of Red, Yellow, and Green VLAN filters prior to enabling the Nortel SNAS feature. In future releases of the Nortel
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Nortel SNAS configuration roadmap
41
SNAS and EPM software, users have the additional ability to add and modify security and quality of service filters while Nortel SNAS is enabled on the device.
For general information about installing and using EPM, see Installing
Nortel Enterprise Policy Manager () .
•
Simple Network Management Protocol (SNMP) agent
For information about configuring SNMP for the Nortel SNAS, see
“Configuration of SNMP” (page 333)
.
Nortel SNAS configuration roadmap
The following procedure list is an overview of the steps required to configure the Nortel SNAS and the Nortel SNAS.
Procedure steps
Step
1
2
Action
Configure the network DNS server to create a forward lookup zone for the Nortel SNAS domain.
For more information, see the configuration examples in Nortel
Secure Network Access Switch Using the Command Line
Interface (NN47230-100).
Configure the network DHCP server.
For more information, see the configuration examples in Nortel
Secure Network Access Switch Using the Command Line
Interface (NN47230-100).
For each VLAN:
a
Create a DHCP scope.
b Specify the IP address range and subnet mask for that scope.
c
Configure the following DHCP options:
•
Specify the default gateway.
•
Specify the DNS server to be used by endpoints in that scope.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
42
Overview
3
4
ATTENTION
For the Red VLANs, the DNS server setting is one of the Nortel
SNAS portal Virtual IP addresses (pVIP).
While the endpoint is in the Red VLAN, there are limited DNS server functions to be performed, and the Nortel SNAS acts as the DNS server. When the endpoint is in one of the other VLANs, DNS requests are forwarded to the corporate DNS servers.
The DNS server setting is required for the captive portal to work.
Configure the network core router:
a
Create the Red, Yellow, Green, VoIP, and Nortel SNAS management VLANs.
b If the edge switches operate in Layer 2 mode, enable 802.1q
tagging on the uplink ports to enable them to participate in multiple VLANs, and then add the ports to the applicable
VLANs.
ATTENTION
The uplink ports must participate in all the VLANs.
c
Configure IP addresses for the VLANs.
These IP interfaces are the default gateways that the DHCP
Relay uses.
d If the edge switches operate in Layer 2 mode, configure
DHCP relay agents for the Red, Yellow, Green, and VoIP
VLANs.
Use the applicable show commands on the router to verify that DHCP relay is activated to reach the correct scope for each VLAN.
For more information about performing these general configuration steps, see the regular documentation for the type of router used in your network.
Configure the network access devices:
a
Configure static routes to all the networks behind the core router.
b Configure the switch management VLAN, if necessary.
c
Configure and enable SSH on the switch.
d Configure the Nortel SNAS portal Virtual IP address
(pVIP)/subnet.
e
Configure port tagging, if applicable.
For a Layer 2 switch, the uplink ports must be tagged to allow them to participate in multiple VLANs.
f
Create the port-based VLANs.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
5
6
7
Nortel SNAS configuration roadmap
43
These VLANs are configured as VoIP, Red, Yellow, and
Green VLANs in
and
.
g Configure DHCP relay and IP routing if the switch is used in
Layer 3 mode.
h (Optional) Configure the Red, Yellow, Green, and VoIP filters.
The filters are configured automatically as predefined defaults when you configure the Red, Yellow, and Green VLANs (see
step j ). Configure the filters manually only if your particular
system setup requires you to modify the default filters. You can modify the filters after Nortel SNAS is enabled.
i
Configure the VoIP VLANs.
j
Configure the Red, Yellow, and Green VLANs, associating each with the applicable filters.
k
Configure the Nortel SNAS ports.
Identify switch ports as either uplink or dynamic. When you configure the uplink ports, you associate the Nortel SNAS
VLANs with those ports. Clients are connected on the dynamic ports. You can configure Nortel SNAS ports (both dynamic and uplink) after Nortel SNAS is enabled globally.
l
Enable Nortel SNAS globally.
For more information about configuring an Ethernet Routing
Switch 5510, 5520, or 5530 in a Nortel SNAS network, see
Release Notes for Nortel Ethernet Routing Switch 5500 Series,
Software Release 5.0.1.
For more information about configuring an Ethernet Routing
Switch 8300 in a Nortel SNAS network, see Release Notes for
the Ethernet Routing Switch 8300, Software Release 2.2.8.
For more information about the commands used to create a
Nortel SNAS configuration using the CLI, see Nortel Secure
Network Access Switch Using the Command Line Interface
(NN47230-100).
Perform the initial setup on the Nortel SNAS (see Nortel Secure
Network Access Switch Using the Command Line Interface
(NN47230-100)). Nortel recommends running the quick setup wizard during initial setup in order to create and configure basic settings for a fully functional portal.
Using the CLI, enable SSH and SRS Admin to allow communication with the SREM (see Nortel Secure
Network Access Switch Using the Command Line Interface
(NN47230-100)).
Generate and activate the SSH key for communication between the Nortel SNAS and the network access devices (see
).
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
44
Overview
8
9
16
17
14
15
12
13
10
11
Specify the software requirement set (SRS) rule for the default
Nortel Health Agent group (see
).
Add the network access devices and export the SSH key (see
“Adding a network access device” (page 47)
).
Specify the VLAN mappings (see
).
Test Nortel SNAS connectivity (see
).
Configure groups (see
“Configuration of groups and profiles”
).
Configure client filters (see
“Configuring client filters” (page
).
Configure extended profiles (see
“Configuring extended profiles”
).
Specify the authentication mechanisms (see
Configure system users (see Management of Nortel Health
Agent rules and expressions).
Configure the end user experience (see
“Customize the portal and logon” (page 295)
).
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Management of network access devices
This chapter provides a general introduction to the Nortel SNAS network and also contains detailed procedures to manage the network access devices.
Navigation
•
•
“Manage network access devices” (page 46)
45
Before you begin
In Trusted Computing Group (TCG) terminology, the edge switches in a
Nortel SNAS function as the Policy Enforcement Point. In this document, the term network access device is used to refer to the edge switch after it is configured for the Nortel SNAS network.
The following edge switches can function as network access devices in the Nortel SNAS:
•
Ethernet Routing Switch 8300
•
Ethernet Routing Switch 5510, 5520, and 5530
Before you can configure the edge switches as network access devices in the Nortel SNAS domain, you must complete the following:
•
Create the domain, if applicable. If you use the quick setup wizard during initial setup, Domain 1 is created. For more information about creating a domain, see
“Configuration of the domain” (page 111)
.
•
Configure the edge switches for Nortel SNAS (see
“Nortel SNAS configuration roadmap” (page 41)
, step
). For detailed information about configuring the edge switches for Nortel SNAS, see Release
Notes for the Ethernet Routing Switch 8300, Software Release 2.2.8
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
46
Management of network access devices
() or Release Notes for Nortel Ethernet Routing Switch 5500 Series,
Software Release 5.0.1.
For secure communication between the Nortel SNAS and the network access device, each must have knowledge of the other’s public SSH key.
After you have added the network access device to the Nortel SNAS domain, you must exchange the necessary SSH keys (see
).
You require the following information for each network access device:
•
IP address of the switch
•
VLAN names and VLAN IDs for the Red, Yellow, and Green VLANs
• the TCP port to be used for Nortel SNAS communication
• a valid rwa user name for the Ethernet Routing Switch 8300 switches
Manage network access devices
The Nortel SNAS starts communicating with the network access device as soon as you enable the switch on the Nortel SNAS.
You cannot configure the VLAN mappings for a network access devicein the Nortel SNAS domain if the switch is enabled. When you add a network access device to the domain, the network access device is disabled by default. Do not enable the network access device until you complete the configuration. For information about enabling and disabling the network access device, see
“Controlling communication with the network access devices” (page 59)
.
ATTENTION
If you do not enable the network access device after you complete the configuration, or the network access device remains inactive.
This section describes the steps to configure the network access devices in the Nortel SNAS domain.
Manage network access devices navigation
•
“Adding a network access device” (page 47)
•
“Deleting a network access device” (page 49)
•
“Configuring the network access devices” (page 49)
•
•
•
“Monitoring switch health” (page 57)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Manage network access devices
47
Adding a network access device
To add a network access device, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain and Switches from the
Navigation pane.
The Switches screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New Switch screen appears.
5
6
Click Create Switch.
The network access device appears in the Switches table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add a network access device.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
48
Management of network access devices
Variable
Switch Id
Name
Value
Specifies an integer that uniquely identifies the network access device in the Nortel SNAS domain.
Specifies a string that identifies the switch on the Nortel
SNAS.
Management
Protocol
The maximum length of the string is 255 characters. After you define a name for the switch, you can use either the switch name or the switch ID to access the network access device.
Based on the selected management protocol fields appears.
is sscplite, 3 new fields "switch ports" and "switch-uplink ports" and SNMP Profile appear and values in "Type" list box too change.Values: sscp and sscplite default: sscp
Management Protocol: sscp
Type Specifies the type of network access device. The options are ERS8300, ERS 4500, ERS5500 and ERS5600.
IP Address
Communication
Port
Specifies the network access device IP address.
Specifies the TCP port number used for the Switch to
Nortel SNAS Communication Protocol (SSCP). The default setting is 5000.
Value range: (1024-65535)
Management Protocol: sscplite
Switch Ports Select the Set Switch Ports to Default checkbox. You can enter the comma separated values for the switch ports.
default: 1/1-23
Switch Uplink Select the Set Switch Uplink Ports to Default checkbox.
You can enter the comma separated values for the switch uplink ports.
default: 1/24
SNMP Profile
Type
IP Address
Port
Select the SNMP profile for the switch.
Specifies the type of network access device. The options are BayStack, PassPort, Cisco, and HP-ProCurve.
Specifies the network access device IP address.
Specifies the TCP port number used for the Switch to
Nortel SNAS Communication Protocol (SSCP). The default setting is 5000.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Manage network access devices
49
Variable
Status
Red VLAN ID
Value
Enables or disables the switch.
Values: enabled and disabled default: disabled
Specifies the VLAN ID of the Red VLAN configured on the network access device.
Deleting a network access device
To remove an existing network access device from the domain configuration see
“Manage network access devices” (page 46)
. Use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Secure Access Domain and Switches from the
Navigation pane.
The Switches screen appears.
Select the network access device from the Switches list.
Click Delete.
A dialog box appears to confirm that you want to delete this network access device.
Click Yes.
The network access device is removed from the Switches list.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring the network access devices
When you first add a network access device to the Nortel SNAS domain, the switch is disabled by default. Do not enable the switch until you complete its configuration. In particular, do not enable the switch until you map the VLANs (see
“Mapping the VLANs” (page 50) ) and exchange the
necessary SSH keys (see
).
To reconfigure the VLAN mappings for an existing network access device, first disable it (see
“Controlling communication with the network access devices” (page 59)
). After you disable the network access device, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
50
Management of network access devices
6
7
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain and Switches from the
Navigation pane.
The Switch screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Select the network access device you want to configure and click
Edit.
The Modify Switch screen appears.
Enter the network access deviceinformation in the applicable fields.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Mapping the VLANs
The VLANs are configured on the network access devices. You can specify the Red VLAN for each network access device when you add the switch (see
“Adding a network access device” (page 47) ). After adding the
switch, you must map the Yellow and Green VLANs to the Nortel SNAS
(see
).
Nortel recommends mapping the VLANs by domain. In this way, if you later add switches which use the same VLAN IDs, their VLAN mappings can automatically be picked up.
If you map the VLANs by domain, you can modify the mapping for a particular network access device at the switch level. Switch-level settings override domain settings.
The Nortel SNAS maintains separate maps for the domain and the switch.
If you add a domain-level VLAN, then you must use the domain-level command for all future management of that mapping. Similarly, if you add a switch-level VLAN, then you must use the switch-level command for all future management of that mapping.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Manage network access devices
51
Mapping VLANs
To map VLANs in a domain, select the Secure Access Domain,
Switches, and VLANs tab.
The VLANs screen appears, listing all current VLANs applied to the domain.
This screen allows you to manage VLANs on the domain by adding or deleting entries to the VLAN Table. For detailed steps on adding or removing VLANs, see:
•
•
To add VLANs, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, Switches and
VLANs from the Navigation pane.
The VLANs screen appears.
Select the secure access domain and the switch from the respective lists, and click
Refresh.
Click Add.
The Add VLAN dialog box appears.
5
Click Create VLAN.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
52
Management of network access devices
6
7
The new VLAN appears in the VLAN table.
Repeat step 3-5 for each Green and Yellow
VLAN that you want to configure on the domain.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add a VLAN.
Variable
Name
VLAN ID
Value
The name of the VLAN, as configured on the domain.
The ID of the VLAN, as configured on the domain.
Removing VLANs
To remove existing VLANs, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
6
7
Select the Config tab.
Select Secure Access Domain, Switches and VLANs from the
Navigation pane.
The VLANs screen appears.
Select the secure access domain and the switch from the respective lists, and click Refresh.
Select the VLAN entry from the VLAN Table.
Click Delete.
A dialog box appears to confirm that you want to delete this
VLAN.
Click Yes.
The VLAN disappears from the VLAN Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Manage network access devices
53
Managing SSH keys
The Nortel SNAS and the network access devices controlled by the
Nortel SNAS domain exchange public keys so that they can authenticate themselves to each other in future SSH communications.
ATTENTION
When you add a new network access device, the SSH fingerprint of the switch is automatically picked up if the switch is reachable. If the fingerprint is not successfully retrieved, then the SSH key is not set for this network access device.
To enable secure communication between the Nortel SNAS and the network access device, use the following procedure:
Procedure steps
Step Action
1
2
3
Generate an SSH public key for the Nortel SNAS domain (see
“Generating SSH keys for the domain” (page 54)
), if necessary.
Apply the change immediately.
If you create the domain manually, the SSH key is generated automatically (see
“Manually creating a domain” (page 113) ).
ATTENTION
The SSH key for the Nortel SNAS domain is not the same as the
SSH key generated during initial setup for all Nortel SNAS hosts in the cluster (for more information about the initial setup, see Nortel
Secure Network Access Switch Using the Command Line Interface
(NN47230-100)).
For an Ethernet Routing Switch 8300, you can export the key directly to the switch (see
“Managing SSH keys for Nortel SNAS communication” (page 55) ).
For an Ethernet Routing Switch 5510, 5520, or 5530, upload the key to a TFTP server for manual retrieval from the switch (see
“Exporting SSH keys for the domain” (page 55)
).
For information about downloading the key from the server to the switch, see Release Notes for Nortel Ethernet Routing Switch
5500 Series, Software Release 5.0.1.
ATTENTION
If you regenerate the key at any time, you must re-export the key to each network access device.
If you export the key after the network access device is enabled, you may need to disable and reenable the switch in order to activate the change.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
54
Management of network access devices
4
For each network access device, import its public key into the
Nortel SNAS domain, if necessary. For more information about importing public keys, see
“Managing SSH keys for Nortel SNAS communication” (page 55) .
ATTENTION
If the network access device is reachable when you add it to the domain configuration, the SSH key is automatically retrieved.
If the network access device defaults, it generates a new public key.
You must reimport the key whenever the switch generates a new public key (see
“Reimporting the network access device SSH key”
)
In general, click Apply on the toolbar immediately after you change any of the SSH settings.
--End--
Generating SSH keys for the domain
To generate, view, and export the public SSH key for the domain, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and SSH Keys from the Navigation pane.
The SSH Key screen appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to know the fields and controls available from the switch SSH Key screen.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Manage network access devices
55
Variable
Generate New
Keys
Show SSH keys
Value
Generates an SSH public key for the domain.
At any one time, only one key can be in effect for the Nortel SNAS domain. If a key already exists, you are prompted to confirm that you want to replace it.
Click Apply on the toolbar to save the change immediately and create the key.
Displays the SSH public key generated for the domain.
Exporting SSH keys for the domain
You cannot export the domain SSH key directly to an Ethernet Routing
Switch 5500 series switch. Instead, you must upload the key to a file exchange server by using the following export procedure.
To export the SSH public key for the domain, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, Switches, and SSH Key from the Navigation pane.
The SSH Key screen appears.
Select the secure access domain and the switch from the respective lists, and click Refresh.
Click Export SSH Key to Switch.
Click Apply on the toolbar to begin the export process.
--End--
Managing SSH keys for Nortel SNAS communication
To retrieve the public key for the network access device and export the public key for the domain, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
56
Management of network access devices
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, Switches, and SSH Key from the Navigation pane.
The SSH Key screen appears.
Select the secure access domain and the switch from the respective lists, and click Refresh.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to know the fields and controls available from the switch SSH Key screen.
Variable
Import SSH Key from Switch
Export SSH Key to
Switch
Value
Retrieves the SSH public key from the network access device, if it is reachable.
Exports the SSH public key for the
Nortel SNAS domain to the network access device.
Delete
CAUTION
You cannot use this command to export the key to an
Ethernet Routing
Switch 5500 series switch. For more information, see
“Exporting SSH keys for the domain”
Deletes the SSH public key for the network access device in the domain.
Reimporting the network access device SSH key
Whenever the network access device generates a new public SSH key, you must import the new key into the Nortel SNAS domain.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Manage network access devices
57
To reimport a public SSH key, use the following procedure:
3
4
5
6
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Switches, and SSH Key from the Navigation pane.
The SSH Key screen appears.
Click Delete Switch SSH Key.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
Click Import SSH from Switch.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
For more information about the SSH Key commands, see
“Managing SSH keys for Nortel SNAS communication” (page 55)
.
Monitoring switch health
The Nortel SNAS continually monitors the health of the network access devices. At specified intervals, a health check daemon sends queries and responses to the switch as a heartbeat mechanism. If no activity
(heartbeat) is detected, the daemon retries the health check for a specified number of times (the dead count). If no heartbeat after a further interval
(the status-quo interval), the network access device moves all its clients into the Red VLAN. When connectivity is reestablished, the Nortel SNAS synchronizes sessions with the network access device.
You can configure the health check interval, dead count, and status-quo interval.
1
2
To configure parameters for the Nortel SNAS health checks, use the following procedure:
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Switches, and Health Check from the Navigation pane.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
58
Management of network access devices
The Health Check screen appears.
3
4
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure the health check.
Variable
Interval
Value
Sets the time interval between checks for switch activity.
Dead Count
Accepts an integer that indicates the time interval in seconds (s), minutes (m), or hours (h). The valid range is 60s (1m) to 64800s (18h). The default is 1m
(1 minute).
Specifies the number of times the Nortel SNAS repeats the check for switch activity when no heartbeat is detected.
Accepts an integer in the range 1–65535 that indicates the number of retries. The default is 3.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Manage network access devices
59
Variable Value
Status Quo Interval
If no heartbeat is detected after the specified number of retries, the Nortel SNAS enters status-quo mode.
Sets the time interval for status-quo mode, after which the network access device moves all clients into the
Red VLAN.
Accepts an integer that indicates the time interval in seconds (s), minutes (m), or hours (h). The valid range is 0 to 64800s (18h). The default is 1m (1 minute).
Controlling communication with the network access devices
To stop communication between the Nortel SNAS and a network access device, disable the switch. Click Apply to apply the change immediately.
ATTENTION
If the switch is not used in the Nortel SNAS network, Nortel recommends that you delete the switch from the Nortel SNAS domain, rather than just disabling it.
To restart communication between the Nortel SNAS and a network access device, enable the switch. Click Apply to apply the change immediately.
When you first add a network access device to the Nortel SNAS domain, the switch is disabled by default. Do not enable the switch until you complete its configuration. In particular, do not enable the switch until you have mapped the VLANs (see
) and exchanged the necessary SSH keys (see
).
To disable or enable the network access device, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain and Switches from the
Navigation pane.
The Switches screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Ensure the Enable setting is correct.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
60
Management of network access devices
5
Click Update on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Configuration of system settings
This chapter provides detailed procedures to configure the Nortel SNAS host.
ATTENTION
System settings apply to a cluster as a whole.
You can log on to either the Management IP address (MIP) or a Nortel SNAS host Real IP address (RIP) in order to configure the system.
Navigation
•
“Configuring the cluster ” (page 61)
•
“Configuring system settings” (page 62)
•
“Configuring a Nortel SNAS host” (page 63)
•
“Configuring host interfaces” (page 66)
•
“Configuring static routes” (page 70)
•
“Configuring host ports” (page 76)
•
“Configuring the access list” (page 78)
•
“Managing date and time settings” (page 80)
•
“Configuring DNS settings” (page 83)
•
“Configuring servers” (page 85)
•
“Configuring administrative settings” (page 94)
•
“Configuring Nortel SNAS host SSH keys” (page 95)
•
“Adding an SSH key for a known host” (page 97)
•
“Managing RADIUS authentication of system users” (page 98)
61
.
Configuring the cluster
This section describes how to configure the cluster. Choose from one of the following tasks:
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
62
Configuration of system settings
Configuring the cluster navigation
•
“Configuring system settings” (page 62)
•
“Configuring a Nortel SNAS host” (page 63)
•
“Configuring host interfaces” (page 66)
•
“Configuring static routes” (page 70)
•
“Configuring host ports” (page 76)
•
“Configuring the access list” (page 78)
•
“Managing date and time settings” (page 80)
•
“Configuring DNS settings” (page 83)
•
“Configuring servers” (page 85)
•
“Configuring administrative settings” (page 94)
•
“Configuring Nortel SNAS host SSH keys” (page 95)
•
“Adding an SSH key for a known host” (page 97)
•
“Managing RADIUS authentication of system users” (page 98)
•
“Configuring auto blacklisting” (page 102)
•
“Configuring harden password” (page 108)
•
“Redistributing switches” (page 110)
Configuring system settings
To view and configure cluster-wide system settings, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Cluster and Host(s) from the Navigation pane.
The Host(s) screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
63
3
4
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure the Management IP
Address for the cluster.
Variable
MIP Address
Value
Sets the MIP for the cluster. The MIP identifies the cluster and must be unique on the network.
ATTENTION
Nortel does not recommend reconfiguring this parameter if you are logged on to the
MIP because you can lose connectivity. To reset the MIP, log on to the RIP instead.
Configuring a Nortel SNAS host
To configure a Nortel SNAS host, use one or more of the following procedures:
•
“Viewing host information” (page 64)
•
“Viewing installed licenses for a particular host” (page 64)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
64
Configuration of system settings
For details about configuring host interfaces, see
“Configuring host interfaces” (page 66) . For details about configuring host ports, see
“Configuring host ports” (page 76) .
Viewing host information
To display a list of available Nortel SNAS hosts, use the following procedures:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Cluster and Host(s) from the Navigation pane.
The Hosts screen appears, listing all hosts currently in the Nortel
SNAS configuration.
To view detailed host information, select a particular host from the navigation tree, or in the Hosts list.
--End--
Viewing installed licenses for a particular host
Procedure steps
Step
1
2
Action
Select the Config tab.
To view the licenses applied to a particular Nortel SNAS device in the cluster, select Cluster, Host(s), and License from the
Navigation pane.
The License screen appears, displaying a list of the type and value for each license installed on that Nortel SNAS host.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
65
3
Select the host number from the Host Number list, and click
Refresh.
The corresponding details appear.
--End--
.
Installing a license for a particular host
The Nortel SNAS SSL (portal and Nortel SNAS domain client access) license is available for 100, 250,
500, and 1000 users.
ATTENTION
Before you install a new license, you must first purchase a Nortel SNAS SSL
(portal and Nortel SNAS domain client access) license key from Nortel Technical
Support. To obtain a license key, check the Information screen to find the MAC address of the Nortel SNAS device. Then, provide the MAC address to Nortel
Technical Support and request the key for the desired license type.
To install a new license on a Nortel SNAS device in the cluster, use the following procedure:
Procedure steps
Step Action
1
2
Open the license key provided by Nortel Technical Support in a text editor.
Select and copy the entire license key.
When copying the license key, ensure you include the
BEGIN
LICENSE and
END LICENSE lines.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
66
Configuration of system settings
3
4
5
6
7
Select the Config tab.
Select Cluster, Host(s), and License from the Navigation pane.
The License screen appears.
Click Paste to insert the license key into the text box.
Click Save to add the new license to this Nortel SNAS host.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring host interfaces
The default IP interface on the Nortel SNAS host is Interface 1. You can create additional interfaces and specify the ports to be assigned to each interface. If you assign more than one port to an interface, you can choose whether the ports operates in failover or trunking mode.
To view a list of interfaces on a particular Nortel SNAS host, select
Cluster, Host(s), and Interfaces from the Navigation pane. The Interfaces screen appears.
To continue, choose one of the following procedures:
•
“Adding a host interface” (page 66)
•
“Configuring an existing host interface” (page 68)
•
“Removing a host interface” (page 69)
Adding a host interface
To create a host interface, use the following procedure:
3
4
1
2
Procedure steps
Step Action
Select the Config tab.
Select Cluster, Host(s), and Interfaces from the Navigation pane.
The Interfaces screen appears.
Select the host from the Host Number list, and click Refresh.
Click Add.
The Add Network screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
67
5
6
Click Update.
The new interface appears in the Interfaces table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add a host interface.
Variable
Id
Address
Netmask
VLAN Id
Value
An integer in the range 1 to 252 that uniquely identifies the interface on the Nortel SNAS.
Sets the network address for the interface. (For
Interface 1, the network address is the RIP.)
Sets the subnet mask for the interface.
Specifies the VLAN tag if packets received by the interface are tagged with a specific VLAN tag ID.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
68
Configuration of system settings
Variable
Mode
Ports
Primary
Port
Value
Specifies the mode of operation for the port numbers assigned to this interface. The options are:
• failover—only one link is active at any given time. If the port with an active link fails, the active link is immediately switched over to one of the other ports configured for the interface. When you select failover mode, you also have the option of specifying a primary port.
• trunking—active links are sustained on all configured ports simultaneously to increase network throughput.
The default is failover.
Select the available ports.
Specifies the primary port in the interface on which the active link is set up. If the primary port fails, the active link is immediately transferred to a remaining (secondary) port. As soon as the primary port regains functionality, the active link is transferred back to the primary port.
An integer indicating the port number of the physical port assigned to the interface. The default is 0 (zero).
The default value of zero means that the currently active link remains in use until it fails.
If the port fails, the link is transferred to another port. The link remains active on the port to which it is transferred, even after the failed port regains functionality.
The primary port setting applies only when you configure more than one port in the interface, and the mode is failover.
Configuring an existing host interface
To configure an existing host interface, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
69
5
6
7
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Cluster, Host(s), and Interfaces from the Navigation pane.
The Interface screen appears.
Select the host number from the Host Number list, and click
Refresh.
Select the interface from the Interface table, and click Edit.
The Modify Network screen appears.
Enter the interface information in the applicable fields.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Removing a host interface
To delete a host interface, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
6
Select the Config tab.
Select Cluster, Host(s), and Interfaces from the Navigation pane.
The Interface screen appears.
Select the host number from the Host Number list, and click
Refresh.
Select the interface from the list.
Click Delete.
A confirmation dialog box appears.
Click Yes.
The interface is removed from the Interfaces list.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
70
Configuration of system settings
7
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Rebooting or halting a host
To reboot or halt a host, use the following procedure:
3
4
1
2
Procedure steps
Step Action
Select the Config tab.
Select Cluster and Host(s) from the Navigation pane.
The Host(s) screen appears.
Select NSNAS host from the list.
Click Reboot to reboot the host or Halt to halt the host.
--End--
Configuring static routes
To view or configure static routes at a particular level, choose from the following procedures:
•
“Viewing static routes for a cluster” (page 70)
•
“Adding a static route for a cluster” (page 70)
•
“Removing a static route for a cluster” (page 72)
Viewing static routes for a cluster
To configure static routes for the cluster, select Cluster > Routes > Static
Routes from the Navigation pane.
The Static Routes screen appears, displaying a list of the existing static routes on the Nortel SNAS cluster.
From the selected static route screen, complete the following tasks as necessary:
•
“Adding a static route for a cluster” (page 70)
•
“Removing a static route for a cluster” (page 72)
.
To add a static routes, use the following procedure:
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
71
ATTENTION
When you add a static route to the system, host, or interface configuration, the route is automatically assigned an index number. There are separate sequences of index numbers for routes configured for the cluster, for each host, and for each interface.
Procedure steps
Step
1
2
3
Action
Select the Config tab.
Select Cluster, Routes, and Static Routes from the Navigation pane.
The Static Routes screen appears, displaying a list of the existing static routes on the Nortel
SNAS cluster.
Click Add.
The Add Static Route screen appears.
4
5
Click Update.
The new route appears in the Static Route table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add a static route for a cluster.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
72
Configuration of system settings
Variable
Destination IP
Value
Specifies the static route destination IP address.
Destination Subnet Specifies the destination subnet IP address.
Gateway IP Specifies the IP address on the core router.
Removing a static route for a cluster
To remove an existing static route, use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Cluster, Routes, and Static Routes from the Navigation pane.
The Static Routes screen appears, displaying a list of the existing static routes on the Nortel SNAS cluster.
Select the static route from the IP Route Table.
Click Delete.
A confirmation dialog box appears.
Click OK.
The static route is removed from the IP Route Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Viewing static routes for a host
To configure static routes for a host, select Cluster, Routes, and Host
Routes from the Navigation pane.
The Host Routes screen appears, displaying a list of the existing static routes on this host.
From the selected static route screen, complete the following procedures as necessary:
•
“Adding a static route for a host” (page 73)
•
“Removing a static route for a host” (page 73)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
73
To add a static route, use the following procedure:
ATTENTION
When you add a static route to the system, host, or interface configuration, the route is automatically assigned an index number. There are separate sequences of index numbers for routes configured for the cluster, for each host, and for each interface.
Procedure steps
Step
1
2
3
4
5
6
Action
Select the Config tab.
Select Cluster, Routes, and Host Routes from the Navigation pane.
The Host Routes screen appears.
Select the host from the Host Number list, and click Refresh.
Click Add.
The Add Host Route screen appears.
Click Update.
The new route appears in the Add Host Route table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add a host route.
Variable
Destination IP
Value
Specifies the static route destination IP address.
Destination Subnet Specifies the destination subnet IP address.
Gateway IP Specifies the IP address on the core router.
Removing a static route for a host
To remove an existing static route, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
74
Configuration of system settings
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Cluster, Routes, and Host Routes from the Navigation pane.
The Host Routes screen appears.
Select the static route from the list.
Click Delete.
A confirmation dialog box appears.
Click OK.
The static route is removed from the Routes table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Viewing static routes for an interface
To configure static routes for an interface, select Cluster, Routes, and
Interface Routes from the Navigation pane.
The Interface Route screen appears, displaying a list of the existing static routes on this interface.
•
“Adding a static route for an interface” (page 74)
•
“Removing a static route for an interface” (page 76)
To add a static route, use the following procedure:
ATTENTION
When you add a static route to the system, host, or interface configuration, the route is automatically assigned an index number. There are separate sequences of index numbers for routes configured for the cluster, for each host, and for each interface.
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
2
3
4
Configuring the cluster
75
Select Cluster, Routes, and Interface Routes from the Navigation pane.
The Interface Routes screen appears.
Select the host and the interface from the respective lists, and click Refresh.
Click Add.
The Add Interface Route screen appears.
6
7
5
Enter the static route information in the applicable fields. The following table describes the Add Interface Route fields.
Click Update.
The new route appears in the Route Table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add a static route for an interface.
Variable Value
Destination IP Specifies the static route destination IP address.
Destination Subnet Specifies the destination subnet IP address.
Gateway IP Specifies the IP address on the core router.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
76
Configuration of system settings
Removing a static route for an interface
To remove an existing static route, use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Cluster, Routes, and Interface Routes from the
Navigation pane.
The Interface Routes screen appears.
Select the static route from the Interface Routes screen.
Click Delete.
A confirmation dialog box appears.
Click OK.
The static route is removed from the Route Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Viewing host ports
To configure the connection properties for a port, select Cluster, Host(s), and Ports from the Navigation pane.
The Ports screen appears, listing the ports for this host.
To configure port settings, use the procedure
.
Configuring host ports
To configure the connection properties for a port, use the following procedure:
3
4
1
2
Procedure steps
Step Action
Select the Config tab.
Select Cluster, Host(s), and Ports from the Navigation pane.
The Ports screen appears.
Select the host from the Host Number list, and click Refresh.
Select a port to configure from the list, and click Edit.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
77
The Modify Port screen appears displaying configuration details for the selected port.
5
6
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure host ports.
Variable
Port Number
Autonegotiation
Value
Displays an integer in the range 1 to 4, indicating the port number of the physical port on the Nortel
SNAS.
Specifies the Ethernet autonegotiation setting for the host and NIC port. The options are:
• on—the port is set to autonegotiate speed and mode. This is the recommended setting.
• off—speed and mode are fixed at a specified setting.
The default is on.
When autonegotiation is on, ensure that the device to which the port is connected is also set to autonegotiate.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
78
Configuration of system settings
Variable
Speed
Full or half duplex mode
Value
Specifies the speed in megabits per second for the host and NIC port when autonegotiation is set to off.
Quick Choice values: 10|100|1000.
Specifies the duplex mode for the host and NIC port when autonegotiation is set to off.
Values: full and half default: full
Configuring the access list
The access list is a cluster-wide list of IP addresses for hosts authorized to access the Nortel SNAS devices by Telnet, SSH, BBI, and SREM. You can configure the list to allow access by individual systems or a range of systems on a specific network.
If the access list is empty, access is open to any system.
For information about enabling Telnet and SSH access, see
“Configuring administrative settings” (page 94) .
To configure the access list, select Administration, Access List from the
Navigation pane.
The Access List screen appears.
From here, you can manage the access list by using one of the following procedures:
•
“Adding an access list entry” (page 78)
•
“Removing an Access List entry” (page 79)
Adding an access list entry
To add an entry to the access list, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and Access List from the Navigation pane.
The Access List screen appears.
Click Add.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
79
The Add New Client Access screen appears.
4
5
Click Update.
The new host appears in the table. An index number is automatically assigned to the entry.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add an access host.
Variable
Client Network
Address
Value
Specifies the IP address of the host to be allowed access.
Client Subnet Mask Specifies the subnet mask. You can set the mask to specify a single system or a range of systems on a specific network.
Removing an Access List entry
To remove an existing entry from the access list, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration and Access List from the Navigation pane.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
80
Configuration of system settings
3
4
5
6
The Access List screen appears.
Select an entry from the Access List table to remove.
Click Delete.
A confirmation dialog box appears.
Click OK.
The entry disappears from the Access List Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Managing date and time settings
To manage system date and time settings, select Cluster and Time from the Navigation pane.
The Time screen appears, allowing you to modify existing system settings and manage a list of NTP servers.
ATTENTION
You can add NTP servers to the system configuration to enable the NTP client on the Nortel SNAS to synchronize its clock. To compensate for discrepancies, it is recommended that NTP has access to at least three NTP servers.
For detailed procedures about managing date and time settings, use one of the following procedures:
•
“Configuring the date and time settings” (page 80)
•
“Adding an NTP server” (page 81)
•
“Removing an NTP server” (page 82)
Configuring the date and time settings
To configure the system date and time, use the following procedure:
Procedure steps
Step
1
2
Action
Select the Config tab.
Select Cluster and Time from the Navigation pane.
The Time screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
81
3
4
Click Save.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to configure the system date and time.
Variable
Date
Time
Time Zone
Value
Specify the system date in
MM-DD-YYYY format.
Specifies the system time in HH:MM format, using a 24-hour clock.
Select the time zone from the list.
Adding an NTP server
To add an additional NTP server, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
82
Configuration of system settings
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Network and NTP from the Navigation pane.
The NTP Servers screen appears.
Click Add.
The Add NTP Server screen appears.
4
5
6
Enter the NTP Server information in the applicable fields. The following table describes the Add NTP Server fields.
Click Update.
The NTP server appears in the NTP Server table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add an NTP server.
Variable
New NTP IP
Value
Specifies the IP address of an
NTP server. An index number is automatically assigned to the server.
Removing an NTP server
To remove an existing NTP server from the NTP Server Table, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
83
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Network and NTP from the Navigation pane.
The Time screen appears.
Select the NTP server entry that you wish to remove from the
NTP Server Table.
Click Delete.
A confirmation dialog box appears.
Click OK.
The NTP server entry disappears from the NTP Server table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring DNS settings
To configure DNS client settings, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Network and DNS from the Navigation pane.
The DNS Settings screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
84
Configuration of system settings
3
4
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure DNS client settings.
Variable Value
Local DNS Cache size Specifies the maximum number of DNS entries contained in the local DNS cache. The range is
0–10000. The default is 1000.
Retransmit Interval Timer Specifies the interval for retransmitting a DNS query in seconds ( s
), minutes ( m
), hours ( h
), or days ( d
). If you do not specify a measurement unit, seconds is assumed. The default is 2 seconds.
Retransmit Counter Specifies the maximum number of times a DNS query is retransmitted. The default is 3.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
85
Variable
Maximum TTL
Value
Specifies the maximum Time-to-live (TTL) value for entries in the DNS cache. After the TTL expires, the entries are discarded. Specify the TTL in seconds (s), minutes ( m
), hours ( h
), or days ( d
).
You can enter compound values (for example,
2h30m). If you do not specify a measurement unit, seconds is assumed. The default is 3h (3 hours).
Health Check Up Counter Specifies the interval for the Nortel SNAS to check the health of the DNS servers. At the specified interval, the Nortel SNAS performs a DNS query to each DNS server in the system configuration to determine its health status. Specify the interval in seconds ( s
), minutes ( m
), hours ( h
), or days ( d
). If you do not specify a measurement unit, seconds is assumed. The default is 10 seconds.
Health Check Down
Counter
Specifies the number of times a DNS server health check can time out before the Nortel SNAS determines that the DNS server is down. The default is 2.
Health Check Up Interval Specifies the number of times a DNS server health check returns a positive response before the Nortel
SNAS determines that the DNS server is up. The default is 2.
Configuring servers
To configure servers, use one of the following procedures:
•
“Managing syslog servers” (page 85)
•
“Managing DNS servers” (page 88)
•
“Managing RSA servers” (page 89)
Managing syslog servers
To manage syslog servers, select Cluster and Syslog from the Navigation pane.
The Syslog screen appears, displaying a list of active syslog servers.
From this screen, complete the following tasks as necessary:
•
“Adding a new syslog server” (page 86)
•
“Reordering a new syslog server” (page 87)
•
“Removing an existing syslog server” (page 87)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
86
Configuration of system settings
To add a new syslog server entry, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Cluster and Syslog from the Navigation pane.
The Syslog screen appears.
Click Add.
The Add New Remote Server screen appears.
4
5
Click Update.
The syslog server entry appears in the Syslog server table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
.
Use the data in the following table to add a new syslog server.
Variable
New Server IP
Value
Specifies the IP address of the syslog server.
New Server Facility Specifies a local facility number that can be used to uniquely identify syslog entries.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
87
Reordering a new syslog server
To reorder the existing syslog servers, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Cluster and Syslog from the Navigation pane.
The Syslog screen appears.
Select the syslog server entry you want to reorder from the
Syslog Server Table.
Specify the new facility sequence in the Syslog table.
Click Apply on the toolbar to automatically reindex all syslog server entries.
--End--
Removing an existing syslog server
To remove an existing syslog server entry from the Syslog Server Table, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Cluster and Syslog from the Navigation pane.
The Syslog screen appears.
Select the syslog server entry you want to delete from the
Syslog Server Table.
Click Delete.
A confirmation dialog box appears.
Click OK.
The syslog server entry is immediately removed from the Syslog
Server Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
88
Configuration of system settings
Managing DNS servers
You can add up to three DNS servers to the system configuration. The
DNS server is used by the captive portal when the DNS server forwards queries on the Exclude List. (For more information about the captive portal and the Exclude List, see
“Captive portal and Exclude List” (page 286)
.)
To manage DNS servers in the system configuration, select Network and
DNS from the Navigation pane. The DNS Server screen appears.
From this screen, you can complete the following tasks as necessary:
•
“Adding a DNS server” (page 88)
•
“Removing an existing DNS server” (page 89)
To manage DNS servers in the system configuration, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Network and DNS from the Navigation pane.
The DNS Server screen appears.
Click Add.
The DNS screen appears.
4
Click Updated.
The DNS server entry appears in the DNS
Server table.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
5
Configuring the cluster
89
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add a DNS server.
Variable
New DNS IP
Value
Specifies the IP address for the DNS server.
Removing an existing DNS server
To remove a DNS server from the system configuration, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Network and DNS from the Navigation pane.
The DNS Server screen appears.
Select the DNS server you want to remove from the DNS Server table.
Click Delete.
A confirmation dialog box appears.
Click OK.
The DNS server entry is immediately removed from the DNS
Server Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Managing RSA servers
To manage RSA servers, select Administration and RSA Servers from the Navigation pane. The RSA Server screen appears, listing RSA servers that have already been configured on the Nortel SNAS.
ATTENTION
This feature is not supported in Nortel Secure Network Access Switch Software
Release 1.6.1.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
90
Configuration of system settings
This screen allows you to view, manage, and configure RSA server entries by using the following procedures:
•
“Adding an RSA server” (page 90)
•
“Removing an existing RSA server” (page 91)
•
“Removing the RSA node secret” (page 92)
•
“Importing sdconf.rec” (page 93)
ATTENTION
This feature is not supported in Nortel Secure Network
Access Switch Software Release 1.6.1.
To configure RSA servers, use the following procedure.
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and RSA Servers from the Navigation pane.
The RSA Server screen appears.
Click Add.
The Add New RSA Server screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
91
4
5
6
Enter the RSA server information in the applicable fields. The following table describes the Add New RSA Server fields.
Click Update.
The RSA server appears in the RSA Server table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add a RSA server.
Variable
Id
RSA Server
IP/Hostname
Value
Specifies the index value for the server entry.
Specifies the hostname of the RSA server.
ATTENTION
This feature is not supported in Nortel Secure Network Access Switch Software
Release 1.6.1.
Removing an existing RSA server
To remove an existing RSA server, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Administration and RSA Servers from the Navigation pane.
The RSA Server screen appears.
Select the RSA server entry to remove from the RSA Server table.
Click Delete.
A confirmation dialog box appears.
Click OK.
The RSA server entry disappears from the RSA Server Table.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
92
Configuration of system settings
6
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
ATTENTION
This feature is not supported in Nortel Secure Network Access Switch Software
Release 1.6.1.
Removing the RSA node secret
You can remove the RSA node secret, if necessary. However, authentication then fails until you clear he Node secret created check box in the Edit Agent Host window on the RSA server.
To remove the RSA node secret, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and RSA Servers from the Navigation pane.
The RSA Server screen appears.
Select the RSA server entry from the RSA Server table, and click Edit.
The Modify RSA Server screen appears. The screen displays the index number and symbolic name assigned to the RSA server when you added the RSA server.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
4
5
6
Configuring the cluster
93
Click Remove Node Secret.
The RSA node secret is immediately removed.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
ATTENTION
This feature is not supported in Nortel Secure Network
Access Switch Software Release 1.6.1.
The sdconf.rec
file is a configuration file that contains critical RSA ACE/Server information. Ask your RSA
ACE/Server administrator to make the file available on the specified TFTP/FTP/SCP/SFTP server.
To import an sdconf.rec file, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and RSA Servers from the Navigation pane.
The RSA Server screen appears.
Select an RSA server from the RSA Server table and click Edit.
The Modify RSA Server screen appears.
Click Import.
Click Apply on the toolbar to send the current changes to the Nortel SNASand import the sdconf.rec file.
--End--
Use the data in the following table to import sdconf.rec.
Variable
Filename
Value
Specifies the file name.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
94
Configuration of system settings
Configuring administrative settings
To manage system administrative settings, choose from one of the following procedures:
•
“Configuring SRS control settings” (page 94)
•
“Configuring Nortel SNAS host SSH keys” (page 95)
•
“Managing RADIUS authentication of system users” (page 98)
Configuring SRS control settings
To create and modify the Nortel Health Agent Software Requirement Set
(SRS) rules, you must use the BBI (see Nortel Health Policy Administrator
SRS Builder). Before you can access the Rule Builder utility, you must enable support for SRS administration.
To configure support for managing the SRS rules, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration and SRS Control Setting from the
Navigation pane.
The SRS Control Settings screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
95
.
3
4
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure SRS rules.
Value Variable
HTTP Settings
Port
Status
Specifies the TCP port used for communication with the SRS administration server.
default: 80
Enables or disables the SRS administration for creating and managing SRS rules.
Values: enabled and disabled
HTTP/SSL Settings
Port
Status
Specifies the TCP port used for communication with the SRS administration server.
default: 4443.
Enables or disables the SRS administration for creating and managing SRS rules.
Idle Timeout
Web/CLI Timeout Specifies an idle timeout in seconds for Web GUI and CLI logons. The value can be between 300 and 604800.
Configuring Nortel SNAS host SSH keys
The Nortel SNAS functions as both SSH client (for importing and exporting logs using SFTP) and SSH server for secure management communications between the Nortel SNAS devices in a cluster.
ATTENTION
SCP is not supported.
The SSH host keys are a set of keys used by all hosts in the cluster in accordance with the Single System Image (SSI) concept. As a result, connections to the MIP always appear to an SSH client to be to the same host.
During initial setup, there is an option to generate the SSH host keys automatically.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
96
Configuration of system settings
Showing SSH keys
To show or copy the existing SSH key, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and SSH Keys from the Navigation pane.
The SSH Keys screen appears
Click Show SSH Keys from the Navigation pane.
The SSH Host Keys screen appears.
The keys display in the following formats:
•
RSA1 key—the OpenSSH implementation, except that the line is wrapped.
•
RSA and DSA keys—the SECSH Public Key File Format, as described in Internet Draft draft-ietf-secsh-publicke yfile
--End--
Importing an SSH key from a known host
To import an SSH key from a known host, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Administration and SSH Keys from the Navigation pane.
The SSH Keys screen appears
Click Import .
The New SSH Key screen appears.
Enter a value in the IP Address field.
This field specifies the host from which the SSH key is imported.
Click Save.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
97
Adding an SSH key for a known host
As a convenience, you can paste public SSH keys from remote hosts, so that are not prompted to accept a new key during a later use of SCP or
SFTP for file or data transfer.
To achieve strict man in the middle protection, verify the fingerprint before applying the changes.
To add the public SSH key of a known remote host, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and SSH Keys from the Navigation pane.
The SSH Keys screen appears
Click Add .
The New SSH Key screen appears.
4
5
Click Save.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
98
Configuration of system settings
Variable definitions
Use the data in the following table to add an SSH key for a known host.
Variable
Host name/IP Address
SSH Key
Value
Specifies the host for which you are adding the
SSH key. You can provide a comma-separated list of names and IP addresses for the host.
The SSH key.
Valid formats are:
•
RSA1 keys—the OpenSSH implementation
(native format or with the line wrapped)
•
RSA and DSA keys—the SECSH Public Key
File Format, as described in Internet Draft draft-ietf-secsh-publickeyfile
Managing RADIUS authentication of system users
You can configure the Nortel SNAS cluster to use an external RADIUS server to authenticate system users. Authentication applies to CLI, SREM, and BBI users.
The user name and password defined on the RADIUS server must be the same as the user name and password defined on the Nortel SNAS.
When the user logs on, the RADIUS server authenticates the password.
The user group (admin, oper, or certadmin) is picked up from the local definition of the user.
For more information about specifying user names, passwords, and group assignments for Nortel SNAS system users, see
“Management of system users and groups” (page 275) .
When you add an external RADIUS authentication server to the configuration, the server is automatically assigned an index number. You can add several RADIUS authentication servers, for backup purposes.
Nortel SNAS authentication is performed by an available server with the lowest index number. You can control authentication server usage by reassigning index numbers (see
“Managing RADIUS authentication servers” (page 100) ).
To configure the Nortel SNAS to support RADIUS authentication of system users, use the following procedures:
•
“Configuring RADIUS authentication of system users” (page 99)
•
“Managing RADIUS authentication servers” (page 100)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
99
Configuring RADIUS authentication of system users
To configure RADIUS authentication, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration and RADIUS from the Navigation pane.
The RADIUS screen appears.
3
4
5
Enter the RADIUS authentication information in the applicable fields. The following table describes the RADIUS fields.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to configure RADIUS authentication.
Variable
Status
Value
Enables or disables RADIUS authentication of system users.
The default is disabled.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
100
Configuration of system settings
Variable
Timeout
Fallback
Value
Specifies the timeout interval for a connection request to a RADIUS server. At the end of the timeout period, if no connection is established, authentication fails.
Enter a value to indicate the time interval in seconds. The range is
1–10000 seconds. The default is 10 seconds.
Specifies the desired fallback mode.
Valid options are:
• on—if the RADIUS servers are unreachable, the local passwords defined on the Nortel SNAS are used as fallback.
• off—if the RADIUS servers are unreachable, the only way to access the system is to reinstall the software (boot install).
When checked, the fallback mode is on.
The default is on.
ATTENTION
With the fallback mode set to on, unwanted access to the Nortel SNAS is possible by using a serial cable (if the network cable is disconnected) and the local password.
Managing RADIUS authentication servers
To manage RADIUS authentication servers used by the Nortel SNAS, select Administration and RADIUS from the Navigation pane.
The RADIUS screen appears.
Select from the following tasks to manage the RADIUS authentication servers:
•
“Adding a RADIUS authentication server ” (page 101)
•
“Removing an existing RADIUS server ” (page 102)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
101
To add a new RADIUS authentication server, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and RADIUS from the
Navigation pane.
The RADIUS screen appears.
Click Add.
The Add RADIUS Authentication Server screen appears.
4
5
Click Update.
The RADIUS authentication server appears in the table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
.
Use the data in the following table to add a RADIUS authentication server.
Variable
IP Address
Value
Specifies the IP address of the
RADIUS authentication server.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
102
Configuration of system settings
Variable
Port
Shared Secret
Value
Specifies the TCP port number used for RADIUS authentication. The default is 1813.
Specifies the password used to authenticate the Nortel SNAS to the authentication server.
Confirm the password.
Shared Secret
(again)
Removing an existing RADIUS server
To remove an existing RADIUS authentication server, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Administration and RADIUS from the Navigation pane.
The RADIUS screen appears.
Select the RADIUS server entry to remove from the RADIUS table.
Click Delete.
A dialog box appears, asking for confirmation.
Click OK.
The authentication server entry is immediately removed from the
Radius Server Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring auto blacklisting
To configure auto blacklisting, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration, Auto Blacklisting, and General from the Navigation pane.
The General screen appears.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
103
3
4
Click Update.
The auto blacklisting settings appears in the General screen.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Auto BlackListing
Failed User Purge
Failed Host Purge
Variable definitions
Use the data in the following table to configure auto blacklisting.
Failed User Attempt
Failed Host Attempt
Value
Enables or disables the auto blacklisting settings. (default: disabled)
Specifies allowed number of failed attempts to a user account.
(default: 10/1h attempts/timeperiod)
Specifies allowed number of failed login attempts from a host.
(default: 10/1h attempts/timeperiod)
Specify time period for purging failed user attempt record.
(default: 2d)
Specify time period for purging failed host attempt record.
(default: 2d)
Configuring monitored users
To configure monitored users, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
104
Configuration of system settings
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration, Auto Blacklisting, and Users from the
Navigation pane.
The Monitored Users screen appears.
Click Add.
The Add User screen appears.
Variable
UserName
4
5
Click Update.
The new monitored user appears in the Monitored Users table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add a user.
Value
Specify user names to be monitored. You can specify the user names to be monitored in the following format:
• to monitor users write, comma separated names like: oper,admin
• to monitor all users, enter wild card (*)
• to monitor all users except "root" precede the user with (^) like: ^root
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
105
Configuring monitored hosts
To configure monitored hosts, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration, Auto Blacklisting, and Hosts from the
Navigation pane.
The Monitored Hosts screen appears.
Click Add.
The Add Host screen appears.
4
5
Click Update.
The new monitored host appears in the Monitored Hosts table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Variable
IP Address
Use the data in the following table to add a host.
Value
Specify hosts (IP Addresses) to be monitored. You can specify the hosts to be monitored in the following format:
• to monitor hosts write, comma separated IPs like:
10.10.2.1,10.10.5.2
• to monitor all hosts, enter wild card (*)
• to monitor all hosts except "10.10.1.2" precede the IP
Address with (^) like: ^10.10.1.2
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
106
Configuration of system settings
Deleting monitored users/hosts
To delete monitored users/hosts, use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Administration, Auto Blacklisting, and Users/Hosts from the Navigation pane.
The Monitored Users/Hosts screen appears.
Select the user/host from the Monitored Users/Hosts list.
Click Delete.
A message appears that Are you sure you want to delete selected user/host.
Click OK.
The Auto BlackList User/Host is deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Viewing failed login attempts
To view the details of failed login attempts of users and hosts, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration, Auto Blacklisting, and Show from the
Navigation pane.
The Failed Login Attempts screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
107
3
4
Click Clear, to clear the blacklisted users/hosts.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Nortel SNAS TPS Interface
This supports the blacklisting feature, which allows to configure a time-out value for which the specified user or device is not permitted to connect to the network.
You can blacklist a device using ipv4 or MAC address and set the duration of blacklisting the device.
To view the details of blacklisted devices, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Blacklist from the Navigation pane.
The Blacklist screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
108
Configuration of system settings
3
4
Click Blacklist.
The specified device details that needs to be blacklisted appears in the screen.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to blacklist.
Variable
Enter IPv4 or Mac Address
Enter blacklist duration
Value
Specify the IPv4 or MAC Address to be blacklisted.
Specify the duration to blacklist the device.
Range: 1 minute to 31 days (for example: 20m)
Configuring harden password
Harden Password provides strong password enforcement. To configure harden password, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration and Harden Password from the
Navigation pane.
The Harden Password screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring the cluster
109
3
4
Click Update.
The harden password settings appears in the Harden Password screen.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Harden Password
Variable definitions
Use the data in the following table to configure harden password.
Minimum Password Length
Minimum Number of Lower
Case Characters
Minimum Number of Upper
Case Characters
Minimum Number of Digits
Minimum Number of Other
Characters
Number of Retries
Value
Enables or disables the harden password settings.
(default: disabled)
Specify the minimum length of the password. (Range: 1-511)
Specify the minimum number of lower case characters in the password. (Range: 0-511)
Specify the minimum number of upper case characters in the password. (Range: 0-511)
Specify the minimum number digits in the password.
(Range: 0-511)
Specify the minimum number other characters in the password.
(Range: 0-511)
Specify the number of retries to enter the password.
(Range: 0-15)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
110
Configuration of system settings
Redistributing switches
To redistribute switches, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration and Redistribute Switches from the
Navigation pane.
The Redistribute Switches screen appears.
3
4
5
Enter the harden password information in the applicable fields.
The following table describes the fields of Harden Password screen.
Click Redistribute.
WARNING
Redistribution related operations are directly applied to the database.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
WARNING
Redistributing will affect the switches in all domains.
The changes done are not reversible.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
111
.
Configuration of the domain
This chapter provides detailed procedures to configure domains.
Navigation
•
“Creating a domain” (page 112)
•
“Configuring domain parameters” (page 121)
•
“Deleting a domain” (page 121)
•
“Configuring the Nortel Health Agent check” (page 133)
•
“Configuring the SSL server” (page 138)
•
“Configuring HTTP redirect” (page 144)
•
“Configuring RADIUS accounting” (page 145)
•
“Configuration of location” (page 150)
•
“Configuring Lumension PatchLink integration” (page 154)
Overview of Nortel SNAS domains
A Nortel SNAS domain encompasses all the switches, authentication servers, and remediation servers associated with that Nortel SNAS cluster.
If you run the quick setup wizard during initial setup, Domain 1 is created.
If you do not run the quick setup wizard, you must create at least one domain. For information about creating a domain, see
.
To delete a domain, see
“Deleting a domain” (page 121)
.
ATTENTION
When using the Nortel Secure Network Access Switch Software Release 1.6.1, you cannot configure the Nortel SNAS to have more than one domain.
For more information about configuring the domain, see
“Configure the domain” (page 112) .
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
112
Configuration of the domain
Configure the domain
To configure the domain, select Secure Access Domain from the
Navigation pane. The Secure Access Domain screen appears, displaying a list of existing domains.
From the Secure Access Domain screens, you can configure and manage the following:
• domain parameters such as name and portal IP address (pVIP) (see
“Configuring domain parameters” (page 121)
)
•
Authentication, Authorization, and Accounting (AAA) features
— for authentication, see
“Configuration of authentication” (page 219)
— for authorization, see
“Configuration of groups and profiles” (page
and
“Configuring the Nortel Health Agent check” (page 133)
— for accounting, see
“Configuring RADIUS accounting” (page 145)
• the SSL server used for the domain portal (see
“Configuring the SSL server” (page 138)
)
—
SSL trace commands
—
SSL settings
— logging traffic with syslog messages
• portal settings (see
“Customize the portal and logon” (page 295) )
— captive portal
— portal look and feel
— linksets
• the network access devices (see
“Management of network access devices” (page 45)
)
• the Nortel SNAS VLANs (see
“Management of network access devices” (page 45)
)
•
SSH keys for the domain (see
“Managing SSH keys” (page 53) )
•
HTTP redirect settings (see
“Configuring HTTP redirect” (page 144) )
Creating a domain
You can create a domain by using either of the following procedures:
•
“Manually creating a domain” (page 113)
•
“Using the Domain Quick Wizard” (page 114)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
113
Manually creating a domain
To create and configure a domain manually, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain from the Navigation pane.
The Secure Access Domain screen appears.
Click Add.
The Add Secure Access Domain screen appears.
4
5
Click Create.
The new domain appears in the Secure Access Domain table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Use the data in the following table to configure a domain.
Variable
Identifier
Value
Specifies an integer in the range 1 to
256 that uniquely identifies the domain in the Nortel SNAS cluster.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
114
Configuration of the domain
.
Variable
Name
IP Address
Port
Value
Specifies a string that identifies the domain on the Nortel SNAS. The maximum length of the string is 255 characters.
Specifies the IP address of the Nortel
SNAS portal.
You can have more than one portal for a domain. To specify more than one IP address, use a comma separator.
The IP address is the address to which the client connects for authentication and host integrity check.
Specifies the port on which the portal Web server listens for SSL communications.
The default for HTTPS communicatio ns is port 442.
SSL Status Specifies whether SSL is enabled on the portal server. The default is enabled.
Certificate Number Specifies the server certificate that the portal server uses. You cannot specify more than one server certificate for the server to use at any one time.
Using the Domain Quick Wizard
The Nortel SNAS quick setup wizard is similar to the quick setup wizard available during initial setup.
You can always modify all settings created by the domain quick setup wizard (see
“Configuring domain parameters” (page 121) ).
To create a domain using the Nortel SNAS quick setup wizard, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Wizard from the Navigation pane.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
3
Configure the domain
115
The Wizard screen appears.
Click Domain Quick Wizard.
The Domain Quick Wizard — General Settings screen appears.
4
Click Next.
The Domain Quick Wizard: Configure a Certificate screen appears.
.
5
Three ways exist to specify certificate information: by specifying an existing certificate, by creating a test certificate, or by entering
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
116
Configuration of the domain
6
a new server certificate. The following table describes the
Certificate fields.
Click Next.
The Domain Quick Wizard — Certificate Chain screen appears.
7
8
Enter the certificate chain information in the applicable fields.
The following table describes the Certificate Chain fields.
Click Next.
The Domain Quick Wizard — Switch screen appears.
.
9
10
If you do not want to add a switch at this time, continue with next step.
Click Next.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
117
The Domain Quick Wizard — Nortel Health Agent screen appears.
11
12
Click Finish.
If any information entered is not valid, a dialog box appears describing the errors encountered when completing the wizard processing. Click Back to correct the invalid information before continuing.
If there are no problems, then a dialog box appears to indicate that the wizard is processing the information. The wizard creates the domain, and assigns the following default VLAN IDs:
•
Green VLAN = VLAN ID 110
•
Yellow VLAN = VLAN ID 120
ATTENTION
You can change the VLAN mappings when you add or modify the network access devices (see
“Management of network access devices” (page 45) ).
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Use the data in the following table to create a domain using the Nortel SNAS quick setup wizard.
Variable
General Settings
Value
Domain IP Address Specifies the IP address of the Nortel
SNAS domain.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
118
Configuration of the domain
Variable
Domain Name
Port
Value
Specifies a name for the Nortel SNAS domain.
Specifies the port on which the portal Web server listens for SSL communications.
The default for HTTPS communicatio ns is port 442.
Certificate
Certificate
Test Certificate
Country Code (2 letter code)
State or Province
Locality
Organization
Organization Unit
Specifies an existing certificate from the list.
Specifies that a temporary test certificate is created using information in the related fields.
Specifies the two-letter ISO code for the country where the Web server is located. For current information about
ISO country codes, see www.iana.org
.
Specifies the name of the state or province where the head office of the organization is located. Enter the full name of the state or province.
Specifies the name of the city where the head office of the organization is located.
Specifies the registered name of the organization. The organization must own the domain name that appears in the common name of the Web server.
Do not abbreviate the organization name and do not use any of the following characters:
< > ~ ! @ # $ % ^ * / \ ( ) ?
Specifies the name of the department or group that uses the secure Web server.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Configure the domain
119
Variable
Common Name
Email Address
Subject Alternative
Name
URI
DNS
IP
Valid for days
Key Size
Input Server
Certificate
Server Certificate
Value
Specifies the name of the Web server as it appears in the URL. The name must be the same as the domain name of the Web server that requests a certificate. If the Web server name does not match the common name in the certificate, some browsers refuse a secure connection with your site. Do not enter the protocol specifier (http://) or any port numbers or pathnames in the common name. Wildcards (such as * or ?) and IP address are not allowed.
Specifies the user’s e-mail address.
Specifies alternate information if you did not provide a Common
Name or e-mail address. Enter a comma-separated list of URI:<uri>,
DNS:<fqdn>, IP:<ip-address>, email:<email-address>).
Specify the URI for the certificate.
Specify the domain name.
Specify the IP address.
Specify the email address.
Specifies the number of days a test certificate remains valid.
Specifies the length of the generated key, in bits. Available options are:
•
512
•
1024
•
2048
•
4096
The default value is 1024.
Select this box to create a new certificate by pasting the certificate file from a text editor.
The area where contents of an existing certificate file are pasted when the
Input Server Certificate option is selected.
Chain Certificate
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
120
Configuration of the domain
Variable
CA Chain List
Value
Specifies whether the SSL server uses chain certificates.
Select additional certificates from the list to force the SSL server to use chain certificates.
Server
Create HTTP or
HTTPS Redirect
Server
IP Address of
Switch
NSNA Communicati on Port
Specifies whether or not to create a redirect server for HTTP to HTTPS redirection.
Switch
Configure a Switch Specifies whether or not to add a network access device to the domain.
Type of Switch Specifies the type of network access device from the list. Valid options are
ERS8300, ERS4500, ERS5500 and
ERS5600.
Vlan ID Specifies the Red VLAN ID for the network access device.
Specifies the IP address of the network access device.
Key For Switch
Specifies the TCP port used for communication with the Nortel SNAS.
The default is port 5000.
Allows you to paste in the switch public SSH key if it is not automatically retrieved. Alternatively, you can later import the key from the switch (see
“Managing SSH keys” (page 53) ).
Nortel Health Agent
Nortel Health Agent
Action
Specifies the action performed when an SRS rules check fails. The options are:
• restricted—the session remains intact, but access is resticted in accordance with the rights specified in the access rules for the group.
• teardown—the SSL session is torn down.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
121
Variable
Create Nortel
Health Agent Test
User
Create Nortel
Health Agent
System Test User
Value
Specifies to create Nortel Health Agent test user.
Specifies to create Nortel Health Agent system test user.
Deleting a domain
To delete a domain, use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Secure Access Domain from the Navigation pane.
The Secure Access Domain screen appears.
Select the domain from the Secure Access Domain list.
Click Delete.
A confirmation dialog box appears.
Click OK.
The domain is removed from the Secure Access Domain table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring domain parameters
To configure a domain, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain from the Navigation pane.
The Secure Access screen appears.
Select the domain and click Edit.
The Modify Secure Access Domain screen appears.
Enter the domain information in the applicable fields.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
122
Configuration of the domain
5
6
Click Update to save the changes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Additional domain configuration
The following table describes the purpose of additional domain configurations.
Domain configuration
VLANs
SSH Key
DNS Capture
HTTP Redirect
Description
Accesses the domain VLANs screen, to manage VLAN mappings on the Nortel SNAS domain (see
).
Accesses the domain SSH Key screens, to generate, show, and export the public SSH key for the Nortel SNAS domain (see
SSH keys for the domain” (page 54)
).
Accesses the DNS Capture screen, to set the Nortel SNAS domain portal as a captive portal and to configure the DNS Exclude List
(see
“Configuration of the captive portal” (page
Accesses the HTTP Redirect screen, to configure HTTP to HTTPS redirect settings
(see
“Configuring HTTP redirect” (page 144) ).
The following table describes the purpose of additional tree components found within the Secure Access Domain component.
Component
Portal Display
Description
Accesses the Portal Display screens, to configure links and linksets displayed after client authentication is completed.
For more information, see
.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
123
Component
AAA
Server
Switches
Portal
Description
Accesses the AAA screens, to configure authentication, authorization, and accounting features:
•
For authentication, see
“Configuration of authentication” (page 219)
.
•
For authorization, see
“Configuration of groups and profiles” (page 189)
and
“Configuring the Nortel Health Agent check”
•
For accounting, see
“Configuring RADIUS accounting” (page 145) .
Accesses the Server screens, in order to configure the portal SSL server (see
“Configuring the SSL server” (page 138)
.
Accesses the Switch screens, in order to configure the network access devices controlled by the Nortel SNAS domain (see
“Manage network access devices” (page 46)
).
Accesses the Portal screens, in order to customize the portal page that appears in the client’s Web browser (see
“Customization of the portal and user logon” (page 285)
).
Configuring VIP addresses
To configure a VIP address, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain and VIP Addresses from the
Navigation pane.
The VIP Addresses screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add Portal IP Address screen appears.
Click Add.
The created portal IP address appears in the VIP Addresses table.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
124
Configuration of the domain
6
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
New IP
Variable definitions
Use the data in the following table to add a VIP address.
Value
Specifies the VIP address.
Deleting a VIP address
To delete a VIP address, use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Secure Access Domain and VIP Addresses from the
Navigation pane.
The VIP Addresses screen appears.
Select the VIP address from the VIP Addresses list.
Click Delete.
A dialog box appears to confirm that you want to delete this VIP address.
Click Yes.
The VIP address is removed from the list.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring VLANs
To configure a VLAN, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Variable
Name
Vlan Id
3
4
5
2
6
Configure the domain
125
Select Secure Access Domain and VLANs from the Navigation pane.
The VLANs screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add VLAN screen appears.
Click Add.
The created portal IP address appears in the VIP Addresses table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add a VLAN.
Value
Specifies the Vlan name.
Specifies the Vlan Id.
3
4
Deleting a VLAN
To delete a VLAN, use the following procedure:
Procedure steps
Step
1
2
5
Action
Select the Config tab.
Select Secure Access Domain and VLANs from the Navigation pane.
The VLANs screen appears.
Select the VLAN from the VLANs list.
Click Delete.
A dialog box appears to confirm that you want to delete this
VLAN.
Click Yes.
The VLAN is removed from the list.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
126
Configuration of the domain
6
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Managing DHCP support
The Nortel SNAS acts as a DHCP server for devices connected via hub to
NSNA controlled switch ports. SNAS can also act as a DHCP server in a normal mode or to support captive portal and FILTER-ONLY mode.
Adding a DHCP subnet
To add a DHCP subnet, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, DHCP, and Subnet from the
Navigation pane.
The Subnet screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click the Add button.
The Add DHCP Subnet screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
127
5
6
Click Update to save the details.
The new DHCP subnet appears in the DHCP Subnet table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add a DHCP subnet.
Variable
DHCP Subnet Number
Type
Subnet Name
Subnet network address
Subnet netmask
Subnet Status
Phone Signature
Value
Specifies an integer in the range 1 to 256 that uniquely identifies the DHCP subnet.
Specifies whether the subnet type is hub, filter, or standard.
Specifies the name for the subnet.
Specifies the address to assign
Specifies the subnet to assign
Specifies whether the subnet is enabled or disabled.
Specifies the phone signature for each type of IP phone connected to the network.
External DHCP Server address Specifies the external DHCP IP address to which the clients are directed.
VLAN Name Specifies the name for the VLAN.
Managing a DHCP Subnet
To manage a DHCP subnet, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, DHCP, and Subnet from the
Navigation pane.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Select the DHCP subnet you want to modify and then click Edit.
The Modify DHCP Subnet screen appears.
Modify the required information. For more information about
DHCP Subnet fields.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
128
Configuration of the domain
6
7
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Managing DHCP Ranges
To manage DHCP ranges, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, DHCP, Subnet, Settings, and
Ranges from the Navigation pane.
The Subnet range screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
--End--
From this screen, the following tasks can be performed:
•
To add a new range click Add and enter a new upper and lower range limit.
•
To delete a range select it from the table and click Delete.
•
To change the order of precedence of the ranges, select a range and adjust the position using the Up and Down buttons.
.
Inserting DHCP Ranges
To insert a DHCP range, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, DHCP, Subnet, Settings, and
Ranges from the Navigation pane.
The Subnet screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
4
5
6
7
Configure the domain
129
Click Add.
The Add Subnet Range screen appears.
Enter the subnet range information in the applicable fields. The following table describes the fields on this tab.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Enter Lower Address
Enter Upper Address
Use the data in the following table to insert a DHCP range.
Value
Specifies the lower end of the range.
Specifies the upper end of the range.
Managing DHCP Range Standard Options
To manage DHCP Range Standard Options, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, DHCP, Subnet, Settings, and
Stdopts from the Navigation pane.
The Subnet screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh. A list of existing range standard options table appears.
--End--
From this screen, the following tasks can be performed:
•
To delete DHCP range standard option, select the option you want to delete and click Delete.
•
To add a DHCP range standard new option, click Add.
.
Managing DHCP Vendor Options
To manage DHCP Vendor Options, use the following procedure:
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
130
Configuration of the domain
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, DHCP, Subnet, Settings, and
Vendopts from the Navigation pane.
The Subnet screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh. A list of existing vendor options table appears.
--End--
From this screen, the following tasks can be performed:
•
To delete a vendor option, select the vendor option and click Delete.
•
To add a vendor option, click Add.
Managing DHCP Standard Options
To manage DHCP standard options, perform the followings steps:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, DHCP, Subnet, Settings, and
Stdopts from the Navigation pane.
The Subnet screen appears.
Select the secure access domain from the Secure Access
Domain list and click Refresh. A list of existing standard options table appears.
--End--
From this screen, the following tasks can be performed:
•
To add a standard option, click the Add button.
•
To delete a standard option, select the options from the table and click
Delete.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Configure the domain
131
Using the DHCP Wizard
You can use the DHCP Wizard to create the DHCP subnet. To use the wizard, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
6
7
8
9
10
Select the Config tab.
Select Wizards from the Navigation pane.
The Wizards screen appears.
Click DHCP Wizard.
The DHCP Wizard screen appears.
Select the Secure Access Domain and the DHCP Subnet type.
Click Next.
The Subnet Setting screen appears.
In the fields provided, enter the subnet name, address, and mask.
Click Next.
The Configure DHCP screen appears.
If necessary, select the Change the global DHCP options check box and enter the global DHCP information in the fields provided.
Click Next.
The DHCP Settings screen appears.
If the hub subnet type is selected in step 3, perform the following steps:
•
If IP phones are present on this subnet, select the Are there
any IP phones in this subnet check box and enter the appropriate phone signature in the Phone Signature field.
•
On the same screen, enter the configuration information for the Red, Yellow, and Green partitions.
11
12
If the filter subnet type is selected in step 4, perform the following steps:
•
Enter the subnet start and end IP addresses.
•
Enter the unknown clients DHCP options.
•
Enter the known clients DHCP options.
If the standard subnet type is selected in step 4, perform the following steps:
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
132
Configuration of the domain
13
•
Enter the standard mode subnet IP addresses.
•
Enter the standard mode subnet DHCP options.
Click Finish.
--End--
Viewing DHCP leases
To view information about active DHCP leases, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Monitor, DHCP, and DHCP Lease from the Navigation pane.
The DHCP screen appears.
3
Click List to list the DHCP based on leases.
--End--
Use the data in the following table of DHCP leases.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
133
Variable
DHCP Leases Based on
Value
Select the DHCP leases based on the available values.
Values: All, Address, and Subnet
Viewing DHCP statistics
To view DHCP statistics, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Monitor, DHCP, and DHCP Statistics from the
Navigation pane.
The DHCP screen appears.
3
The DHCP screen shows the DHCP statistics.
--End--
Configuring the Nortel Health Agent check
Before an authenticated client is allowed into the network, the Nortel
Health Agent application checks client host integrity by verifying that the components required for the client’s personal firewall (executables, DLLs,
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
134
Configuration of the domain configuration files, and so on) are installed and active on the client PC. For more information about how the Nortel Health Agent check operates in the
Nortel SNAS, see
“Nortel Health Agent host integrity check” (page 36)
.
If you run the quick setup wizard during the initial setup or to create the domain, the Nortel Health Agent check is configured with default settings and the check result that you select (teardown or restricted). You can rerun the Nortel Health Agent portion of the quick setup wizard at any time by using the steps described in
“Using the Nortel Health Agent Wizard”
.
To configure settings for the Nortel Health Agent host integrity check and the check result, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select the Secure Access Domain, Nortel Health Agent, and
Setup from the Navigation pane.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
The corresponding Nortel Health Agent Settings screen appears.
.
4
Click Update to save the changes.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
5
Configure the domain
135
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure Nortel Health Agent settings.
Variable
Fail Action
Value
Specifies the action performed if the client fails the Nortel Health Agent SRS rule check. The options are:
• restricted—the session remains intact but access is restricted in accordance with the rights specified in the access rules for the group.
• teardown—the SSL session is torn down.
Display SRS Failure Details
Heart Beat Retry Count default: restricted
Specifies whether SRS failure details can be displayed:
•
If selected, then the details are displayed.
•
If not selected, the details are not displayed.
The default is off (details are not displayed).
If set to on, you can click the TG icon on the portal page to display details about which elements of the SRS rule check failed.
Specifies the number of times the Nortel SNAS repeats the check for client activity when no heartbeat is detected.
The acceptable range is an integer from
1–65535. The default is 3.
If no heartbeat is detected after the specified number of retries (the inactivity interval), the
Nortel SNAS terminates the session.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
136
Configuration of the domain
Variable
Recheck Interval
On-the-fly SRS Policy
Allow client script customization
Log Level
Value
Specifies the time interval between SRS rule rechecks made by the Nortel Health Policy
Administrator on the client system.
Accepts an integer that indicates the time interval in seconds ( s
), minutes ( m
), hours ( h
), or days (d). The valid range is 60s (1m) to
86400s (1d). The default is 15m (15 minutes).
If a recheck fails, the Nortel SNAS terminates the session and evicts the client from the portal.
Enables or disables on-the-fly srs policy.
When a security policy is modified on the
SNAS using the administrative tool the policy is updated on the Nortel Health Agent running on the logged in operating systems.
Values: on and off default: off
Enables or disables the client script customization.
Values: on and off default: on
Specifies the log level for debug information from the Nortel Health Policy Administrator.
The options are:
• fatal—shows fatal errors only.
• error—shows all errors.
• warning—shows warning information about conditions that are not error conditions.
• info—shows high-level information about processes.
• debug—shows detailed information about all processes.
The default is info.
The information displays in the client’s Java
Console window. You can use the information to track errors in the Nortel Health Agent SRS rules.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
137
Variable
Heart Beat Interval
Status-Quo
Desktop Agent
Desktop Agent Short Cut
Name
Persist out-of-bound connections
Nortel Health Agent Rules
Table
Value
Specifies the time interval between checks for client activity.
Accepts an integer that indicates the time interval in seconds ( s
), minutes ( m
), hours ( h
), or days (d). The valid range is 60s (1m) to
86400s (1d). The default is 1m (1 minute).
Specifies whether the Nortel SNAS domain operates in status-Quo mode. Status-quo mode determines the behavior of the Nortel
SNAS if no client activity is detected after the inactivity interval.
If selected (Status-Quo on), the client session continues indefinitely.
If not selected (Status-Quo off), the Nortel
SNAS terminates the session immediately.
The default is Status-Quo off (not selected).
Enables or disables the desktop agent.
Values: on and off default: off
Specify the desktop agent name.
default: Nortel Desktop Agent
Enables or disables the out-of-bound connection.
Values: on and off default: on
Lists the SRS rules configured for the domain.
For information about creating SRS rules, see
Nortel Health Policy Administrator SRS Builder.
The Nortel Health Policy Administrator can apply different SRS rules for different groups.
For information about specifying the SRS rule to use for the Nortel Health Agent check, see
“Configuring groups” (page 194)
.
Using the Nortel Health Agent Wizard
To configure settings for the Nortel Health Agent host integrity check and the check result, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
138
Configuration of the domain
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, Nortel Health Agent, and SRS
Rules from the Navigation pane.
The Launch Nortel Health Policy Administrator screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Launch.
The Nortel Health Policy Administrator window appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring the SSL server
To configure settings for the SSL server, use the following procedure:
Procedure steps
Step Action
1
Select Secure Access Domain and Server from the Navigation pane.
The Server screen appears.
2
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
3
4
Configure the domain
139
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure the SSL server.
Variable
Listen Port
Value
Specifies the port to which the portal server listens for HTTPS communications.
DNS Name
Accepts an integer in the range 1–65534 that indicates the TCP port number. The default is
443.
Specifies a DNS name for the portal IP address.
Accepts the fully qualified domain name
(FQDN) of the pVIP (for example, nsnas.example.com).
Generally, you need to specify a DNS name only if your corporate DNS server is unable to perform reverse lookups of the portal IP address.
Backend Interface
When you click Apply after specifying the
DNS name, the system performs a check against the DNS server included in the system configuration to verify that:
• the FQDN is registered in the DNS.
• the resolved IP address corresponds to the pVIP.
Specifies the backend interface.
Configuring SSL settings
To configure SSL-specific settings for the portal server, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
140
Configuration of the domain
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Server, and SSL from the
Navigation pane.
The SSL screen appears.
3
4
5
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Updated to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Variable definitions
Use the data in the following table to configure the server SSL-specific settings.
Variable
Certificate Number
Value
Specifies the server certificate that the portal server uses. You cannot specify more than one server certificate for the server to use at a time.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Variable
Status
Protocol
Ciphers
Verify Level
SSL Cache Size
Configure the domain
141
Value
Specifies whether SSL is enabled on the portal server. The default is enabled.
Specifies the protocol to use when establishing an SSL session with a client. The options are:
• ssl2 — accept SSL 2.0 only
• ssl3 — accept SSL 3.0 and TLS 1.0
• ssl23 — accept SSL 2.0, SSL 3.0, and TLS
1.0
• tls1 — accept TLS 1.0 only
Specifies the cipher preference list.
Allows expressions that consists of cipher strings separated by colons. The default cipher list is ALL@STRENGTH.
Specifies the level of client authentication to use when establishing an SSL session. The options are:
• none—no client certificate is required.
• optional—a client certificate is requested, but the client need not present one.
• require—a client certificate is required.
Not supported in Nortel Secure Network
Access Switch Software Release 1.6.1.
Specifies the size of the SSL cache.
Allows an integer less than or equal to 10000 indicating the number of cached sessions. The default is 4000.
If there are many cache misses, increase the
Cache Size value for better performance.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
142
Configuration of the domain
Variable
SSL Cash Timeout
CA Certificate List
CA Chain List
Value
Specifies the maximum time to live (TTL) value for items in the SSL cache. After the TTL has expired, the items are discarded.
Allows an integer that indicates the TTL value in seconds ( s
), minutes ( m
), hours ( h
), or days
(d). If you do not specify a measurement unit, seconds is assumed. The default is 5m (5 minutes).
Specifies which of the available CA certificates to use for client authentication.
CA Certificate List is not supported in Nortel
Secure Network Access Switch Software
Release 1.6.1.
Specifies the CA certificate chain of the server certificate.
Select certificates from the list to create the chain. The chain starts with the issuing CA certificate of the server certificate and can range up to the root CA certificate.
ATTENTION
To use chain certificates on the SSL server, you must set the protocol version to either ssl3 or ssl23.
Configuring traffic log settings
You can configure a syslog server to receive User Datagram Protocol
(UDP) syslog messages for all HTTP requests handled by the portal server.
Nortel does not recommend that you routinely enable this functionality for the following reasons:
•
Logging traffic with syslog messages generates a substantial amount of network traffic.
•
Logging traffic places an additional CPU load on each Nortel SNAS device in the cluster.
•
In general, syslog servers are not intended for the traffic type of log message. Therefore, the syslog server might not be able to cope with the quantity of syslog messages generated within a cluster of Nortel
SNAS devices.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
143
Enable traffic logging with syslog messages in environments where laws or regulations require traffic logging to be performed on the SSL terminating device itself. You can also enable it temporarily for debugging purposes.
Because of the amount of traffic generated, Nortel recommends that you set up syslog on the backend server if possible.
To set up a syslog server to receive UDP syslog messages for all HTTP requests handled by the portal server, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Server, and Traffic Log from the Navigation pane.
The Traffic Log screen appears.
3
4
5
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to configure the traffic log settings.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
144
Configuration of the domain
Variable
Status
Syslog Host IP
Syslog Port
Syslog Priority
Value
Enables or disables traffic logging with syslog messages to the specified syslog server.
Traffic logging with syslog messages is disabled by default.
Specifies the host IP address of the syslog server.
Specifies the UDP port number of the syslog server.
Accepts an integer in the range
1–65534, which indicates the UDP port number. The default is 514.
Specifies the priority level of the syslog messages that are sent. The options are:
• debug—information useful for debugging purposes only.
• info—informational messages.
• notice—information about conditions that are not error conditions but nevertheless warrant special attention.
The default value is info.
Configuring HTTP redirect
You can configure the Nortel SNAS domain to automatically redirect HTTP requests to the HTTPS server. For example, a client request directed to http://nsnas.com is automatically redirected to https://nsnas.com.
To configure the domain to automatically redirect HTTP requests to the
HTTPS server specified for the domain, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and HTTP Redirect from the
Navigation pane.
The HTTP Redirect screen appears.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
145
3
4
5
Select the secure access domain from the Secure Access
Domain list and click Refresh.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure the HTTP Redirect.
Variable
Port Number
Enable Http Redirect
Value
Specifies the TCP port number on which the portal server listens for HTTP communications. The default value is 80.
ATTENTION
If you do not accept the default value and you specify a different port, you must modify the Red and Yellow filters on the network access devices accordingly. Otherwise, the client PC is not able to reach the portal for user authentication.
Specifies whether HTTP requests are redirected to the HTTPS server.
Configuring RADIUS accounting
You can configure the Nortel SNAS to provide support for logging administrative operations and user session start and stop messages to a
RADIUS accounting server.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
146
Configuration of the domain
With RADIUS accounting enabled, the Nortel SNAS sends an accounting request start packet to the accounting server for each user who successfully authenticates to the Nortel SNAS domain. The start packet contains the following information:
• client user name
•
Nortel SNASRIP
• session ID
When the user session terminates, the Nortel SNAS sends an accounting request stop packet to the accounting server. The stop packet contains the following information:
• session ID
• session time
• cause of termination
Configure the RADIUS server in accordance with the recommendations in
RFC 2866.
Certain Nortel SNAS-specific attributes are sent to the RADIUS server when you enable accounting (see
“Configuring Nortel SNAS specific attributes” (page 146)
). In conjunction with the custom plugins on RADIUS, you can use these attributes for more detailed monitoring of Nortel SNAS activity.
When you add an external RADIUS accounting server to the configuration, the server is automatically assigned an index number. Nortel SNAS accounting is performed by an available server with the lowest index number. You can control accounting server usage by reassigning index numbers (see
“Managing RADIUS accounting servers” (page 148)
).
Configuring Nortel SNAS specific attributes
The RADIUS accounting server uses Vendor-Id and Vendor-Type attributes in combination to identify the source of the accounting information. The attributes are sent to the RADIUS accounting server together with the accounting information for the logged on user.
You can assign vendor-specific codes to the Vendor-Id and Vendor-Type attributes for the Nortel SNAS domain. By using these vendor-specific codes, the RADIUS accounting server can provide separate accounting information for each Nortel SNAS domain.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure the domain
147
Each vendor has a specific dictionary. The Vendor-Id specified for an attribute identifies the dictionary that the RADIUS server uses to retrieve the attribute value. The Vendor-Type indicates the index number of the required entry in the dictionary file.
The Internet Assigned Numbers Authority (IANA) designates SMI Network
Management Private Enterprise Codes that can be assigned to the
Vendor-Id attribute (see www.iana.org/assignments/enterprise-numbers ).
RFC 2866 describes the usage of the Vendor-Type attribute.
Contact your RADIUS system administrator for information about the vendor-specific attributes used by the external RADIUS accounting server.
To configure vendor-specific attributes in order to identify the Nortel SNAS domain, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA, and Radius Accounting from the Navigation pane.
The RADIUS Accounting screen appears.
3
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
148
Configuration of the domain
4
5
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to configure the
RADIUS Accounting.
Variable
Status
Vendor Id
Value
Specifies whether RADIUS accounting is enabled or not.
Specifies the vendor-specific attribute used by the RADIUS accounting server to identify accounting information from the
Nortel SNAS domain.
Vendor Type
The default Vendor-Id is 1872
(Alteon).
Specifies the Vendor-Type value used in combination with the
Vendor-Id to identify accounting information from the Nortel SNAS domain.
The default Vendor-Type value is 3.
Managing RADIUS accounting servers
There are two steps to manage RADIUS accounting servers:
•
“Adding a RADIUS accounting server” (page 148)
•
“Deleting a RADIUS accounting server” (page 150)
To configure the Nortel SNAS to use external RADIUS accounting servers, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
2
3
4
Configure the domain
149
Select Secure Access Domain, AAA, Radius
Accounting, and Radius Accounting Servers from the Navigation pane.
The Radius Accounting Servers screen appears.
Select the secure access domain from the
Secure Access Domain list, and click Refresh.
Click Add.
The Add RADIUS Accounting Server screen appears.
5
6
Click Update.
The RADUIS accounting server appears in the
Radius Accounting Server table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to configure the
RADIUS Accounting server.
Variable
IP Address
Port
Value
Specifies the IP address of the accounting server.
Specifies the TCP port number used for RADIUS accounting. The default is
1813.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
150
Configuration of the domain
Variable
Shared Secret
Value
Specifies the password used to authenticate the Nortel SNAS to the accounting server.
Confirm the password.
Shared Secret
(again)
Deleting a RADIUS accounting server
To delete a RADIUS accounting server entry, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
6
7
Select the Config tab.
Select Secure Access Domain, AAA, Radius Accounting, and
Radius Accounting Servers from the Navigation pane.
The Radius Accounting Servers screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Select the RADIUS accounting server entry from the list.
Click Delete.
A confirmation dialog box appears.
Click OK.
The RADUIS accounting server is removed from the Radius
Accounting Server table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Configuration of location
This section contains the following sections:
Configuration of location navigation
•
“Creating a location” (page 151)
•
“Editing a location” (page 151)
•
“Deleting a location” (page 152)
•
“Creating locations” (page 153)
•
“Deleting locations” (page 154)
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuration of location
151
Creating a location
To create and configure location, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain and Location from the
Navigation pane.
The Add Location screen appears.
Click Add.
The Add Location screen appears.
4
5
Click Create Location.
The new location appears in the Location table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Location Number
Name
Variable definitions
Use the data in the following table to add a location.
Value
Specifies the location number.
Specify the name of the location.
Editing a location
To edit a location, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
152
Configuration of the domain
3
4
5
6
1
2
Procedure steps
Step Action
7
Select the Config tab
Select Secure Access Domain and Location from the
Navigation pane.
The Location screen appears.
Select the location from the Location list.
Click Edit.
The Modify Location screen appears.
Enter the location information in the applicable fields.
Click Update Location.
Changes appears in the Location table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Deleting a location
To delete a location, use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Secure Access Domain and Location from the
Navigation pane.
The Location screen appears.
Select the location from the location list.
Click Delete.
A message appears that Are you sure you want to delete all
Locations.
Click OK.
The location(s) deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuration of location
153
Creating locations
You can configure groupings of NSNAS controlled switches as the basis for identity/location networking. Network access is granted or denied based on the identity and the location of the user. To grant and deny the network access for the particular ip address and unit/port specify the ip address and unit/port of a switch.
To create and configure locations, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Location, and Locations from the Navigation pane.
The Locations screen appears.
3
4
Click Create Location List.
The new location list appears in the Locations table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add locations.
Value
Specify the switch IP address.
Specify the unit/port for the switch.
Variable
Switch IP
Unit/Port
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
154
Configuration of the domain
Deleting locations
To delete location(s), use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Secure Access Domain, Location, and Locations from the Navigation pane.
The Locations screen appears.
Select the locations from the locations list.
Click Delete.
A message appears that Are you sure you want to delete all
Location list.
Click OK.
The location(s) deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Configuring Lumension PatchLink integration
Nortel SNAS is integrated with the Lumension PatchLink security patch management system, which allows to proactively enforce user and device compliance by ensuring that devices are properly patched and up-to-date.
PatchLink server is a patch and vulnerability management solution. It works in an Agent mode, where an installed agent (system service) communicates to a central PatchLink server and updates the system as and when patches are available. PatchLink solution is integrated to verify the compliance status of the client with Nortel SNAS.
To create and configure patch link server, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain and Patch Link from the
Navigation pane.
The Patch Link screen appears.
Click Add.
The Add PatchLink Server screen appears.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring Lumension PatchLink integration
155
4
5
Click Update.
The new patchlink server appears in the Patch Link table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure a patchlink server.
Variable
IP Address
Username
Password
Value
Specify the IP address for the patch link server.
Specify the user name.
Specify the password.
Deleting a patch link server
To delete a patch link server, use the following procedure:
Procedure steps
Step
1
2
3
Action
Select the Config tab.
Select Secure Access Domain and Patch Link from the
Navigation pane.
The Patch Link screen appears.
Select the patch link server from the Patch Link list.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
156
Configuration of the domain
4
5
6
Click Delete.
A message appears that Are you sure you want to delete all
PatchLink Servers.
Click OK.
The PatchLink Server(s) deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring syslog server
To configure a syslog server for a domain, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Secure Access Domain and Syslog from the Navigation pane.
The Secure Access Domain screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New Remote Server screen appears.
Click Update.
The server appears in the secure access domain table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add a syslog server for a domain.
Variable
New Server IP
New Server Facility
Value
Specifies the server IP address.
Specifies the server facility.
Inserting a syslog server
To insert a syslog server for a domain, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring syslog server
157
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Secure Access Domain and Syslog from the Navigation pane.
The Secure Access Domain screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Insert.
Insert Remote Server screen appears.
Click Update.
The server appears in the secure access domain table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Deleting a syslog server
To delete a syslog server for a domain, use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
6
Select the Config tab.
Select Secure Access Domain and Syslog from the Navigation pane.
The Secure Access Domain screen appears.
Select the server from the list.
Click Delete.
A dialog box appears to confirm that you want to delete this server.
Click Yes.
The remote server is deleted from the list.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
158
Configuration of the domain
Configuring advanced settings
To configure advanced settings for a domain, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
6
Select the Config tab.
Select Secure Access Domain and Advanced from the
Navigation pane.
The Secure Access Domain screen appears.
Select the secure access domain from the Secure Access
Domain list and click Refresh.
Enter the information in the respective fields.
Click Update.
The server appears in the secure access domain table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure advanced settings for a domain.
Variable
Backend Interface
Value
Specifies the backend interface.
Use common Authentication
Servers
Enables or disables the authentication server.
Values: enabled and disabled
Default: disabled
Use common Accounting Servers Enables or disables the accounting server.
Values: enabled and disabled
Default: disabled
Log Options Specifies the log options.
Values: all, http, portal, and reject
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Configuration of Microsoft NAP
Interoperability
This chapter provides detailed procedures to configure Network Access
Protection (NAP) interoperability.
Navigation
•
“Overview of NAP interoperability” (page 159)
•
159
Overview of NAP interoperability
Microsoft Network Access Protection (NAP), introduced with Windows
Vista and Windows Server is a new set of operating system components that provides a platform for protected access to private networks. The
NAP platform provides an integrated way of detecting the health state of a network client, which attempts to connect to a network and restricts the access of the network client until the policy requirements for connecting to the network are met.
The NSNA NAP interoperability architecture allows you to deploy both the
NSNA solution and the Network Access Protection (NAP) in a symbiotic manner. It also allows you to enforce security policies for network access using NSNA and NAP together, leveraging the strengths of both products.
It also deploys the NAP clients with or without a Microsoft NPS server present on your network. If the Microsoft NPS server is available, it is consulted and its response are used in a configurable way to enhance the access decision made by the Nortel SNAS. If your system does not contain a Microsoft NPS server in place, it can still deploy clients with NAP support enabled and then adds a Microsoft NPS server if desired.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
160
Configuration of Microsoft NAP Interoperability
Windows 802.1x Supplicant—The Nortel Health Agent integrated with the Microsoft NAP Agent provides a robust EAP supplicant for Windows
Vista and XP Operating Systems.
Configuring NAP
To configure NAP, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and NAP from the Navigation pane.
The NAP screen appears.
3
4
5
Enter the general settings information in the applicable fields.
The following table describes the fields of NAP screen.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring NAP
161
Variable definitions
Use the data in the following table to configure NAP.
Variable
General Settings
Value
Automatic Remediation Sets necessary updates to allow a noncompliant computer to become compliant.
Values: false and true default: false
Policy Decision Point
ATTENTION
When Automatic Remediation is set to false Policy Decision Point and
Trouble Shooting URL fields will be disabled.
Select the policy decision point.
Values: local and remote default: local
Specify the trouble shooting url.
Trouble Shooting URL
Probation Settings
Full Access for a
Limited Time
Date
Time
Enables or disables the full access for a limited time.
Values: enabled and disabled default: disabled
Specify the probation date.
Specify the probation time.
Configuring NAP navigation
This section contains the following sections:
•
“Configuring windows system health validators” (page 161)
•
“Creating a remote policy server” (page 164)
•
“Creating a system health validator” (page 167)
Configuring windows system health validators
To configure windows system health validators, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
162
Configuration of Microsoft NAP Interoperability
2
Select Secure Access Domain, NAP, and Windows System
Health Validators from the Navigation pane.
The Windows System Health Validators screen appears.
3
4
5
Select the secure access domain from the Secure Access
Domain list and click Refresh.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
General Settings
Firewall application
Variable definitions
Use the data in the following table to configure Windows System Health
Validators.
Value
Enables or disables the firewall application.
Values: on and off default: on
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring NAP
163
Variable
Automatic update
Value
Enables or disables the automatic updates.
Values: on and off default: on
Virus Protection
Antivirus
Antivirus is up to date
Enables or disables the antivirus.
Values: on and off default: on
Specifies whether the antivirus is up to date or not.
Values: true and false default: true
Spyware
Antispyware
Antispyware is up to date
Enables or disables the antispyware.
Values: on and off default: on
Specifies whether the antispyware is up to date or not.
Values: true and false default: true
Security Updates Protection
Security Updates
Protection
Enables or disables the Windows System Health Verifier (WSHV) to validate the Windows endpoint’s current software security patch levels. Microsoft Windows security update patches are Windows update patches that fix specific software security vulnerabilities.
Values: true and false
If set to "true" the Windows security patch levels on the endpoint becomes a criteria item for policy compliance.
If set to "false," Windows security patch levels reported by the endpoint are ignored.
default: false
Security Updates Severity Security Updates Severity instructs the Windows System Health
Verifier (WSHV) to validate the minimum level of all Windows security update patches on the Windows endpoint. For instance, if the Security Updates Severity is set to "critical" the Windows endpoint must have all Microsoft Windows security update patches designated by the Microsoft Research Center as "critical" installed for the endpoint to be considered policy complaint.
If the Security Updates Severity is set to "important" the Windows endpoint must have security update patches designated as
"important" or higher installed to be considered policy complaint (so all updates designated as either "important" or "critical").
This setting is only applicable when Security Updates Protection is
"true."
Values: critical, important, moderate, low, and all default: important
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
164
Configuration of Microsoft NAP Interoperability
Variable
Duration allowed since last sync
Value
Designates the duration of time allowed to pass since the Windows endpoint was last updated its own copy of its Windows security update list from its security update source (Windows Update or
Windows Server Update Service). Only if the Windows endpoint has synchronized its security update information from its update source within this time is the endpoint considered policy compliant.
This setting is only applicable when Security Updates Protection is
"true." default: 86400 seconds (1 day)
Updates from WSUS
Windows Update
Designates whether Windows Server Update Service (WSUS) is an acceptable source for endpoints to obtain their Windows security update information. When the endpoint reports its security update status, it will do so with respect to the security updates it knows about (local copy) and the source where it obtained its security updates.
Values: true and false
If set to "true" the WSHV considers WSUS as an acceptable source for the endpoint and accepts the endpoint’s security update status.
This setting is only applicable when Security Updates Protection is
"true." default: false
Designates whether Microsoft’s Windows Update is an acceptable source for endpoints to obtain their Windows security update information. When the endpoint reports its security update status, it will do so with respect to the security updates it knows about (local copy) and the source where it obtained its security updates.
Values: true and false
If set to "true" the WSHV considers Windows Update as an acceptable source for the endpoint and accepts the endpoint’s security update status.
This setting is only applicable when Security Updates Protection is
"true." default: false
Creating a remote policy server
To create and configure a NAP policy server, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, NAP, and Remote Policy
Servers from the Navigation pane.
The Remote Policy Servers screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
3
Click Add.
The Add NAP Server screen appears.
Configuring NAP
165
4
5
6
Click Update to save the changes.
Move Server from moves the value by number, From Index values to To Index values.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add a NAP server.
Variable
IP Address
Port
Shared Secret
Shared Secret (again)
Value
Specify the IP address for the NAP server.
Specify the port for the NAP server.
Specify the shared secret for the NAP server.
Reconfirm the shared secret.
Editing a remote policy server
To edit a policy server, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
166
Configuration of Microsoft NAP Interoperability
2
3
4
5
6
7
Select Secure Access Domain, NAP, and Remote Policy
Servers from the Navigation pane.
The Remote Policy Servers screen appears.
Select the server from the Remote Policy Servers list.
Click Edit.
The Modify NAP Server screen appears.
Enter the server information in the applicable fields.
Click Update.
Changes appears in the Remote Policy Servers list.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Moving a remote policy server
To move a remote policy server, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, NAP, and Remote Policy
Servers from the Navigation pane.
The Remote Policy Servers screen appears.
Move Server from moves the value by number, From Index values to To Index values.
Click Move.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Deleting a remote policy server
To delete a remote policy server, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
2
3
4
5
Configuring NAP
167
Select Secure Access Domain, NAP, and Remote Policy
Servers from the Navigation pane.
The Remote Policy Servers screen appears.
Select the policy server from the Remote Policy Servers list.
Click Delete.
The Server is deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Creating a system health validator
To create and configure system health validator, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, NAP, and System Health
Validators from the Navigation pane.
The System Health Validators screen appears.
.
3
4
5
6
Select the secure access domain from the Secure Access
Domain list and click Refresh.
Click Add.
The Add System Health Validator screen appears.
Click Update to save the changes.
Move System Health Validator from moves the value by number, From Index values to To Index values.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
168
Configuration of Microsoft NAP Interoperability
7
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Vendor ID
Component ID
Module Name
Variable definitions
Use the data in the following table to add a system health validator.
Value
Specify the vendor id.
Specify the component id.
Specify the module name.
Editing a system health validator
To edit a location, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
7
Select the Config tab
Select Secure Access Domain, NAP, and System Health
Validators from the Navigation pane.
The System Health Validators screen appears.
Select the Health Validator from the System Health Validators list.
Click Edit.
The Modify System Health Validators screen appears.
Enter the health validator information in the applicable fields.
Click Update.
Changes appears in the System Health Validators list.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Moving a system health validator
To move system health validator, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring NAP
169
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, NAP, and System Health
Validators from the Navigation pane.
The System Health Validators screen appears.
Move System Health Validator from moves the value by number, From Index values to To Index values.
Click Move.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Deleting a system health validator
To delete system health validator, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, NAP, and System Health
Validators from the Navigation pane.
The System Health Validators screen appears.
Select a system health validator from the System Health
Validators list.
Click Delete.
The server is deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
170
Configuration of Microsoft NAP Interoperability
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Configuration of RADIUS server
This chapter provides detailed procedures to configure RADIUS server.
Navigation
•
“Overview of RADIUS server” (page 171)
•
“802.1x functionality” (page 171)
•
“Configure RADIUS server” (page 171)
171
Overview of RADIUS server
The Nortel SNAS is integrated with full featured RADIUS server. The
RADIUS server is used to authenticate users through PAP or CHAP authentication methods. It also works in a more complex 802.1x
environment, which supports EAP-MD5, TLS, PEAP, and TTLS authentication methods.
Radius server configuration includes the RADIUS realms, clients, authentication methods, EAP authentication methods, dictionary, accounting logs, and accounting ports components.
802.1x functionality
Integration of RADIUS server with the Nortel Health Agent’s 802.1x
supports 802.1x for user authentication and health assessment in the
Nortel SNAS.
Configure RADIUS server
To create and configure a RADIUS server, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
172
Configuration of RADIUS server
2
Select Secure Access Domain and RADIUS Server from the
Navigation pane.
The RADIUS Server screen appears.
3
4
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure RADIUS server.
Variable
Authentication Port
Value
Specify the authentication port. (default: 1812)
Accounting Port
Server Certificate
Server CA Certificate
Specify the accounting port. (default: 1813)
Select the server certificate from the list.
Select the server CA certificate from the list.
Configuring RADIUS server navigation
This section contains the following sections:
•
“Creating a client” (page 173)
•
•
“Creating an authentication method” (page 178)
•
“Creating an EAP authentication method” (page 180)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure RADIUS server
173
•
“RADIUS server dictionary” (page 183)
•
“Exporting accounting log” (page 185)
Creating a client
To create and configure a RADIUS Client, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and Client from the Navigation pane.
The Client screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add Radius Client screen appears.
5
6
7
Enter the client information in the applicable fields. The following table describes the fields to Add Radius Client.
Click Update.
The new client appears in the Client table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
174
Configuration of RADIUS server
Variable
Client IP Address
Shared Secret
Variable definitions
Use the data in the following table to add RADIUS client.
Value
Specify the client IP Address.
Specify the shared secret for the radius client.
Inserting a Client
To insert a RADIUS Client, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and Client from the Navigation pane.
The Client screen appears.
Click Insert.
The Insert Radius Client screen appears.
Click Update.
The new client appears in the Client table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Identifier
Client IP Address
Shared Secret
Use the data in the following table to insert a RADIUS client.
Value
Specify the index to insert. Index must be a positive number.
Specify the client IP Address.
Specify the shared secret for the radius client.
Moving the RADIUS client
To move RADIUS Client, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
2
3
4
5
Configure RADIUS server
175
Select Secure Access Domain, RADIUS Server, and Client from the Navigation pane.
The Client screen appears.
Move Radius Client from moves the value by number, From
Index values to To Index values.
Click Move.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Deleting a Client
To delete a RADIUS Client, use the following procedure:
3
4
1
2
Procedure steps
Step Action
5
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and Client from the Navigation pane.
The Client screen appears.
Select the client from the Client list.
Click Delete.
The Clients(s) deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Creating a realm
To create and configure a realm, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and Realms from the Navigation pane.
The Realms screen appears.
Click Add.
The Add RADIUS Proxy Realm screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
176
Configuration of RADIUS server
4
5
Click Update to save the changes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add a realm.
Variable
Name
Authentication Server
Value
Specify a realm name.
Select the authentication server id. It displays the list based on the authentication servers configured on the device.
Inserting a realm
To insert a RADIUS Realm, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and Realms from the Navigation pane.
The Realms screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Insert.
The Insert RADIUS Proxy Realm screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
5
6
Configure RADIUS server
177
Click Update.
The new realm appears in the Realms table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Identifier
Name
Authentication Server
Use the data in the following table to insert a realm.
Value
Specify the index to insert. Index must be a positive number.
Specify a realm name.
Select the authentication server id. It displays the list based on the authentication servers configured on the device.
Moving a realm
To move RADIUS realm, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and Realms from the Navigation pane.
The Realms screen appears.
Move Realm from moves the value by number, From Index values to To Index values.
Click Move.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Deleting a realm
To delete a realm, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
178
Configuration of RADIUS server
2
3
4
5
Select Secure Access Domain, RADIUS Server, and Realms from the Navigation pane.
The Realms screen appears.
Select the realm from the Realms list.
Click Delete.
The Realms(s) deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Creating an authentication method
To create and configure a authentication method, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Authentication Methods from the Navigation pane.
The Authentication Methods screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add Authentication Method screen appears.
Click Update to save the changes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add Authentication Method.
Variable
Authentication Method
Name
Value
Specify the authentication method name.
Inserting an authentication method
To insert a authentication method, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure RADIUS server
179
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Authentication Methods from the Navigation pane.
The Authentication Methods screen appears.
Select the secure access domain from the Secure Access
Domain list and click Refresh.
Click Insert.
The Insert Authentication Method screen appears.
Click Update.
The new authentication method appears in the Authentication
Methods table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Identifier
Authentication Method Name
Use the data in the following table to insert the authentication method.
Value
Specify the index to insert. Index must be a positive number.
Specify the authentication method name.
Moving an authentication method
To move an authentication method, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Authentication Methods from the Navigation pane.
The Authentication Methods screen appears.
Move Authentication Method from moves the value by number, From Index values to To Index values.
Click Move.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
180
Configuration of RADIUS server
5
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Deleting an authentication method
To delete a authentication method, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Authentication Methods from the Navigation pane.
The Authentication Methods screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Select the authentication method from the Authentication
Methods list.
Click Delete.
The Authentication Method(s) deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Creating an EAP authentication method
To create and configure an EAP authentication method, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and EAP
Authentication Methods from the Navigation pane.
The EAP Authentication Methods screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add EAP Authentication Method screen appears.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
5
6
Configure RADIUS server
181
Click Update to save the changes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
EAP Authentication
Method Type
EAP Authentication
Module Name
Variable definitions
Use the data in the following table to add EAP authentication method.
Value
Specify the EAP authentication method type.
Specify the EAP authentication module name.
Inserting an EAP authentication method
To insert an EAP authentication method, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and EAP
Authentication Methods from the Navigation pane.
The Authentication Methods screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Insert.
The Insert Authentication Method screen appears.
Click Update.
The new authentication method appears in the Authentication
Methods table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Variable
Identifier
Use the data in the following table to insert EAP authentication method.
Value
Specify the index to insert. Index must be a positive number.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
182
Configuration of RADIUS server
Variable Value
EAP Authentication Method Type Specify the EAP authentication method type.
EAP Authentication Module Name Specify the EAP authentication module name.
Moving an EAP authentication method
To move an EAP authentication method, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Authentication Methods from the Navigation pane.
The Authentication Methods screen appears.
Move Authentication Method from moves the value by number, From Index values to To Index values.
Click Move.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Deleting an EAP authentication method
To delete an EAP authentication method, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and EAP
Authentication Methods from the Navigation pane.
The EAP Authentication Methods screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Select the EAP authentication method from the EAP
Authentication Methods list.
Click Delete.
The Authentication Method(s) deleted successfully message appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
6
Configure RADIUS server
183
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
RADIUS server dictionary
You can view, reset, import, and export the dictionary. This section includes the following section:
•
“Resetting the dictionary” (page 183)
•
“Importing or exporting a dictionary” (page 183)
•
“Viewing a dictionary” (page 184)
•
“Deleting a dictionary” (page 185)
Resetting the dictionary
The two options "Vendor Specific" and "Standard Dictionary" are available in this page.
To reset the dictionary to defaults, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Dictionary from the Navigation pane.
The Dictionary screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Set Default, to reset the dictionary to deafults. This will reset the dictionary to defaults and will take a few minutes. Do you want to proceed?
Click OK to proceed. Loaded default RADIUS Attributes message appears. It displays the Vendor ID and Vendor Name.
--End--
Importing or exporting a dictionary
To import or export a dictionary from TFTP/FTP/SCP/SFTP, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
184
Configuration of RADIUS server
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Dictionary from the Navigation pane.
The Dictionary screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
To import a dictionary, click Import.
or
To export a dictionary select a vendor, click Export.
The Import / Export dictionary screen appears.
Click Import / Export to import or export the dictionary.
--End--
Variable
Protocol
Server
File
Use the data in the following table to Imoprt or Export dictionary.
Value
Select the protocol to import the dictionary.
Values: tftp, ftp, scp, and sftp (default: tftp)
Specify the hostname or IP address of the server.
Specify the filename on the server.
Viewing a dictionary
To view the details of a vendor directory, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Dictionary from the Navigation pane.
The Dictionary screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
4
Configure RADIUS server
185
To view the details of a vendor, select the vendor from the
Dictionary list and click Show.
--End--
Deleting a dictionary
To delete a vendors dictionary, use the following procedure:
3
4
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Dictionary from the Navigation pane.
The Dictionary screen appears.
Select the vendor to delete dictionary from the Dictionary list.
Click Delete. Are you sure you want to delete the selected dictionar(ies) message appears click OK.
The Dictionary(ies) deleted successfully message appears.
--End--
Exporting accounting log
To export accounting log, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, RADIUS Server, and
Accounting from the Navigation pane.
The Accounting screen appears.
Select the secure access domain from the Secure Access
Domain list and click Refresh.
Click Export.
The Export Accounting Log screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
186
Configuration of RADIUS server
5
Click Export to export the accounting log.
--End--
Variable
Protocol
Variable definitions
Use the data in the following table to Export Accounting log.
Value
Select the protocol to import the dictionary.
Values: tftp, ftp, scp, sftp (default: tftp)
Server
File
FTP User
FTP Password
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specify the hostname or IP address of the server.
Specify the filename on the server.
Specify the FTP User name.
Specify the FTP password.
Clearing accounting log
To clear accounting log, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
2
3
4
Configure RADIUS server
187
Select Secure Access Domain, RADIUS Server, and
Accounting from the Navigation pane.
The Accounting screen appears.
Click Clear.
Cleared accounting log message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
188
Configuration of RADIUS server
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Configuration of groups and profiles
189
This chapter provides detailed procedures to configure groups and profiles.
Navigation
•
“Overview of groups, profiles, and access rules” (page 189)
•
•
“Configuring groups and extended profiles” (page 193)
Overview of groups, profiles, and access rules
This section gives an overview of groups, profiles, and access rules.
For more information about the groups and extended profiles of the Nortel
SNAS, see Nortel Secure Network Access Switch 2.0 Solution Guide ()
(NN47230-200).
Overview of groups, profiles, and access rules navigation
•
•
•
“Nortel Health Agent SRS rule” (page 191)
•
“Extended profiles” (page 191)
Groups
The Nortel SNAS determines, which VLANs users are authorized to access, based on group membership.
When a user logs on to the Nortel SNAS domain, the authentication method returns the group name associated with the user’s credentials.
The Nortel SNAS then maps the user to groups defined on the Nortel
SNAS. You can define up to 1023 groups in the Nortel SNAS domain.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
190
Configuration of groups and profiles
The data of each group includes the following configurable parameters:
• linksets
•
Nortel Health Agent SRS rule
• extended profiles
After the user is authenticated, the Nortel SNAS checks the groups defined for the domain to match the group name returned from the authentication database. For the duration of the user’s logon session, the Nortel SNAS maintains a record of the group matched to the user.
When the Nortel SNAS identifies the matching group, it applies group data to the user as follows:
• linksets—All linksets configured for the group of which the user is a member display on the user’s portal page (see
•
Nortel Health Agent SRS rule—The Nortel Health Agent host integrity check uses the criteria specified in the SRS rule assigned to the group.
• extended profiles—The Nortel SNAS checks the group to identify if an applicable extended profile exists (see
“Extended profiles” (page 191) ).
For information about configuring a group, see
.
Default group
You can configure a group to be the default group, with limited access rights. If the group name returned from the authentication database does not match any group defined on the Nortel SNAS, the Nortel SNAS maps the user to the default group.
To create a default group, see
“Creating a default group” (page 214) .
Linksets
A linkset is a set of links that are displayed on the portal page so that the user can easily access internal or external Web sites, servers, or applications. After the user is authenticated, the user’s portal page displays all the linksets associated with the group to which the user belongs. The user’s portal page also displays all the linksets associated with the user’s extended profile.
When mapping linksets to groups or extended profiles, make sure that the access rules specified for the profile do not contradict the links defined for the linkset.
For information about creating and configuring the linksets, see
“Configuring linksets” (page 320) .
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Overview of groups, profiles, and access rules
191
For information about mapping the linksets to groups, see
“Mapping linksets to a group or profile” (page 208) .
Nortel Health Agent SRS rule
The SRS rule specified for the group is the set of operating system and other software criteria that constitute the host integrity check performed by the Nortel Health Policy Administrator. The SRS rule can be a composite of other rules, but only one SRS rule exists for the group. Each group can have a different SRS rule.
For information about configuring SRS rules, see Nortel Health Policy
Administrator SRS Builder. You cannot configure SRS rules by using the
CLI.
If you run the quick setup wizard during the initial setup, you specify the action to occur if the SRS rule check fails. You can rerun the wizard at any time. You can also change the SRS rule check result (see
Nortel Health Agent check” (page 133) ).
Extended profiles
Passing or failing the SRS rule check is the only authorization control provided at the group level. This is the base profile. In future releases of the Nortel SNAS software, extended profiles provide a mechanism to achieve more granular authorization control, based on specific characteristics of the user’s connection. You can define up to 63 extended profiles for each group.
In Nortel Secure Network Access Switch Software Release 1.6.1, the data for an extended profile include the following configurable parameters:
• linksets
• the VLAN which the user is authorized to access
Each extended profile references a client filter in a one-to-one relationship.
With Nortel Secure Network Access Switch Software Release 1.6.1, you can configure the Nortel Health Agent check result as the criterion for the client filters, so to establish the user’s security status.
The client filter referenced in the extended profile determines whether the extended profile data is applied to the user. After the user is authenticated and the Nortel Health Agent host integrity check is conducted, the Nortel
SNAS checks the extended profile of the group in sequence, in order of the profile IDs, for a match between the client filter conditions and the user’s security status. When it finds a match, the Nortel SNAS applies that particular extended profile data to the user. Data defined for the base
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
192
Configuration of groups and profiles profile (for example, linksets) are appended to the extended profile data. If the Nortel SNAS finds no match in any of the extended profiles, it applies the base profile data.
For information about configuring client filters, see
“Configuring client filters” (page 201)
.
For information about configuring extended profiles, see
“Configuring extended profiles” (page 205)
.
Ping
Ping is a computer network tool used to test whether a particular host is reachable across an IP network. It is also used to self test the network interface card of the computer. It works by sending “echo request” packets to the target host and listening for “echo response” replies. Ping estimates the round-trip time (generally in milliseconds), records any packet loss, and prints a statistical summary when finished.
Traceroute
Traceroute is a computer network tool used to determine the route taken by packets across an IP network.
Traceroute is often used for network troubleshooting. By showing a list of routers traversed, it allows the user to identify the path taken to reach a particular destination on the network. This can help to identify routing problems or firewalls that may be blocking access to a site. Traceroute is also used by penetration testers to gather information about network infrastructure and IP ranges around a given host. It can also be used when downloading data. If there are multiple mirrors available for the same piece of data, one can trace each mirror to get a good idea of which mirror would be the fastest to use.
Dnslookup
To identify the IP address for a machine whose host name you specify or the host name of a machine whose IP address you specify. Host is the host name or IP address of the target station. If a back end interface is mapped to the current Nortel SNAS domain, the check is made through the back end interface.
A DNS lookup uses an Internet domain name to find an IP address, where a reverse DNS lookup uses an Internet IP address to find a domain name.
Reverse DNS lookup technique is able to identify whether sending e-mail server is legitimate and contains a valid host name.
Before you begin
Before you configure groups, client filters, and extended profiles on the
Nortel SNAS, complete the following tasks:
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring groups and extended profiles
193
Procedure steps
Step Action
1
2
3
Create the linksets, if desired (see
).
Create the SRS rules (see
“Nortel Health Agent SRS rule” (page
).
If authentication services are already configured, ascertain the group names used by the authentication services.
Group names defined on the Nortel SNAS must correspond to group names used by the authentication services. The following table summarizes the requirements for the various authentication methods.
Authentication method
RADIUS
LDAP
Local database
Group name on the Nortel SNAS must correspond to...
A group name defined in the vendor-specific attribute used by the RADIUS server.
Contact your RADIUS system administrator for information.
A group name defined in the LDAP group attribute used by the LDAP server. Contact your LDAP system administrator for information.
A group name used in the database. The group name is for internal use to control access to intranet resources, according to the associated access rules. When you add a user to the local database, you map the user to one or more of the defined user groups.
--End--
.
Configuring groups and extended profiles
Use the following procedure to configure groups and extended profiles on the Nortel SNAS:
1
2
Procedure steps
Step Action
Configure the group (see
“Configuring groups” (page 194)
).
Configure the client filters that is referenced in the extended profiles (see
“Configuring client filters” (page 201)
).
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
194
Configuration of groups and profiles
3
4
5
The client filters can be referenced by all extended profiles in the domain.
Configure the extended profiles for the group (see
“Configuring extended profiles” (page 205)
).
Map the linksets to the group and extended profiles (see
“Mapping linksets to a group or profile” (page 208) ).
Create a default group, if desired (see
).
--End--
Configuring groups
This section describes the procedure to configure group.
Configuring groups navigation
•
•
“Modifying a group” (page 197)
Adding a group
To create and configure a group, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, and Groups from the
Navigation pane.
The Groups screen appears.
Select the secure access domain from the Secure Access
Domain list and click Refresh.
Click Add.
The Add New Group screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring groups and extended profiles
195
5
6
Click Update.
The new group appears in the list of groups.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add new group.
Variable
Group Id
Group Name
Value
An integer in the range 1 to 1023 that uniquely identifies the group in the Nortel SNAS domain.
A string that uniquely identifies the group on the Nortel SNAS. The group name must match a group name used by the authentication services.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
196
Configuration of groups and profiles
Variable
Maximum Login
Sessions
Maximum Session
Length
SRS Rule
MAC Trust Level
Nortel Health Agent running mode
Enable MAC
Registration
Enable User
Registration
Enforcement type
Value
The maximum number of simultaneous portal or Nortel
SNAS sessions allowed for each member of the group. The default is 0 (unlimited).
Range: It must be between 0 and
65535.
Specify the maximum number of simultaneous portal or Nortel SNAS session length allowed for each member of the group.
Max 31d and min 2m
Select the Nortel Health Agent srs rule for the group.
Values: srs-rule-test and srs-rule-syscred-test
Specify the mac trust level.
Values: blacklist and bypass
Select the Nortel Health Agent mode.
Values: continuous, runonce, and never default: continuous
ATTENTION
The runonce option is only for the browser based authentication and is not applicable for Nortel Health
Desktop Agent.
Enables or disables the display of
MAC Registration Page.
Values: disabled and enabled default: disabled
Enable or disables the display of
User Registration Page.
Values: disabled and enabled default: disabled
The enforcement type used for the group. Available types are VLAN
Filter and Filter Only.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring groups and extended profiles
197
Variable
Cache Password
Locally
Locations
Value
Allow passwords to be cached on clients.
Values: disabled and enabled default: disabled
Select the allowed locations for this group.
Modifying a group
To configure a group, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
7
Select the Config tab.
Select Secure Access Domain, AAA, and Groups from the
Navigation pane.
The Groups screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Select the group from the list, and click Edit.
The Modify Group screen appears.
Modify the details as required.
Click Update.
The group appears in the list of groups.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring RADIUS attribute for group
To configure the RADIUS attributes for the group, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA, Groups, and RADIUS
Attributes from the Navigation pane.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
198
Configuration of groups and profiles
3
4
5
6
The RADIUS Attributes screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Click Add.
The Add RADIUS Attribute screen appears.
Click Create RADIUS Attribute.
The created attribute appears in the RADIUS Attributes table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to configure RADIUS attribute for group.
Variable
Vendor Id
Attribute Id
Attribute Value
Value
Specify the vendor Id for the group.
default: 0
Specify the attribute Id for the group.
Specify the attribute value for the group.
Using Guest Provisioning Wizard
Guest Provisioning wizard helps you to add a username and associated password to the Nortel SNAS local user database for the guest users, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab
Select Wizard from the Navigation pane.
The Wizard screen appears.
Click Guest Provisioning Wizard. The Domain Selection screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring groups and extended profiles
199
4
5
Select the domain for which guest provision needs to be provided from the Select Domain for which Guest Provision has to be Provided field.
Click Next.
The Group Creation/Selection screen appears.
ATTENTION
In this page, if the group do not exists for the selected domain then, only "Create a Group" option is visible. If a group already exists then another option "Select Existing Group" appears from which the user can select the group from the existing list for the guest user.
6
Select the Create a Group.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
200
Configuration of groups and profiles
7
Click Next.
The Local Authentication & User Configurations screen appears.
8
9
Click Finish.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add new group using guest provisioning wizard.
Variable
Domain Selection
Select the Domain for which guest provision needs to be
Provided
Group Creation/Selection
Group Id
Group Name
Value
Select the domain for which guest provision needs to be provided.
Specify a group id.
Specify a group name.
Local Authentication & User Configurations
Local Authentication Server
Name
Specifies the local authentication server name.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Variable
Guest User Name
Guest Password
Configuring groups and extended profiles
201
Value
Specify the name of the guest.
Specify the password for the guest.
Configuring client filters
This section describes the procedures to add and modify a client filter.
Configuring client filters navigation
•
“Adding a client filter” (page 201)
•
“Modifying a client filter” (page 204)
Adding a client filter
To create and configure a client filter, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, and Filters from the
Navigation pane.
The Filters screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New Filter screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
202
Configuration of groups and profiles
5
6
Click Update.
The new client filter appears in the Client Filters table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add new client filter.
Variable
Filter Id
Name
Value
An integer in the range 1 to 63 that uniquely identifies the filter in the
Nortel SNAS domain.
Names the filter.
• name is a string that must be unique in the domain.
You reference the client filter name when you configure the extended profile.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring groups and extended profiles
203
Variable
Nortel Health Agent
Check Passed
Value
Specifies whether passing or failing the Nortel Health Agent host integrity check triggers the filter:
PatchLink Check
Passed
Values: false, true, and ignore default: false
• true—the client filter triggers when the Nortel Health Agent check succeeds.
• false—the client filter triggers when the Nortel Health Agent check fails.
• ignore—passing or failing the
Nortel Health Agent check does not trigger the client filter.
For example, to grant limited access rights to users who fail the Nortel
Health Agent check, set the value to false, create an extended profile that references this client filter, and then map the extended profile to a restrictive VLAN.
For information about configuring the Nortel Health Agent checks, see
“Configuring the Nortel Health Agent check” (page 133) .
Specifies whether passing or failing the PatchLink check triggers the filter:
Values: false, true, and ignore default: false
• true—the client filter triggers when the PatchLink check succeeds.
• false—the client filter triggers when the PatchLink check fails.
• ignore—passing or failing the
PatchLink check does not trigger the client filter.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
204
Configuration of groups and profiles
Variable
NAP checks passed
Value
Specifies whether passing or failing the NAP check triggers the filter:
Comment
Values: false, true, and ignore default: false
• true—the client filter triggers when the NAP check succeeds.
• false—the client filter triggers when the NAP check fails.
• ignore—passing or failing the NAP check does not trigger the client filter.
Specifies a comment about the client filter.
Modifying a client filter
To configure a client filter, use the following procedure:
4
5
6
1
2
Procedure steps
Step Action
3
7
Select the Config tab.
Select Secure Access Domain, AAA, and Filters from the
Navigation pane.
The Filters screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Select the client filter from the table, and click Edit.
Modify the details as required.
Click Update.
The modified client filter appears in the Client Filters table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring groups and extended profiles
205
Configuring extended profiles
To view the extended profiles within a group, select the Secure Access
Domain, AAA, Groups, and Extended Profiles from the Navigation pane.
The Extended Profiles screen appears with a list of all profiles for that group.
When you select a profile in the list, the extended profile configuration details and linksets are accessible from the tabs that display below the list.
You can view or edit details for an extended profile from these additional tabs.
This section describes the following procedures:
•
“Adding an extended profile” (page 205)
•
“Modifying an extended profile” (page 207)
Adding an extended profile
To create an extended profile for a group, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Groups, and Extended
Profiles from the Navigation pane.
The Extended Profiles screen appears.
Select the secure access domain and the group from the respective lists, and click Refresh.
Click Add.
The Add New Profile screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
206
Configuration of groups and profiles
5
6
Click Update.
The new extended profile appears in the Extended Profile table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add new extended profile.
Variable
Id
Value
An integer in the range 1 to 1064 that uniquely identifies the profile in the group.
Filter Name
The default value for this field is the lowest unused index number available.
The name of the predefined client filter that determines whether the Nortel
SNAS applies this extended profile to the user.
Values: nha_system_passed and nha_system_failed
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring groups and extended profiles
207
Variable
Vlan Name
Value
The name of the VLAN to which the
Nortel SNAS assigns users with this profile.
Values: yellow and green
Access Control List
ID
Specify the name of the filter configured on the edge switch to be applied to the client port after
RADIUS authentication. The value specified here is returned as a
RADIUS standard Filter-Id attribute
(type 11) when authenticating 802.1x
clients.
Modifying an extended profile
To modify an extended profile for a group, use the following procedure:
5
6
7
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Groups, and Extended
Profiles from the Navigation pane.
The Extended Profiles screen appears.
Select the secure access domain and the group from the respective lists, and click Refresh.
Select the extended profile from the table, and click Edit.
The Modify New Profile screen appears.
Modify the details as required.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring Admin Rights
You can configure groups to function with or without Administrator rights.
To configure group administrator rights, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
208
Configuration of groups and profiles
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Groups, and Admin
Rights from the Navigation pane.
The Admin Rights screen appears.
Select secure access domain and the group from the respective lists, and click Refresh.
Click Update to save the changes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Admin User Name
Password
Confirm Password
Action
Variable definitions
Use the data in the following table to configure admin rights settings.
Value
Specify the administrator username.
Specify the password associated with the username.
Confirm the password.
Action to take.
Values: no_access and filter_only
Mapping linksets to a group or profile
You can tailor the portal page for different users by mapping preconfigured linksets to groups and extended profiles. Linksets configured for a group display on the portal page after the linksets configured for the user’s extended profile.
For information about configuring linksets, see
.
This section describes the following procedures:
•
“Mapping linksets to a group” (page 208)
•
“Mapping linksets to a profile” (page 210)
Mapping linksets to a group
To map a linkset to a group, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring groups and extended profiles
209
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Groups, and Linksets from the Navigation pane.
The Linksets screen appears.
Select the secure access domain and the group from the respective lists, and click Refresh.
To map a linkset to a group, use the following procedures:
•
“Adding linksets to a group” (page 209)
•
“Removing linksets from a group” (page 209)
--End--
Adding linksets to a group
To add a linkset to a group, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, AAA, Groups, and Linksets from the Navigation pane.
The Linksets screen appears and displays the Linkset table.
Select the secure access domain and the group from the respective lists, and click Refresh.
Select the portal linksets that you want add to the group and click
Add.
The new linkset appears in the Linkset table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Removing linksets from a group
To remove a linkset from a group, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
210
Configuration of groups and profiles
4
5
1
2
Procedure steps
Step Action
3
6
Select the Config tab.
Select Secure Access Domain, AAA, Groups, and Linksets from the Navigation pane.
The Linksets screen appears and displays the Linkset table.
Select the secure access domain and the group from the respective lists, and click Refresh.
Select the linkset that you want to remove from the Linkset table.
Click Delete.
The linkset is removed from the Linkset Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Mapping linksets to a profile
To map a linkset to an extended profile, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Groups, Extended
Profiles, and Extended Linksets from the Navigation pane.
The Extended Linksets screen appears.
Select the secure access domain, the group, and the client filter from the respective lists, and click Refresh.
To map a linkset to a profile, use the following procedures:
•
“Adding linksets to an extended profile” (page 210)
•
“Removing linksets from an extended profile” (page 211)
--End--
Adding linksets to an extended profile
To add a linkset to an extended profile, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring groups and extended profiles
211
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA, Groups, Extended
Profiles, and Extended Linksets from the Navigation pane.
3
4
5
Select the secure access domain, the group, and the client filter from the respective lists, and click Refresh.
Select the portal linksets that you want add to the extended profile and click Add.
The new linkset appears in the Linkset table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Removing linksets from an extended profile
To remove a linkset from an extended profile, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA, Groups, Extended
Profiles, and Extended Linksets from the Navigation pane.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
212
Configuration of groups and profiles
3
4
5
6
7
The Linksets screen appears.
Select the secure access domain, the group, and the client filter from the respective lists, and click Refresh.
Select the linkset that you want to remove from the Linkset
Table.
Click Delete.
Click OK.
The linkset disappears from the Linkset Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring RADIUS Attributes to a profile
To configure a RADIUS Attribute to an extended profile, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
7
Select the Config tab.
Select Secure Access Domain, AAA, Groups, Extended
Profiles, and RADIUS Attributes from the Navigation pane.
The RADIUS Attributes screen appears.
Select the secure access domain, the group, and the client filter from the respective lists, and click Refresh.
Click Add.
The Add RADIUS Attribute screen appears.
Enter the information in the respective fields.
Click Create RADIUS Attribute.
The created attribute appears in the RADIUS Attributes table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to configure RADIUS attribute for the extended profile.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Variable
Vendor Id
Attribute Id
Attribute Value
Configuring groups and extended profiles
213
Value
Specify the vendor Id for the extended profile.
default: 0
Specify the attribute Id for the extended profile.
Specify the attribute value for the extended profile.
To add a RADIUS Attribute to an extended profile, use the following procedure:
5
6
7
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Groups,
Extended Profiles, and RADIUS Attribute from the Navigation pane.
The RADIUS Attributes screen appears.
Select the secure access domain, the group, and the client filter from the respective lists, and click Refresh.
Click Insert.
The Insert RADIUS Attribute screen appears.
Enter the information in the respective fields.
Click Update RADIUS Attribute.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
To move a RADIUS Attribute to an extended profile, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA, Groups,
Extended Profiles, and RADIUS Attribute from the Navigation pane.
The RADIUS Attributes screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
214
Configuration of groups and profiles
3
4
5
6
Select the secure access domain, the group, and the client filter from the respective lists, and click Refresh.
Move RADIUS Attribute from moves the value by number, From Index values to To Index values.
Click Move.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
To delete a RADIUS Attribute to an extended profile, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
6
Select the Config tab.
Select Secure Access Domain, AAA, Groups,
Extended Profiles, and RADIUS Attribute from the Navigation pane.
The RADIUS Attributes screen appears.
Select the secure access domain, the group, and the client filter from the respective lists, and click Refresh.
Select the RADIUS Attribute to be deleted.
Click Delete.
A confirmation dialog appears, click OK.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Creating a default group
To create a default group, first create a group with extended profiles mapped to a restrictive VLAN (see
“Configuring groups” (page 194)
and
“Configuring extended profiles” (page 205) ), and then use the following
procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Trace
215
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and AAA from the Navigation pane.
The AAA screen appears.
Trace
3
4
5
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure AAA.
Variable
Default Group
Value
Specifies name of the group that you want to set as a default.
You can trace the device information through pinging, tracerouting and
Dnslookup options.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
216
Configuration of groups and profiles
Pinging a device
To Verify station-to-station connectivity across the network, use the following procedure.
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, Trace, and Ping from the
Navigation pane.
The Ping screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Ping to submit the page.
The ping packets status appears in the Ping Status table.
--End--
Variable definitions
Use the data in the following table to ping.
Variable Value
Ping through Backend Interface
Host Specify IP address or Host name to Ping.
ATTENTION
To specify host names, you must configure the
DNS parameters.
Viewing the Traceroute
To identify the route used for station-to-station connectivity across the network, use the following procedure.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Trace
217
WARNING
The traceroute operation may take some time to display the routes information for an unreachable host.
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, Trace, and Traceroute from the Navigation pane.
The Traceroute screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Traceroute to submit the page.
The traceroutes status appears in the Traceroute Status table.
--End--
Variable definitions
Use the data in the following table to traceroute.
Variable Value
Traceroute through Backend Interface
Host Specify IP address or Host name of the target station to traceroute.
ATTENTION
To specify host names, you must configure the
DNS parameters.
Viewing the Dnslookup
To identify the IP address for a machine whose host name you specify or the host name of a machine whose IP address you specify. Host is the host name or IP address of the target station. If a backend interface is mapped to the current Nortel SNAS domain, the check is made through the backend interface.
To view the dnslookup, use the following procedure.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
218
Configuration of groups and profiles
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, Trace, and Dnslookup from the Navigation pane.
The Dnslookup screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Lookup to submit the page.
The DNS lookup status appears in the DNS Lookup Status table.
--End--
Variable definitions
Use the data in the following table to Dnslookup.
Variable Value
Lookup a name in DNS through Backend Interface
Host Specify IP address or Host name to view the dnslookup.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Configuration of authentication
This chapter provides detailed procedures to configure authentication.
Navigation
•
•
•
“Configuring authentication” (page 221)
219
Overview
The Nortel SNAS controls the authentication of clients when they log on to the network.
The Nortel SNAS supports the following authentication methods in Nortel
Secure Network Access Switch Software Release 1.6.1:
• external database
—
Remote Authentication Dial-In User Service (RADIUS)
—
Lightweight Directory Access Protocol (LDAP)
• local database on the Nortel SNAS
ATTENTION
If you run the quick setup wizard during initial setup, the Local database authentication method is created as Authentication 1.
You can configure more than one authentication method within a Nortel
SNAS domain. You determine the order in which the methods are applied by default. Client credentials are checked against the various authentication databases until the first match is found.
You can configure the methods so that their names display on the portal login page (see
“Configuring authentication methods” (page 222) ). You
can then direct clients to select a specific authentication server (for example, for direction to a specific Windows domain). If the client selects
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
220
Configuration of authentication a Login Service name, the authentication request is directed immediately to the specified service. Otherwise, authentication defaults to the authentication order you have configured (see
“Specifying authentication fallback order” (page 270) ).
For general information about authentication within the Nortel SNAS, see Nortel Secure Network Access Switch 2.0 Solution Guide ()
(NN47230-200).
Before you begin
Before you configure authentication on the Nortel SNAS, you must complete the following tasks:
Procedure steps
Step Action
1
2
3
4
Create the Nortel SNAS domain, if applicable (see
“Creating a domain” (page 112)
).
If you run the quick setup wizard during initial setup, Domain 1 is created on the Nortel SNAS.
ATTENTION
With Nortel Secure Network Access Switch Software Release 1.6.1, you cannot configure the Nortel SNAS to include more than one domain.
Create and configure the groups (see
“Configuration of groups and profiles” (page 189) ).
For external authentication servers, create or modify settings on the external server as required:
a
A free RADIUS server can require specific settings in the clients.conf file and the Users file to match group parameters that you configure on the Nortel SNAS.
b A Steel-belted RADIUS server requires specific settings in the vendor.ini file, master dictionary, and vendor dictionary.
c
An MS IAS RADIUS server may require vendor parameters to be configured on the Microsoft Management Console (MMC).
To configure external authentication, you require the following information about the authentication server configuration:
a
RADIUS servers:
• server IP address
• port number used for the service
• shared secret
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
221
•
Vendor-Id attribute
•
Vendor-Type
ATTENTION
You can assign vendor-specific codes to the Vendor-Id and
Vendor-Type attributes. The RADIUS server uses Vendor-Id and
Vendor-Type attributes in combination to identify the values it assigns and sends for attributes such as group name and session timeout.
Each vendor has a specific dictionary. The Vendor-Id specified for an attribute identifies that the dictionary the RADIUS server uses to retrieve the attribute value. The Vendor-Type indicates the index number of the required entry in the dictionary file.
The Internet Assigned Numbers Authority (IANA) designates that SMI Network Management Private Enterprise
Codes can be assigned to the Vendor-Id attribute (see http://www.iana.org/assignments/enterprise-numbers ).
RFC 2865 describes the usage of the Vendor-Type attribute.
If you specify Vendor-Id and Vendor-Type on the RADIUS server and on the Nortel SNAS, the Nortel SNAS retrieves vendor-specific values for the associated attribute. If you set the
Vendor-Id and Vendor-Type attributes to 0, the RADIUS server sends standard attribute values.
b LDAP servers:
• server IP address
• port number used for the service
• configured accounts and users so that you can specify appropriate search entries and group and user attributes
--End--
Configuring authentication
The basic steps for configuring and managing authentication are:
1
2
Procedure steps
Step Action
Create the authentication methods.
Configure specific settings for the methods.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
222
Configuration of authentication
3
4
Specify the order in which the authentication methods are applied. Perform this step even if you define only one method on the Nortel SNAS.
Commit the configuration changes.
--End--
This section describes the tasks to configure authentication on the Nortel
SNAS.
Configuring authentication navigation
•
“Configuring authentication methods” (page 222)
•
“Configuring RADIUS authentication” (page 224)
•
“Configuring LDAP authentication” (page 234)
•
“Configuring NTLM authentication” (page 247)
•
“Configuring SiteMinder authentication” (page 252)
•
“Configuring ClearTrust authentication” (page 255)
•
“Configuring local database authentication” (page 260)
•
“Specifying authentication fallback order” (page 270)
•
“Viewing and managing MAC entries” (page 271)
Configuring authentication methods
To create and configure an authentication method, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA and Authentication from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New Authentication Server screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
223
6
7
5
Continue with the appropriate procedure for the authentication method that you want to add:
•
For RADIUS authentication, go to
“Configuring RADIUS authentication” (page 224)
.
•
For LDAP authentication, go to
“Configuring LDAP authentication” (page 234)
.
•
For Local authentication, go to
“Configuring local database authentication” (page 260)
.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add new authentication method.
Variable
Auth Id
Value
Specifies the internal identifier for the authentication.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
224
Configuration of authentication
Variable
Name
Display Name
Mechanism
Group Authentication
Servers
Value
Specifies a name for the authentication method as a mnemonic aid.
The maximum allowable length of the name string is 255 characters, but Nortel recommends a maximum of 32 characters.
Future releases of the Nortel SNAS software allows you to reference this name in a client filter, so authentication to this server becomes a condition for access rights for a group.
Specifies a name for the method to be displayed in the Login Service list box on the portal login page, together with the names of other authentication services available.
Specifies the authentication method.
Specifies another authentication method to use for retrieving group information.
You can choose any existing Local or LDAP database to retrieve group information. User groups that exist in the RADIUS authentication scheme are added to the user groups found in the specified authentication schemes.
Configuring RADIUS authentication
To configure the Nortel SNAS to use RADIUS authentication, use the following procedure:
Procedure steps
Step Action
1
2
3
Add the RADIUS method to the domain and specify the RADIUS server (see
“Adding the RADIUS method and server” (page
).
Modify the RADIUS configuration settings, if desired (see
“Modifying RADIUS configuration” (page 226)
).
Add extra RADIUS servers, for redundancy, if desired (see
“Managing additional RADIUS servers” (page 231)
).
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
225
Adding the RADIUS method and server
To configure the Nortel SNAS to use an external RADIUS or Steel-belted
RADIUS server for authentication, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, and
RADIUS from the Navigation pane.
The RADIUS screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New RADIUS Server screen appears.
5
6
Click Update.
The RADIUS authentication method displays in the
Authentication Server Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
226
Configuration of authentication
Use the data in the following table to add new RADIUS server.
Variable
Auth Id
Name
Value
Specifies the internal identifier for the authentication.
Specifies a name for the authentication method as a mnemonic aid.
The maximum allowable length of the name string is 255 characters, but Nortel recommends a maximum of 32 characters.
Display Name
Mechanism
Group Authentication
Servers
Future releases of the Nortel
SNAS software allows you to reference this name in a client filter, so authentication to this server becomes a condition for access rights for a group.
Specifies a name for the method to be displayed in the Login Service list box on the portal login page, together with the names of other authentication services available.
Specifies the authentication method.
Specifies another authentication method to use for retrieving group information.
You can choose any existing Local or LDAP database to retrieve group information. User groups that exist in the RADIUS authentication scheme are added to the user groups found in the specified authentication schemes.
Modifying RADIUS configuration
You can modify the RADIUS configuration in the following ways:
• modify settings for the authentication method itself (see
RADIUS method settings” (page 227)
)
• modify settings for the specific RADIUS configuration (see
RADIUS configuration settings” (page 228)
)
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
227
To modify settings for an existing RADIUS authentication method, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select the Secure Access Domain, AAA,
Authentication, RADIUS, and General from the Navigation pane.
The General screen appears, showing current settings for the method.
Select the secure access domain and the Auth
Id from the respective lists, and click Refresh.
Click Update to save the changes.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to modify RADIUS method.
Variable
Name
Value
Specifies a name for the authentication method as a mnemonic aid.
Display Name
Mechanism
Future releases of the Nortel SNAS software will allow you to reference this name in a client filter, so authentication to this server becomes a condition for access rights for a group.
Specifies a name for the method to be displayed in the Login Service list box on the portal login page, together with the names of other authentication services available.
Displays the authentication type for this method.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
228
Configuration of authentication
Variable
Secondary
Authentication
Server
Group Authentication
List
Value
Specifies a second authentication method to use as a backup authentication service, if necessary.
Specifies another authentication method to use for retrieving group information.
You can choose any existing Local or LDAP database to retrieve group information. User groups that exist in the RADIUS authentication scheme are added to the user groups found in the specified authentication schemes.
To modify the RADIUS method configuration, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA,
Authentication, RADIUS, and RADIUS
Settings from the Navigation pane.
The RADIUS Settings screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
229
3
4
5
Select the secure access domain and the Auth
ID from the respective lists, and click Refresh.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
.
Use the data in the following table to for RADIUS
Configuration.
Variable
Secondary
Authentication Server
Vendor Id
Value
Specifies the second authentication server to use after the first one succeeds.
Specifies the vendor-specific attribute used by the RADIUS server to send group names to the Nortel
SNAS. The default Vendor-Id is
1872 (Alteon).
Vendor Type
To use a standard RADIUS attribute rather than the vendor-specific one, set the vendor ID to 0 (see also vendor type).
ATTENTION
If the Authentication Protocol is
CHAPv2, the Vendor-Id must be set to 311 (Microsoft).
Specifies the Vendor-Type value used in combination with the
Vendor-Id to identify the groups to which the user belongs. The group names to which the vendor-specific attribute points to must match the names you define on the Nortel
SNAS. The default is 1.
If you set the vendor ID to 0 in order to use a standard RADIUS attribute
(see vendor ID), set the vendor type to a standard attribute type as defined in RFC 2865. For example,
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
230
Configuration of authentication
Variable
Authentication
Protocol
Vendor Id for Domain
ID
Value
to use the standard attribute Class, set the vendor ID to 0 and the vendor type to 25.
Specifies the protocol used for communication between the Nortel
SNAS and the RADIUS server. The options are:
•
PAP—Password Authentication
Protocol (PAP)
•
CHAPv2—Challenge Handshake
Authentication Protocol (CHAP), version 2
The default is PAP.
Specifies the vendor-specific attribute used by the RADIUS server to send domain names to the Nortel
SNAS. The default Vendor-Id is
1872 (Alteon).
Vendor Type for
Domain ID
Timeout
ATTENTION
If the Authentication Protocol is
CHAPv2, consider setting the
Vendor-Id for the domain to 10
(MS-CHAP-Domain).
Specifies the Vendor-Type value used in combination with the
Vendor-Id to identify the domain.
The default is 3.
Sets the timeout interval for a connection request to a RADIUS server. At the end of the timeout period, if no connection is established, authentication fails.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
231
Variable Value
Acceptable values are an integer that indicates the time interval followed by a letter to specify the measurement unit. The options for measurement units are:
• s—seconds
• m—minutes
• h—hours
If you do not specify a measurement unit, seconds is assumed. The range is 1–10000 seconds. The default is 10 seconds.
Managing additional RADIUS servers
You can specify additional RADIUS servers for redundancy. In the event that the preferred RADIUS server is not responding, the first available server in the list is used instead.
To manage additional RADIUS servers, select the Secure Access
Domain, AAA, Authentication, RADIUS, and Servers from the
Navigation pane.
The Servers screen appears, displaying a list of the existing RADIUS servers.
To manage additional RADIUS servers, use the following procedures:
•
“Adding a RADIUS server” (page 231)
•
“Reordering additional RADIUS servers” (page 233)
•
“Removing a RADIUS server” (page 233)
To add additional RADIUS servers for redundancy, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
232
Configuration of authentication
2
3
4
Select Secure Access Domain, AAA,
Authentication, RADIUS, and Servers from the Navigation pane.
The Servers screen appears.
Select the secure access domain and the Auth
ID from the respective lists, and click Refresh.
Click Add.
The Add New RADIUS Server screen appears.
5
6
Click Update.
The new RADIUS server is automatically assigned a unique index number, and appears in the RADIUS Server table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add new RADIUS
Server.
Variable
IP Address
Value
Specifies the IP address of the RADIUS server.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
233
Variable
Authentication
Port
Accounting
Port
Shared
Secret
Shared
Secret (again)
Value
Specifies the authentication port number configured for this server to use on the
RADIUS server. The default is 1812.
Specifies the accounting port number configured for this server to use on the
RADIUS server. The default is 1813.
Specifies a unique shared secret configured on the RADIUS server that authenticates the
Nortel SNAS to the RADIUS server.
Reconfirm the unique shared secret.
Reordering additional RADIUS servers
To adjust the order in which
RADIUS servers are used, use the following procedure:
4
5
6
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication,
RADIUS, and Servers from the Navigation pane.
The Servers screen appears.
Select the secure access domain and the Auth ID from the respective lists and click Refresh.
Select the RADIUS server entry from the Server table.
Use the up and down arrows to reposition the selected entry.
Click Apply on the toolbar to accept the new order, and adjust index numbers for the RADIUS servers accordingly.
--End--
.
Removing a RADIUS server
To remove an existing RADIUS server from the RADIUS Server Table, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA, Authentication,
RADIUS, and Servers from the Navigation pane.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
234
Configuration of authentication
3
4
5
6
The Servers screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Select the RADIUS server entry from the RADIUS Server Table.
Click Delete.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Next steps
Procedure steps
Step
1
2
Action
Configure additional authentication methods, if desired (see
“Configuring LDAP authentication” (page 234)
or
“Configuring local database authentication” (page 260)
).
Set the authentication order (see
“Specifying authentication fallback order” (page 270) ).
--End--
Configuring LDAP authentication
To configure the Nortel SNAS to use LDAP authentication, use the following procedure:
Procedure steps
Step Action
1
2
3
4
Add the LDAP method to the domain and specify the LDAP server (see
“Adding the LDAP method and server” (page 235) ).
Modify the LDAP configuration settings, if desired (see
“Modifying LDAP configuration” (page 237)
).
Add extra LDAP servers, for redundancy, if desired (see
“Managing additional LDAP servers” (page 242)
).
Add LDAP macros, if desired (see
).
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
235
Adding the LDAP method and server
To configure the Nortel SNAS to use an external LDAP server for authentication, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, and
LDAP from the Navigation pane.
The LDAP screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New LDAP Server screen appears.
5
6
Click Update.
The LDAP authentication method appears in the Authentication
Server Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
236
Configuration of authentication
Use the data in the following table to add new LDAP
Server.
Variable
Auth Id
Name
Value
Specifies the internal identifier for the authentication.
Specifies a name for the authentication method as a mnemonic aid.
The maximum allowable length of the name string is 255 characters, but Nortel recommends a maximum of 32 characters.
Display Name
Mechanism
Group Authentication
Servers
Future releases of the Nortel
SNAS software allows you to reference this name in a client filter, so authentication to this server becomes a condition for access rights for a group.
Specifies a name for the method to be displayed in the Login Service list box on the portal login page, together with the names of other authentication services available.
Specifies the authentication method.
Specifies another authentication method to use for retrieving group information.
You can choose any existing Local or LDAP database to retrieve group information. User groups that exist in the RADIUS authentication scheme are added to the user groups found in the specified authentication schemes.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
237
Modifying LDAP configuration
You can modify the LDAP configuration in the following ways:
• modify settings for the authentication method itself (see
LDAP and Local method settings” (page 237) ).
• modify settings for the specific LDAP configuration (see
LDAP configuration settings” (page 237)
).
Modifying LDAP and Local method settings
The configuration screen used to modify generic authentication method settings is the same for
LDAP and Local authentication methods.
To modify settings for an existing LDAP or local authentication method, use the following procedure:
4
5
6
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, LDAP, and General from the Navigation pane.
The General screen appears showing the current settings for the method.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Modify settings for the authentication method, as necessary.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
To modify the LDAP method configuration, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA,
Authentication, LDAP, and LDAP Settings from the Navigation pane.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
238
Configuration of authentication
3
4
The LDAP Setting screen appears.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table for LDAP settings.
Variable Value
Search Base Entry
Specifies the Distinguished Name (DN) that points to one of the following:
Group Attribute
• the entry that is one level up from the user entries (does not require a Bind ISD DN and Bind ISD
Password)
• if user entries are located in several places in the LDAP Dictionary
Information Tree (DIT), the position in the DIT from where all user records can be found with a subtree search (requires Bind ISD
DN and Bind ISD Password)
Specifies the LDAP attribute that contains the names of the groups.
The group names contained in the
LDAP attribute must be defined in the
Nortel SNAS domain (see
“Configuring groups” (page 194) ).
User Attribute
To specify more than one group attribute name, enter the names separated by a comma (,).
Refers to one of the following:
1.
The LDAP attribute that contains the user name used for authenticating a client in the domain.
The default user attribute name is uid.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
239
Variable
iSD Bind DN
Value
Do not use the Bind ISD DN and
Bind ISD Password fields.
2.
If the client’s portal logon name is different from the RDN (for example, when using LDAP for authentication for Active Directory), the LDAP attribute that is used in combination with the client’s logon name to search the DIT.
For example, a user record in
Active Directory is defined as the following DN: cn=Bill Smith, ou=Users, dc=example, dc=com.
The user record also contains the attribute sAMAccountName=bill.
The user’s login name is bill. If the user attribute is defined as sAMAccountName, the user record for Bill Smith is found.
The ISD Bind DN and ISD Bind
Password fields are required so that the Nortel SNAS can authenticate itself to the LDAP server, in order to search the DIT.
Specifies an entry in the LDAP server used to authenticate the Nortel SNAS to the LDAP server so that the LDAP
DIT can be searched.
The ISD Bind DN corresponds to an entry created in the Schema Admins account (for example, cn=ldap ldap, cn=Users, dc=example, dc=com).
Required for the Search Base Entry and User Attribute method 2.
iSD Bind Password Specifies the password used to authenticate the Nortel SNAS to the
LDAP server. The ISD Bind Password is the password, configured in the
Schema Admins account, for the entry referenced in the ISD Bind DN.
Required for the Search Base Entry and User Attribute method 2.
iSD Bind Password
(again)
Reconfirm the ISD Bind password.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
240
Configuration of authentication
Variable
Enable LDAPS
Server Timeout
User Preferences
Value
If selected, allows LDAP requests between the Nortel SNAS and the
LDAP server to occur over a secure
SSL connection (LDAPS). The default is not selected.
ATTENTION
The default TCP port number used by the LDAP protocol is 389. If
LDAPS is enabled, change the port number to 636.
Sets the timeout interval for a connection request to an LDAP server. At the end of the timeout period, if no connection is established, authentication fails.
Accepted value is an integer that indicates the time interval in seconds
( s
), minutes ( m
), or hours ( h
). If you do not specify a measurement unit, seconds is assumed. The range is
1–10000 seconds. The default is 5 seconds.
Enables or disables storage of user preferences in an external
LDAP/Active Directory database.
If selected, the storage and retrieval of user preferences is enabled. When the client logs off from a portal session, the Nortel SNAS saves any user preferences accumulated during the session in the isdUserPrefs attribute.
The next time the client successfully logs on through the portal, the Nortel
SNAS retrieves the LDAP attribute from the LDAP database.
If cleared, the storage and retrieval of user preferences is disabled.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Variable
Configuring authentication
241
Value
To support storage and retrieval of user preferences, you must extend the
LDAP server schema with one new
ObjectClass and one new Attribute.
Short Group
Format
Cut Domain from
User Name
Values: enabled and disabled default: disabled
Enables or disables the short group formats.
Values: enabled and disabled default: disabled
Specifies whether the domain is cut from user names.
Values: enabled and disabled default: disabled
Managing LDAP active directory
To mange LDAP active directory, use the following procedure:
4
5
1
2
Procedure 1
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, LDAP, and Active Directory from the Navigation pane.
The Active Directory screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Specify the values in the respective fields and click Update
Click Apply on the toolbar to accept the new order, and adjust index numbers for the LDAP servers accordingly.
--End--
Use the data in the following table to manage LDAP active directory.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
242
Configuration of authentication
Variable
Expired Account Check
Expired Account Group
Expired Password Group
Recursive Group
Membership
Value
Enables or disables the account check.
Values: enabled and disabled
Default: disabled
Specify the account group.
Values: nhauser and nhasystem
Specify the password group.
Values: nhauser and nhasystem
Enables or disables the recursive group membership.
Values: enabled and disabled
Default: disabled
Managing additional LDAP servers
You can specify additional LDAP servers for redundancy. In the event that the preferred LDAP server is not responding, the first available server in the list is used instead.
To manage additional LDAP servers, select Secure Access Domain,
AAA, Authentication, LDAP, and Servers from the Navigation pane.
The Servers screen appears, displaying a list of the existing LDAP servers.
To manage additional LDAP servers, use the following procedures:
•
“Adding an LDAP server” (page 242)
•
“Reordering additional LDAP servers” (page 243)
•
“Removing an LDAP server” (page 244)
.
To add an additional LDAP server, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA,
Authentication, LDAP, and Servers from the
Navigation pane.
The LDAP Servers screen appears.
Select the secure access domain and the Auth
ID from the respective lists, and click Refresh.
Click Add.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
243
The Add New LDAP Server screen appears.
5
6
Click Update.
The new LDAP server is automatically assigned a unique index number, and the new LDAP server details appear in the LDAP Server Table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add an LDAP server.
Variable Value
IP Address Specifies the IP address of the LDAP server.
Port Specifies the port number configured for this server to use on the LDAP server. The default is 389.
Reordering additional LDAP servers
To adjust the order in which
LDAP servers are used, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, LDAP, and Servers from the Navigation pane.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
244
Configuration of authentication
3
4
5
6
The LDAP Servers screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Select an LDAP server entry from the LDAP Server Table.
Use the up and down arrows to reposition the selected entry.
Click Apply on the toolbar to accept the new order, and adjust index numbers for the LDAP servers accordingly.
--End--
Removing an LDAP server
To remove an existing LDAP server from the LDAP Server Table, use the following procedure:
4
5
6
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, LDAP, and Servers from the Navigation pane.
The LDAP Servers screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Select an LDAP server entry from the LDAP Server Table.
Click Delete.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Managing LDAP macros
You can create your own macros (or variables), to retrieve data from the
LDAP database. You can use them to map the variable to an LDAP user attribute to create user-specific links on the portal Home tab. When the client successfully logs on, the variable expands to the value retrieved from the LDAP or Active Directory user record. For more information about using macros in portal links, see
To manage LDAP macro variables, select the Secure Access Domain,
AAA, Authentication, LDAP, and Macros tab.
The Macros screen appears and displays a list of existing LDAP macros.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
245
The Macro table allows you to manage LDAP macros by performing any of the following procedures:
•
“Adding LDAP macros” (page 245)
•
“Reordering LDAP macros” (page 246)
•
“Removing LDAP macros” (page 247)
To create an LDAP macro variable, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA,
Authentication, LDAP, and Macros from the
Navigation pane.
The Macros screen appears.
Select the secure access domain and the Auth
ID from the respective lists, and click Refresh.
Click Add.
The Add New User-defined Macro screen appears.
5
Click Update.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
246
Configuration of authentication
6
The new LDAP macro is automatically assigned a unique index number, and LDAP macro details appears in the LDAP Macro table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
.
Use the data in the following table to add new user-defined macro.
Variable Value
Variable Name Specifies the name of the variable.
LDAP Attribute Specifies the LDAP user attribute for which a value is retrieved from the client’s
LDAP/Active Directory user record.
Prefix
Suffix
Specifies values at the start of the string that you want to ignore, if the value string of the LDAP attribute is long and you wish to extract only part of it. Combine with a suffix if the value you can extract is in the middle of the string.
Specifies values at the end of the string that you want to ignore, if the value string of the LDAP attribute is long and you wish to extract only part of it. Combine with a prefix if the value you want to extract is in the middle of the string.
Reordering LDAP macros
To change the order of existing LDAP macro variables, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, LDAP, and Macros from the Navigation pane.
The Macros screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Select an LDAP macro entry from the Macro table.
Use the up and down arrows to reposition the selected entry.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
6
Configuring authentication
247
Click Apply on the toolbar to accept the new order, and adjust index numbers for the LDAP macros accordingly.
--End--
Removing LDAP macros
To remove existing LDAP macro variables, use the following procedure:
4
5
6
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, LDAP, and Macros from the Navigation pane.
The Macros screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Select an LDAP macro entry from the LDAP Macro Table.
Click Delete.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Next steps
Procedure steps
Step
1
2
Action
Configure additional authentication methods, if desired (see
“Configuring RADIUS authentication” (page 224)
or
“Configuring local database authentication” (page 260)
).
Set the authentication order (see
“Specifying authentication fallback order” (page 270) ).
--End--
Configuring NTLM authentication
To configure the Nortel SNAS to use an external NTLM server for authentication, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
248
Configuration of authentication
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, and
NTLM from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New NTLM Server screen appears.
Click Update.
The NTLM authentication server appears in the Authentication
Server Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Variable
Auth Id
Name
Display Name
Variable definitions
Use the data in the following table to add an NTLM authentication server.
Value
Specifies the internal identifier for the authentication.
Specifies a name for the authentication method as a mnemonic aid.
Mechanism
Group Authentication
Servers
The maximum allowable length of the name string is 255 characters, but Nortel recommends a maximum of 32 characters.
Future releases of the Nortel SNAS software allows you to reference this name in a client filter, so authentication to this server becomes a condition for access rights for a group.
Specifies a name for the method to be displayed in the Login
Service list box on the portal login page, together with the names of other authentication services available.
Specifies the authentication method.
Specifies another authentication method to use for retrieving group information.
Modifying NTLM general settings
To modify settings for an existing NTLM, use the following procedure:
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
249
4
5
6
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, NTLM, and General from the Navigation pane.
The General screen appears showing the current settings for the method.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Modify settings for the authentication method, as necessary.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring NTLM settings
To configure the NTLM settings, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, NTLM, and NTLM Settings from the Navigation pane.
The Authentication screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Windows domain name
Use the data in the following table for NTLM settings.
Value
Specifies the windows domain name.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
250
Configuration of authentication
Variable
Windows controller domain name
Password Expired Group
Value
Specifies the windows controller domain name.
Specifies the password expired group.
Values: nhauser and nhasystem
Configuring NTLM join settings
To configure the NTLM join settings, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, NTLM, and Join from the Navigation pane.
The Authentication screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Domain administrator account
Domain administrator password
Domain administrator password (again)
Use the data in the following table for NTLM join settings.
Value
Specifies the domain administrator account name.
Specifies the domain administrator password.
Reconfirm the domain administrator password.
Configuring NTLM servers settings
To add an NTLM servers settings, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Variable
IP Address
2
3
4
5
6
Configuring authentication
251
Select Secure Access Domain, AAA, Authentication, NTLM, and Servers from the Navigation pane.
The Authentication screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Click Add.
The Add New NTLM Server screen appears.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add an NTLM server.
Value
Specifies the IP address of the NTLM server.
To remove an existing NTLM server from the NTLM
Server Table, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA,
Authentication, NTLM, and Servers from the
Navigation pane.
The Authentication screen appears.
Select the secure access domain and the Auth
ID from the respective lists, and click Refresh.
Select an NTLM server entry from the NTLM
Server Table.
Click Delete.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
252
Configuration of authentication
Configuring SiteMinder authentication
To configure the Nortel SNAS to use an external SiteMinder server for authentication, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, and
SiteMinder from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New SiteMinder Server screen appears.
Click Update.
The created SiteMinder authentication server appears in the
Authentication Server Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Auth Id
Name
Display Name
Variable definitions
Use the data in the following table to add a SiteMinder authentication server.
Value
Specifies the internal identifier for the authentication.
Specifies a name for the authentication method as a mnemonic aid.
The maximum allowable length of the name string is 255 characters, but Nortel recommends a maximum of 32 characters.
Future releases of the Nortel SNAS software allows you to reference this name in a client filter, so authentication to this server becomes a condition for access rights for a group.
Specifies a name for the method to be displayed in the Login
Service list box on the portal login page, together with the names of other authentication services available.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
253
Variable
Mechanism
Group Authentication
Servers
Value
Specifies the authentication method.
Specifies another authentication method to use for retrieving group information.
Modifying SiteMinder general settings
To modify settings for an existing SiteMinder, use the following procedure:
4
5
6
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication,
SiteMinder, and General from the Navigation pane.
The General screen appears showing the current settings for the method.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Modify settings for the authentication method, as necessary.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring SiteMinder settings
To configure the SiteMinder settings, use the following procedure:
Procedure steps
Step
1
2
3
4
Action
Select the Config tab.
Select Secure Access Domain, AAA, Authentication,
SiteMinder, and SiteMinder Settings from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the lists, and click
Refresh.
Click Update.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
254
Configuration of authentication
5
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Failover Mode
Group Attribute
AgentName
Timeout
Secret
Confirm Secret
Allow Single Sign-On
Use the data in the following table for SiteMinder settings.
Value
Specifies the failover mode.
Values: failover and roundrobin
Specifies the group attribute value.
Specify the agent name.
Default: Nortel Agent
Specify the timeout value.
Range: 1 to 10000 seconds
Specify the secret value.
Reconfirm the secret value.
Enables or disables the single sign-on.
Value: true and false
Default: false
Specifies the resource value.
Specify the domain cookie scope value.
Resource
Domain Cookie Scope
Configuring SiteMinder servers settings
To add a SiteMinder server settings, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, AAA, Authentication,
SiteMinder, and Servers from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the list, and click
Refresh.
Click Add.
The Add New SITEMINDER Server screen appears.
Click Update.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
6
Configuring authentication
255
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
IP Address
Authentication Port
Authorization Port
Accounting Port
Use the data in the following table to add a SiteMinder server.
Value
Specifies the IP address of the SiteMinder server.
Specifies the authentication port. Value: 44442
Specifies the authorization port. Value: 44443
Specifies the accounting port. Value: 44441
To remove an existing SiteMinder server from the
SiteMinder Server Table, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA,
Authentication, SiteMinder, and Servers from the Navigation pane.
The Authentication screen appears.
Select the secure access domain and the Auth
ID from the respective lists, and click Refresh.
Select an SiteMinder server entry from the
SiteMinder Server Table.
Click Delete.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Configuring ClearTrust authentication
To configure the Nortel SNAS to use an external ClearTrust server for authentication, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
256
Configuration of authentication
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, and
ClearTrust from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New CLEARTRUST Server screen appears.
Click Update.
The created ClearTrust authentication server appears in the
Authentication Server Table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Auth Id
Name
Display Name
Variable definitions
Use the data in the following table to add a ClearTrust authentication server.
Value
Specifies the internal identifier for the authentication.
Specifies a name for the authentication method as a mnemonic aid.
Mechanism
Group Authentication
Servers
The maximum allowable length of the name string is 255 characters, but Nortel recommends a maximum of 32 characters.
Future releases of the Nortel SNAS software allows you to reference this name in a client filter, so authentication to this server becomes a condition for access rights for a group.
Specifies a name for the method to be displayed in the Login
Service list box on the portal login page, together with the names of other authentication services available.
Specifies the authentication method.
Specifies another authentication method to use for retrieving group information.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
257
Modifying ClearTrust general settings
To modify settings for an existing ClearTrust, use the following procedure:
4
5
6
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication,
ClearTrust, and General from the Navigation pane.
The General screen appears showing the current settings for the method.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Modify settings for the authentication method, as necessary.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring ClearTrust settings
To configure the ClearTrust settings, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication,
ClearTrust, and ClearTrust Settings from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the lists, and click
Refresh.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table for ClearTrust settings.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
258
Configuration of authentication
Variable
Distributed Mode
Authentication Type
Distributed Mode
Server Timeout
Single-Sign
Domain Cookie Scope
Value
Specifies the failover mode.
Values: standard and distributed
Specifies the authentication type.
Values: basic, nt, and secureid
Specifies the distributed mode.
Values: clear and ssl_anon
Specify the server timeout value.
Range: 1 to 10000 seconds
Enables or disables the single sign-on.
Value: on and off
Default: off
Specify the domain cookie scope value.
Value Range: 0 or integer > 1
Configuring ClearTrust dispatcher settings
To add a ClearTrust dispatcher settings, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Authentication,
ClearTrust, and Dispatchers from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the list, and click
Refresh.
Click Add.
The Add New Dispatcher screen appears.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add a ClearTrust dispatcher.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
259
Variable
Host Name
Authentication Port
Value
Specifies the host name.
Specifies the authentication port.
Value: 5608
Configuring ClearTrust servers settings
To add a ClearTrust server settings, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Authentication,
ClearTrust, and Servers from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the list, and click
Refresh.
Click Add.
The Add New Server screen appears.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
IP Address
Authentication Port
Use the data in the following table to add a ClearTrust server.
Value
Specifies the IP address of the ClearTrust server.
Specifies the authentication port.
Value: 5615
To remove an existing ClearTrust server from the
ClearTrust Server Table, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
260
Configuration of authentication
2
3
4
5
6
Select Secure Access Domain, AAA,
Authentication, ClearTrust, and Servers from the Navigation pane.
The Authentication screen appears.
Select the secure access domain from the list, and click Refresh.
Select a ClearTrust server entry from the
SiteMinder Server Table.
Click Delete.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Configuring local database authentication
ATTENTION
If you run the quick setup wizard during initial setup, local database authentication is created with authentication ID = 1. The database contains one test user (tg), who belongs to a group called Nortel Health Agent. To continue configuring the local database, go to
“Populating the database” (page 262) .
To configure the Nortel SNAS to use a local database for authentication, use the following procedure:
Procedure steps
Step Action
1
2
3
4
Add the Local method to the domain and create the local database (see
“Adding the Local method” (page 260)
).
Populate the database (see
“Populating the database” (page
).
Modify the local database settings, if desired (see
Local database configuration” (page 266)
).
Export the local database, if desired (see
“Exporting the database” (page 268)
).
--End--
Adding the Local method
To configure the Nortel SNAS to use the Local authentication method, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
261
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, and
Local from the Navigation pane.
The Local screen appears.
Select the secure access domain from the Secure Access
Domain list and click Refresh.
Click Add.
The Add New Local Database Server screen appears.
5
6
Click Update.
The Local authentication method appears in the Authentication
Server table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add an
Authentication Server.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
262
Configuration of authentication
Variable
Auth Id
Name
Value
Specifies the internal identifier for the authentication.
Specifies a name for the authentication method as a mnemonic aid.
The maximum allowable length of the name string is 255 characters, but
Nortel recommends a maximum of 32 characters.
Display Name
Mechanism
Group Authentication
Servers
Future releases of the Nortel SNAS software allows you to reference this name in a client filter, so authentication to this server becomes a condition for access rights for a group.
Specifies a name for the method to be displayed in the Login Service list box on the portal login page, together with the names of other authentication services available.
Displays the authentication method.
Specifies another authentication method to use for retrieving group information.
You can choose any existing Local or LDAP database to retrieve group information. User groups that exist in the RADIUS authentication scheme are added to the user groups found in the specified authentication schemes.
Populating the database
You can populate the Local database in two ways:
• adding users manually (see
“Adding users to the local database” (page
)
• importing a database (see
“Importing a database” (page 264)
)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
263
To manually add individual users to the database, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA,
Authentication, Local, andUsers from the
Navigation pane.
The Users screen appears.
Select the secure access domain and the Auth
ID from the respective lists, and click Refresh.
Click Add.
The Add Single User screen appears.
5
6
7
Click Update.
The new user entry appears in the list of local users.
Repeat step 2 through step 4 for each user that you want to add to the database.
To remove users from the local users list, select a user from the table, click Delete. A
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
264
Configuration of authentication
8
confirmation dialog box appears, click OK. The local user is removed from the list.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add Single User.
Variable
Name
Value
Specifies a unique user logon name.
There are no restrictions on the Nortel
SNAS regarding acceptable user names.
However, if you want the user name in the local database to mirror the Windows login name, observe Windows username conventions (for example, keep the length to no more than 32 characters).
Password
When the client attempts to log on to the
Nortel SNAS domain and local database authentication is applied, the client is prompted for the user name and password that you define for the database.
Specifies the password that applies to the new user. To only use the local database for authorization after an external authentication server has authenticated the user, enter an asterisk (*).
Confirms the user password.
Confirm
Password
Groups Specifies the group to which the new user belongs. The group must exist in the
Nortel SNAS domain. The group name is used for authorization.
ATTENTION
The imported database overwrites existing entries in the local database.
To import a database of local users, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
265
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA,
Authentication, Local, and Users from the
Navigation pane.
The Users screen appears.
Select the secure access domain and the Auth
ID from the respective lists, and click Refresh.
Click Import/Export.
The Import Local User Database from File screen appears.
5
6
Click Import.
Click Apply on the toolbar to import the specified local user database.
--End--
Use the data in the following table to import local user database.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
266
Configuration of authentication
Variable Value
Import Local User Database from File
File System Select the protocol or local to import the file. Fields appear based on the selected file system.
File System: Protocol
Protocol Select the protocol to import the file.
Values: tftp, ftp, scp, and sftp
(default: tftp)
Server
File
FTP User
FTP Password
Secret Key
File System: Local
File
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specify the hostname or IP address of the server.
Specify the filename on the server.
Specify the FTP User name.
Specify the FTP password.
Specifies the password key for user password protection.
Secret Key
To select the file name, click the browse to specify the name of the file to be downloaded.
Specifies the password key for user password protection.
Modifying Local database configuration
You can modify the Local configuration in the following ways:
•
Modify settings for the authentication method itself (see
Local method settings” (page 267)
).
•
Modify user settings in the local database (see
).
•
Modify user passwords in the local database (see
).
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
267
Modifying Local method settings
To modify settings for an existing local or LDAP authentication method, use the following procedure:
4
5
6
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, Local, and General from the Navigation pane.
The General screen appears, showing the current settings for the method.
Select the secure access domain and the Auth ID from the respective lists and click Refresh.
Modify settings for the authentication method as necessary.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Modifying local users
To edit settings for existing users in the database, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
7
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, Local, and Users from the Navigation pane.
The Users screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Select the user that you want to modify.
The Modify Local Database User screen appears.
Click Edit.
Modify the local user information in the applicable fields, as necessary.
Click Update to save the details.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
268
Configuration of authentication
8
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Modifying local user passwords
To modify password settings for existing users in the database, use the following procedure:
4
5
7
8
1
2
Procedure steps
Step Action
3
6
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, Local, and Users from the Navigation pane.
The Users screen appears.
Select the secure access domain and the Auth ID from the respective lists, and clickRefresh.
Select the user you want to modify.
Click Edit.
The Modify Local Database User screen appears.
Modify the local user information in the applicable fields, as necessary.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Exporting the database
To export the database of local users, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, Local, and Users from the Navigation pane.
The Users screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
4
5
6
Configuring authentication
269
Click Export.
The Export Local User Database to File screen appears.
To export the file, click Export.
Click Apply on the toolbar to export the specified local user database.
--End--
Use the data in the following table to export local user database.
Variable Value
Export Local User Database to File
File System Select the protocol or local to export the file. Fields appear based on the selected file system.
File System: Protocol
Protocol
Server
File
Secret Key
Select the protocol to export the file.
Values: tftp, ftp, scp, and sftp
(default: tftp)
Specify the hostname or IP address of the server.
Specify the filename on the server.
Specifies the password key for user password protection.
File System: Local
Secret Key Specifies the password key for user password protection.
Next steps
Procedure steps
Step
1
2
Action
Configure additional authentication methods, if desired (see
“Configuring RADIUS authentication” (page 224)
or
LDAP authentication” (page 234) ).
Set the authentication order (see
“Specifying authentication fallback order” (page 270) ).
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
270
Configuration of authentication
Specifying authentication fallback order
Authentication in the Nortel SNAS solution is performed by checking client credentials against available authentication databases until the first match is found. You can specify the order in which the Nortel SNAS applies the methods configured for the Nortel SNAS domain.
Perform this step even if one method is defined on the Nortel SNAS.
ATTENTION
For best performance, set the authentication order so that the method that supports the biggest proportion of users is applied first. However, if you use the Nortel SNAS local database as one of the authentication methods, Nortel recommends that you set the Local method to be first in the authentication order. The Local method is performed extremely fast, regardless of the number of users in the database. Response times for the other methods depend on such factors as current network load, server performance, and number of users in the database.
To specify authentication fallback order, perform these steps:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, and
AuthOrder from the Navigation pane.
The AuthOrder screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring authentication
271
3
4
5
6
In the Fallback Order section, specify the authentication methods you wish to use.
Rearrange the list so that the methods appear in the desired order.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Viewing and managing MAC entries
To view, add or delete MAC entries, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, Local, and MAC Database from the Navigation pane.
The MAC Database screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
To add an entry, click Add.
The Add new MAC Database entry screen appears.
In the fields provided, enter the necessary information.
To delete an entry, select the entry you wish to delete in the
MAC database table and click Delete.
WARNING
On Delete, the selected entries will be directly deleted from the database.
.
7
8
To view the details of an individual entry, select the entry in the
MAC database table and click Show.
To find a particular MAC entry by using available criteria, click
Search.
--End--
Importing MAC database
To manually import MAC database entries, use the following procedure:
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
272
Configuration of authentication
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, Local, and MAC Database from the Navigation pane.
The MAC Database screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Click Import. The MAC Database screen appears.
Click Import.
--End--
Variable
Protocol
Server
File
Variable definitions
Use the data in the following table to import MAC database.
Value
Specifies the protocol used for file transfer.
Values: ftp, tftp, scp, and sftp.
Specifies the IP address or host name of the server that contains the information.
Specifies the name of the file to be retrieved.
Exporting MAC Database
To manually export MAC database entries, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, Local, and MAC Database from the Navigation pane.
The MAC Database screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Click Export.
The MAC Database screen appears.
To export the file, click Export.
Click Export.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
The MAC Database screen appears.
--End--
Configuring authentication
273
Variable definitions
Use the data in the following table to export MAC database.
Variable
File
Protocol
Server
Value
To select the file name, click the browse to specify the name of the file to be downloaded.
Specifies the protocol used for file transfer.
Values: ftp, tftp, scp, and sftp.
Specifies the IP address or host name of the destination server.
Configuring RADIUS attributes
To configure the RADIUS attributes for the user, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, AAA, Authentication, Local, and RADIUS Attributes from the Navigation pane.
The RADIUS Attributes screen appears.
Select the secure access domain and the Auth ID from the respective lists, and click Refresh.
Click Add.
The Add RADIUS Attribute screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
274
Configuration of authentication
5
6
Click Create RADIUS Attribute.
The created attribute appears in the RADIUS Attributes for User table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to add RADIUS Attributes.
Variable
User
Vendor Id
Attribute Id
Attribute Value
Value
Specify the user from the drop-down list.
Specify the vendor Id for the user.
Specify the attribute Id for the user.
Specify the attribute value for the user.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Management of system users and groups
This chapter provides detailed procedures on how to manage users and groups.
Navigation
•
“User rights and group membership” (page 275)
•
“Managing system users and groups” (page 276)
275
User rights and group membership
There are three groups of system users who routinely access the system for configuration and management:
• admin (administrator)
• certadmin (certificate administrator)
• oper (operator)
ATTENTION
There are two additional types of users with specialized functions: boot and root. For more information, see Nortel Secure Network Access Switch Using the
Command Line Interface (NN47230-100).
Group membership dictates user rights, as shown in
Table 2 "Group membership and user rights" (page 276) . When a user is a member of
more than one group, user rights accumulate. The admin user, who by default is a member of all three groups, has the same user rights as granted to members in the certadmin and oper group, in addition to the specific user rights granted by the admin group membership. The most permissive user rights become the effective user rights when a user is a member of more than one group. For more information about default user groups and related access levels, see Nortel Secure Network Access
Switch Using the Command Line Interface (NN47230-100).
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
276
Management of system users and groups
Table 2
Group membership and user rights
Group
Account
admin
User account
admin
Add user
Yes
System
Delete user
Yes Yes, to own group
Rights
Group
Add user
Delete user
Yes certadmin oper admin oper admin
No
No
No
No
Yes, to own group
Yes, to own group
No
No
Yes
Password
Change own
Change others
Yes, if
Admin is a member of the other user’s first group
Yes No
Yes No
Managing system users and groups
This section describes the procedures to manage users and groups
Managing system users and groups navigation
•
“Managing user accounts” (page 276)
•
“Setting password expiry” (page 279)
•
“Changing your password” (page 280)
•
“Changing another users password” (page 281)
•
“Setting the certificate export passphrase” (page 282)
Managing user accounts
To manage user accounts, select Administration and Users from the
Navigation pane.
The User screen appears, displaying a list of user accounts added to the
Nortel SNAS.
Only the admin user can add users to the system.
Only the admin user can delete users from the system. Of the three built-in users (admin, oper, and root), only the oper user can be deleted.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Managing system users and groups
277
ATTENTION
When you delete a user, the user’s group assignment is also deleted. If you delete a user who is the sole member of a group, none of the remaining users on the system can then be added to that group. Existing users can only be added to a group by a user who is already a member of that group. Before deleting a user, verify that the user is not the sole member of a group.
To manage Nortel SNAS users, select from the following procedures:
•
“Adding new user accounts” (page 277)
•
“Modifying details of existing user accounts” (page 279)
•
“Removing existing user accounts” (page 279)
Adding new user accounts
To add additional user accounts, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and Users from the Navigation pane.
The User screen appears.
Click Add.
The Add New User screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
278
Management of system users and groups
4
Click Save.
The new user entry appears in the User table.
--End--
.
Use the data in the following table to add new User.
Variable
Username
Group
Value
The user name for the new user. The maximum length of the user name is 255 characters. No spaces are allowed.
The group to which the user belongs
(which defines the privileges of the user).
Users added to the system can either belong to the admin (read/write) or oper
(read only) group.
Set Password admin’s Current
Login Password
New Password
New Password
(again)
Specifies the password of the logged on administrator.
Specifies the password for the new user account.
Reconfirm the password for the new user account.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Managing system users and groups
279
Modifying details of existing user accounts
To modifying details of an existing user accounts, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Administration and Users from the Navigation pane.
The User screen appears.
Select the user entry that you want to modify from the User table.
Click Edit.
The Modify Users screen appears.
Modify the information as required.
Click Save.
--End--
Removing existing user accounts
To remove an existing user, use the following procedure:
3
4
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration and Users from the Navigation pane.
The User screen appears.
Select the user entry that you want to delete from the User table.
Click Delete.
--End--
Setting password expiry
To set a password expiry date for all passwords in the system, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
280
Management of system users and groups
3
4
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration and Users from the Navigation pane.
The Users screen appears.
ATTENTION
The password expire time is only applicable to the CLI sessions and not to the BBI sessions.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table for password expiry settings.
Variable
Password Expire Time
Value
Sets the password expiration interval, in seconds.
A value of 0 indicates that the password never expires.
Changing your password
Only the admin user can change the passwords of other users. User who are logged on can change their own passwords.
To change the password for the logged on user, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administration and Users from the Navigation pane.
The Users screen appears.
Select the user from the list whose password you want to change, and click Edit.
The Modify User screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Managing system users and groups
281
4
Click Change Password.
--End--
Variable definitions
Use the data in the following table to change your password.
Variable
Current Password
Enter New Password
Confirm Password
Value
The password of the logged on administrator.
Sets the new password. The password must be at least four characters and can contain spaces. The password is case sensitive.
Confirms the new password.
Changing another users password
Only the admin user can change the passwords of other users.
To change the password for another user, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Administration and Users from the Navigation pane.
The Users screen appears.
Select the user from the list whose password you want to change, and click Edit.
The Modify User screen appears.
Click Change Password.
--End--
Variable definitions
Use the data in the following table to change another user password.
Variable
Current Login Password
Value
The current password of the admin user performing the change.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
282
Management of system users and groups
Variable
New Password
Confirm Password
Value
Sets the new password. The password must be at least four characters and can contain spaces. The password is case sensitive.
Confirms the new password.
Setting the certificate export passphrase
You can set a certificate administrator’s passphrase for encrypted private keys in a configuration backup, if the certificate administrator role is separate from the administrator role.
If the admin user is a member of the certadmin group (the default setting), the admin user must provide an export passphrase to protect the private keys in the configuration dump, each time the configuration is backed up to an external file server.
You must set a certificate administrator export passphrase only if the admin user has removed himself or herself from the certadmin group and added a certificate administrator user with certadmin group rights. When a configuration backup is performed, the certificate export passphrase is automatically used to protect the encrypted private keys. When the configuration is restored from the file exchange server, the user is prompted for the correct certificate export passphrase.
To set a certificate export passphrase, use the following procedure:
3
4
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration and Users from the Navigation pane.
The Users screen appears.
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to set certificate export passphrase.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring system credentials
283
Variable
Passphrase
Confirm Passphrase
Value
Sets the passphrase. Must be at least four characters.
Confirms the passphrase.
Configuring system credentials
The system credential information are required to install the Nortel Health
Agent.
To configure system credentials, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, AAA, Groups, and System
Credentials from the Navigation pane.
The System Credentials screen appears.
.
3
4
Select the secure access domain and group from the respective lists, and click Refresh.
Click Update to save the details.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
284
Management of system users and groups
5
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure System Credentials.
Variable
System Username
Value
Specifies the system username.
System Password Specified the system password.
Confirm System Password Reconfirm the system password.
System Credentials Specifies that the system credential details are enabled or disabled.
System Previous
Username
System Previous
Password
Confirm System Previous
Password
Set Passwords
Specifies the system previous username.
Specifies the system previous password.
Reconfirm the system previous password.
Auto Update Clients
Previous User/Password
Accepted until
New Password Effective
On
Earliest Date to push new
User/Password
Specifies that the system password and the system previous password are specified.
Enables or disables the auto update for the clients.
Values: enabled and disabled
Specify the date until which the previous user and password are accepted.
Specify the date on which the new password is effective.
Specify the earliest date a new user and password is pushed to a client.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Customization of the portal and user logon
285
This chapter provides detailed procedures on how to customize portal and user logon.
Navigation
•
“Overview of the portal and user logon” (page 285)
•
“Customize the portal and logon” (page 295)
Overview of the portal and user logon
The end user accesses the Nortel SNAS network through the Nortel SNAS portal. You can customize the end user experience by configuring the following logon and portal features:
•
“Captive portal and Exclude List” (page 286)
—
•
—
“Portal look and feel” (page 288)
—
“Language localization” (page 291)
—
“Linksets and links” (page 292)
—
—
“Automatic redirection to internal sites” (page 293)
—
“Examples of redirection URLs and links” (page 294)
•
“Managing the end user experience” (page 294)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
286
Customization of the portal and user logon
Captive portal and Exclude List
When the Nortel SNAS is configured to function as a captive portal, the
Nortel SNAS acts as a DNS proxy while clients are in the Red VLAN. The captive Web portal:
• accepts redirected HTTP/HTTPS requests from clients
• resolves unknown names to a fixed IP address
• receives and manages communication requests from the clients to unauthorized network resources
• redirects client requests to an authentication page served by the portal
You must configure the DHCP server to assign the portal Virtual IP address (pVIP) as the DNS server when the client is in the Red VLAN.
The DHCP server is configured to specify the regular DNS servers for the scopes for the Green and Yellow VLANs. After the client is authenticated and is in a Green or Yellow VLAN, DNS requests are forwarded in the regular way to the corporate DNS servers.
For information about configuring the captive portal, see
“Configuration of the captive portal” (page 296) .
Exclude List
The Exclude List is a configurable list of domain names that cannot be captured by the Nortel SNAS. The DNS server in the captive portal forwards requests for domain names in the Exclude List directly to the corporate DNS servers.
In order to speed up client logon, add to the Exclude List any domain names for URLs that are routinely accessed during client logon or startup sequences. The Exclude List entry can be the full domain name or an expression.
By default, the captive portal Exclude List includes the following:
• windowsupdate
This matches all automatic Windows update domain names used by browsers, for example:
— windowsupdate.com
— windowsupdate.microsoft.com
— download.windowsupdate.microsoft.com
For information about configuring the Exclude List, see
.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Overview of the portal and user logon
287
The following table lists the regular expressions and escape sequences that you can use in an Exclude List entry. The set of allowable regular expressions is a subset of the set found in egrep and in the AWK programming language. The escape sequences are allowed in Erlang strings.
Table 3
Allowed regular expressions and escape sequences
.
\c
^
String
Usage
Expressions
c Matches the non-metacharacter c.
$
[abc...]
Matches the literal character c (see escape sequence).
Matches any character.
Matches the beginning of a string.
Matches the end of a string.
Character class, which matches any of the characters abc....
\s
\d
\r
\t
\f
\n
\e
\v
[^abc...]
Character ranges are specified by a pair of characters separated by a hyphen (-).
Negated character class, which matches any character except
abc....
r1|r2 r1r2 r+
Alternation—matches either r1 or r2.
Concatenation—matches r1 and then r2.
r* r?
(r)
Matches one or more r’s.
Matches zero or more r’s.
Matches zero or one r’s.
Grouping—matches r.
Escape sequences
\b backspace form feed newline (line feed) carriage return tab escape vertical tab space delete
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
288
Customization of the portal and user logon
Table 3
Allowed regular expressions and escape sequences (cont’d.)
\
\ddd the octal value ddd literal character
For example: \c for literal character c, \\ for backslash, \" for double quotation marks (")
Portal display
You can modify the following features of the portal display and behavior:
• portal look and feel (see
“Portal look and feel” (page 288) )
• language used (see
“Language localization” (page 291) )
• links (see
“Linksets and links” (page 292)
)
• post-authentication behavior (see
“Automatic redirection to internal sites” (page 293)
)
Portal look and feel
You can customize the colors, logos, icons, and text used on the portal page. You can also add custom content, such as Java applets, to the portal. You can then add links to the portal page to make the content available to clients.
This section includes information about the following topics:
•
“Default appearance” (page 288)
•
For information about the commands to use to configure the portal look and feel, see
“Configuring the portal display” (page 309)
.
Default appearance
The
Figure 8 "Portal Display screen" (page
shows the default portal Home screen.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Figure 8
Portal Display screen
Overview of the portal and user logon
289
Colors
There are four colors used on the portal page:
• the large background area below the tabs
• the background area behind the tab labels
• the fields, information area, and icons on the active tab
• not used area
Five optional color themes exist. The themes are predefined sets of
Web-safe colors that complement each other:
• aqua
• apple
• jeans
• cinnamon
• candy
You can change the individual colors, but Nortel recommends using the color themes to change the look and feel of the portal page. If you change the portal colors, use colors that are considered Web safe. Also consider how the applied colors fit with your company logo and brand.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
290
Customization of the portal and user logon
The colors are specified by using hexadecimal codes. The following table lists the hexadecimal values for some commonly used Web-safe colors.
For additional color values, use an Internet search engine to find Web sites offering comprehensive listings.
Table 4
Common colors with hexadecimal codes
Color
White
Black
Dark gray
Light gray
Red
Green
Blue
Yellow
Orange
Violet
Dark violet
Pink
Brown
Beige
Lime green
Light green
Dark blue
Navy
Light skyblue
Medium blue
Dark red
Hexadecimal code
FFFFFF
000000
A9A9A9
D3D3D3
FF0000
008000
0000FF
FFFF00
FFA500
EE82EE
9400D3
FFC0CB
A52A2A
F5F5DC
32CD32
90EE90
00008B
000080
87CEFA
0000CD
8B0000
For the commands to use to configure the colors used on the portal,
“Changing the portal colors” (page 314)
.
For examples of how you can use macros to configure links and redirection to internal sites, see
“Automatic redirection to internal sites”
.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Overview of the portal and user logon
291
Self Service Portal
The Nortel SNAS self-service portal provides a web-based ‘help desk’ for users to collect information about their network connection, compliance, user status, and also for provisioning a guest access for users. This can be customized by using localized language files. The Nortel Health Agent runs on non-English versions of the operating systems.
•
“Language localization” (page 291)
.
Language localization
The default English-language dictionary file contains entries for the text for tab names, general text, messages, buttons, and field labels on the portal page. The entries in the dictionary file can be translated into another language. You can then set the portal to display the translated text.
The languages supported by the Nortel SNAS are configured for the system, but the language selected for the portal is a domain parameter.
The Nortel SNAS uses ISO 639 language codes to track languages that are added to the configuration. English (en) is the predefined language and is always present.
To change the language displayed for tab names, general text, messages, buttons, and field labels on the portal page, use the following procedure:
Changing the portal page language
Procedure steps
Step Action
1
2
Export the language definition template (see
“Importing or exporting language definitions” (page 304) ).
Translate the language definition template file.
a
Open the file with a text editor such as Notepad.
b Verify that the
charset
parameter specified in the
Content-Type entry is set according to the character encoding scheme you are using. For example:
"Content-Type: text/plain; charset=iso-8859-1/n"
c
Translate the entries displayed under msgstr (message string).
ATTENTION
Do not translate the entries under msgid (message id).
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
292
Customization of the portal and user logon
3
4
Useful Open Source software tools exists for translating po files. Search for po files editor in your Web search engine to find tools that run on Windows and Unix. A translation tool is particularly useful when a new version of the Nortel SNAS software is released: you can export the new template file supplied with the software and merge it with a previously translated language file so that only the new and changed text strings need to be translated.
Import the translated language definition file (see
“Importing or exporting language definitions” (page 304) ).
Set the portal to display the new language (see
“Setting the portal display language” (page 306)
).
--End--
Linksets and links
You can add the following types of links to the portal Home tab:
•
External—links directly to a Web page. Suitable for external Web sites.
A linkset is a set of one or more links. Each linkset configured for the domain can be mapped to one or more groups and extended profiles in the domain. After the client is authenticated, the client’s portal page displays all the links included in the linksets associated with the client’s group. The client’s portal page also displays all the linksets associated with the client’s extended profile. For information about mapping linksets to groups and extended profiles, see
“Mapping linksets to a group or profile” (page 208)
.
Autorun linksets
You can enable an autorun feature for a linkset so that all links defined for that linkset execute automatically after the client is authenticated. For example, you can configure an autorun linkset to automatically link to the URL of the remediation server and then map this linkset to all extended profiles, which filter for clients who fail the Nortel
Health Agent host integrity check.
No links for the autorun linkset display on the portal page. Each link in the linkset opens in a new browser window. If the autorun linkset includes multiple links, multiple browser windows open. For information about configuring autorun, see
“Configuring linksets” (page 320) .
The linkset autorun feature is similar to the portal feature allowing automatic redirection to internal sites (see
this functionality. Also, unlike the linkset autorun feature, the automatic redirection feature does not open the link in a new browser window.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Overview of the portal and user logon
293
Planning the linksets
Plan your configuration so that linksets containing common links are separate from linksets containing group-specific links.
Also, ensure that the links you provide to resources do not contradict the client’s access rights.
You can control the order in which links display on the portal Home tab.
Consider the following in your planning:
•
Linksets for the group display after the linksets for the client’s extended profile.
•
The index number you assign to the linkset controls the order in which the linksets display. You assign the index number when you map the linkset to the group or extended profile (see
“Mapping linksets to a group or profile” (page 208)
).
•
The index number you assign to the link controls the order in which the links display within the linkset. You assign the index number when you include the link in the linkset (see
“Configuring links” (page 323)
).
Macros
Macros are inline functions you can use to insert variable arguments in the text to customize the portal for individual users.
The following macros are available for use as arguments in parameters for links, display text, and redirection commands:
•
<var:portal>
—expands to the domain name of the portal
•
<var:user>
—expands to the user name of the currently logged on client
•
<var:password>
—expands to the password of the currently logged on client
•
<var:group>
—expands to the name of the group of which the currently logged on client is a member
Automatic redirection to internal sites
You can configure the portal to automatically redirect authenticated clients to an internal site. Unlike the linkset autorun feature, automatic redirection does not open a new browser window. Rather, it replaces the default
Home page in the internal frame on the portal browser page. As long as the browser remains open, the session remains logged on.
The commands to configure automatic redirection require you to specify the URL to which the clients are redirected, prefixed by the portal address
(see
“Configuring the portal display” (page 309)
).
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
294
Customization of the portal and user logon
Examples of redirection URLs and links
The
Table 5 "Examples of redirection URLs and link text" (page 294)
table shows example specifications for redirection URLs and associated links. In these examples:
• the portal address is nsnas.example.com
• the address to which you want to redirect clients is inside.example.com
Table 5
Examples of redirection URLs and link text
Purpose
Redirect the client to an internal site.
Redirection URL or link text
Redirection URL: https://nsnas.example.com/http/inside.example
.com
or
Redirect the client to a password-protected site.
https://<var:portal>/http/inside.example.com
Redirection URL:
ATTENTION
The user name and password on the intranet site and the portal must be identical.
https://<var:portal>/http/<var:user>:<var:passw ord>@inside.example.com/protected
Redirect clients to different sites, depending on their group membership (deptA or deptB).
Linktext (static text) entry:
Insert a link on the internal site for the client to log off from the portal.
<script>if ("<var:group>" ==
"deptA") { location.replace
("https://nsnas.example.com/http/ inside.example.com/deptA.html");} else if ("<var:group>" ==
"deptB") { location.replace
("https://nsnas.example.com/http/ inside.example.com/deptB.html");}
</script>
Link:
<a href=https://nsnas.example.com/ logout.yaws> Logout from portal </a>
Managing the end user experience
Nortel recommends that you consider the following ways to manage the end user’s experience:
•
“Automatic JRE upload” (page 295)
•
“Windows domain logon script” (page 295)
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
295
Automatic JRE upload
The Nortel SNAS portal requires the client device to be running a minimum version of the Java Runtime Environment (JRE) so that the Nortel Health
Policy administrator can load properly. Nortel recommends adding the required JRE version and plugins.html as custom content to the portal.
By doing this, if the client does not meet the Java requirement and Nortel
Health Agent does not load, the client is presented with a logon screen to automatically download and install the required JRE.
3
4
To configure the portal to automate the process of updating the client’s
JRE version, use the following procedure:
Procedure steps
Step Action
1
2
Create the plugins.html file, with a link to the JRE installer that you want.
Download the JRE installer from the Sun Microsystems Java
Web site ( www.java.com
).
Bundle plugins.html and the JRE installer in a zip file.
Add the zip file as custom content to the portal.
--End--
For general information about adding custom content to the portal, see
“Configuring custom content” (page 316)
. For information about the minimum JRE requirements, see Nortel Secure Network Access Switch
Release Notes — Software Release 2.0 () .
Windows domain logon script
Configure a Windows domain logon script to automatically launch the end user’s browser and load the Nortel SNAS portal page as the default page.
The exact requirements for the script depend on your particular network setup and usual modes of end-user access.
Customize the portal and logon
This section describes the procedures to use and customize the portal and user logon.
Customize the portal and logon navigation
•
“Configuration of the captive portal” (page 296)
•
“Changing the portal language” (page 303)
•
“Configuring the portal display” (page 309)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
296
Customization of the portal and user logon
•
“Changing the portal colors” (page 314)
•
“Configuring custom content” (page 316)
•
“Configuring linksets” (page 320)
•
“Configuring links” (page 323)
Configuration of the captive portal
By default, the Nortel SNAS is set up to function as a captive portal. For more information about the captive portal in the Nortel SNAS domain, see
“Captive portal and Exclude List” (page 286)
.
To configure the Nortel SNAS as a captive portal, use the following procedures:
•
“Enable DNS capture” (page 296)
•
“Configuring the DNS Exclude List” (page 297)
Enable DNS capture
To configure the Nortel SNAS portal as a captive portal, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and DNS Capture from the
Navigation pane.
The DNS Capture screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
297
3
4
The following table describes the DNS Capture fields.
Fields
DNS Capture
DNS Exclude List
Description
When selected, enables captive portal functionality.
Lists the currently configured DNS domains to exclude when using the Nortel SNAS portal as a captive portal.
Select Update to enable the Nortel SNAS portal as a captive portal.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Configuring the DNS Exclude List
The Exclude List is a list of domain names that cannot be captured by the
Nortel SNAS. For more information about the Exclude List, see
.
To create and manage the Exclude List, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and DNS Capture from the
Navigation pane.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
298
Customization of the portal and user logon
3
The DNS Capture screen appears.
Click Add.
The Add DNS Exclude List screen appears.
6
7
4
5
Click Update.
The entry appears in the DNS Exclude List.
To remove an entry from the Exclude List, select the entry you want to remove and click Delete.
When prompted, click Yes.
The entry is removed from the DNS Exclude List.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add DNS Exclude list.
Variable
Domain
Value
Specify the domain name you want to exclude. The domain name is a string that identifies the domain names to be forwarded directly to the corporate
DNS servers.
For information about allowable expressions and escape sequences, see
.
Inserting the DNS Exclude List
To insert entries to the DNS exclude list, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Variable
Identifier
Domain
Customize the portal and logon
299
1
2
Procedure steps
Step Action
3
4
5
6
Select the Config tab.
Select Secure Access Domain and DNS Capture from the
Navigation pane.
The DNS Capture screen appears.
Click Insert.
The Insert DNS Exclude List screen appears.
Click Update.
The new entry appears in the DNS Exclude List table.
Move DNS Exclude List from moves the value by number,
From Index values to To Index values.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to insert DNS exclude list.
Value
Specify the index to insert. Index must be a positive number.
Specify the domain name you want to exclude. The domain name is a string that identifies the domain names to be forwarded directly to the corporate DNS servers.
For information about allowable expressions and escape sequences, see
Moving the DNS Exclude List
To move entries of DNS exclude list, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and DNS Capture from the
Navigation pane.
The DNS Capture screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
300
Customization of the portal and user logon
3
4
5
Move DNS Exclude List from moves the value by number,
From Index values to To Index values.
Click Move.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuration of the captive portal
By default, the Nortel SNAS is set up to function as a captive portal. For more information about the captive portal in the Nortel SNAS domain, see
“Captive portal and Exclude List” (page 286)
.
To configure the Nortel SNAS as a captive portal, use the following procedures:
•
“Enable DNS capture” (page 296)
•
“Configuring the DNS Exclude List” (page 297)
Enable DNS capture
To configure the Nortel SNAS portal as a captive portal, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and DNS Capture from the
Navigation pane.
The DNS Capture screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
301
3
4
The following table describes the DNS Capture fields.
Fields
DNS Capture
DNS Exclude List
Description
When selected, enables captive portal functionality.
Lists the currently configured DNS domains to exclude when using the Nortel SNAS portal as a captive portal.
Select Update to enable the Nortel SNAS portal as a captive portal.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Inserting the DNS Exclude List
To insert entries to the DNS exclude list, use the following procedure:
Procedure steps
Step
1
2
3
Action
Select the Config tab.
Select Secure Access Domain and DNS Capture from the
Navigation pane.
The DNS Capture screen appears.
Click Insert.
The Insert DNS Exclude List screen appears.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
302
Customization of the portal and user logon
Variable
Identifier
Domain
4
5
6
Click Update.
The new entry appears in the DNS Exclude List table.
Move DNS Exclude List from moves the value by number,
From Index values to To Index values.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to insert DNS exclude in the DNS capture list.
Value
Specify the index to insert. Index must be a positive number.
Specify the domain name you want to exclude. The domain name is a string that identifies the domain names to be forwarded directly to the corporate DNS servers.
For information about allowable expressions and escape sequences, see
Moving the DNS Exclude List
To move entries of DNS exclude list, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and DNS Capture from the
Navigation pane.
The DNS Capture screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
3
4
5
Customize the portal and logon
303
Move DNS Exclude List from moves the value by number,
From Index values to To Index values.
Click Move.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Changing the portal language
To change the language displayed for tab names, general text, messages, buttons, and field labels on the portal page, complete the following procedures:
Procedure steps
Step Action
1
2
3
4
Export the language definition template (see
“Importing or exporting language definitions” (page 304) ).
Translate the language definition template file (see
“Language localization” (page 291) ).
Import the translated language definition file (see
“Importing or exporting language definitions” (page 304) ).
Set the portal to display the new language (see
“Setting the portal display language” (page 306)
).
--End--
Configuring language support
To manage language definition files in the system, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Operation and Language from the Navigation pane.
The Language screen appears.
Choose from one of the following tasks:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
304
Customization of the portal and user logon
•
“Viewing predefined languages” (page 304)
•
“Viewing and removing custom languages” (page 304)
•
“Importing or exporting language definitions” (page 304)
--End--
Viewing predefined languages
To view predefined languages, select
Operation and Language from the Navigation pane. The Language screen appears.
Viewing and removing custom languages
To view custom languages, use the following procedure:
Procedure steps
Step
1
2
3
4
Action
Select the Config tab.
Select Operation and Language from the Navigation pane.
The Language screen appears.
To delete a custom language, select the language and click
Delete.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Importing or exporting language definitions
To import or export a language definition, use the following procedure:
Procedure steps
Step
1
Action
Select Operation and Language from the Navigation pane.
The Import/Export Language Definition screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
305
2
3
4
To import the language definition file, click Import Language.
To export the language definition file, click Export Language.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
ATTENTION
When exporting, the language definition is exported immediately after the Apply button is clicked.
--End--
Use the data in the following table to import or export language definition.
Variable
Protocol
Value
Select the protocol used to import or export the language definition.
Values: tftp, ftp, scp, and sftp
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
306
Customization of the portal and user logon
Variable
Server
File
Language
Code
Value
The User and Password is not displayed while selecting the tftp protocol.
Specify the host name or IP address of the server.
Specify the name of the language definition file.
Specifies the ISO 639 language code.
Setting the portal display language
To set the preferred language for the portal display, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Portal Display, Language, and
General from the Navigation pane.
The General screen appears.
3
4
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Set Portal Language.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
5
Customize the portal and logon
307
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table for portal display language settings.
Variable
Character Set In
Use
Value
Specifies the character set currently in use.
Language Code
(ISO 639)
To change or configure this character set, see
Specifies the language to be used in the portal display.
By default, English is the only language available. Before you can select a custom language, you must import the corresponding language definition file (see
“Importing or exporting language definitions” (page
Exporting or importing cluster configuration
To export or import the cluster configuration, use the following procedure:
Procedure steps
Step Action
1
Select Operation and Configuration from the Navigation pane.
The Export/Import Cluster Configuration screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
308
Customization of the portal and user logon
2
3
4
To export the Cluster Configuration, click Export.
To import the Cluster Configuration, click Import.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to export or import thebcluster configuration.
Variable Value
Export/Import Cluster Configuration
File System Select the protocol or local to import the file.
Fields appear based on the selected file system.
File System: Protocol
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
309
Variable
Protocol
Value
Select the protocol to export/import the file.
Values: tftp, ftp, scp, and sftp (default: tftp)
Server
File
FTP User
FTP Password
Secret Key
File System: Local
File
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specify the hostname or IP address of the server.
Specify the filename on the server.
Specify the FTP User name.
Specify the FTP password.
Specifies the password key for user password protection.
To select the file name, click the browse button to specify the name of the file to be imported.
ATTENTION
In File System: Local the File field is not appears in the Export cluster configuration page.
Specifies the key to encrypt/decrypt settings.
Secret Key
Configuring the portal display
To modify the look and feel of the portal page that appears in the client’s
Web browser, use one of the following procedures:
•
“Configuring content” (page 309)
•
“Importing banners” (page 313)
Configuring content
To configure and modify portal content, use the following procedure:
Procedure steps
Step Action
1
Select the Config tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
310
Customization of the portal and user logon
2
Select Secure Access Domain, Portal Display, and General from the Navigation pane.
The General screen appears.
3
4
5
Select the secure access domain from the Secure Access List, and click Refresh.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to configure or modify portal content.
Variable
Company Name
Use IE ClearAuthentic ationCache
Icon Mode
Value
Specifies the company name to display on the portal page.
Specifies whether IE 6 special feature ClearAuthenticationCache should be controlled.
Specifies the mode for the icons representing portal links (for example, file server links):
•
Clean displays simple icons using a single color (color3)
•
Fancy displays multicolored, shaded, and animated icons
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
311
Variable Value
The default value is fancy.
For more information about linksets and links, see
(page 292) . For more information
about configuring links, see
“Configuring links” (page 323) .
For information about customizing the colors used on the portal page, see
Configuring login page text
To configure and modify login page text, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Portal Display, and Login
Page from the Navigation pane.
The Login Page screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
312
Customization of the portal and user logon
3
4
Select the secure access domain from the Secure Access
Domain list and click Refresh.
Click Update to save the details.
--End--
Use the data in the following table to view Login Page.
Variable
Text
Value
Specifies custom text to be displayed on the portal logon page. You can type in the text or paste it in at the prompt. Press Enter to create a new line.
Configuring redirect URL
To configure and modify redirect URL details, use the following procedure:
Procedure steps
Step
1
2
Action
Select the Config tab.
Select Secure Access Domain, Portal Display, and Redirect
URL from the Navigation pane.
The Redirect URL screen appears.
3
Select the secure access domain from the Secure Access
Domain list and click Refresh.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
4
Customize the portal and logon
313
Click Update to save the details.
--End--
.
Use the data in the following table to configure redirect
URL.
Variable Value
Redirect URL
Sets the URL to which clients are automatically redirected after authentication by the portal.
For example, if the portal address is nsnas.example.com and you want to redirect clients automatically to inside.example.com, the URL parameter is:
https://nsnas.example.com/http/inside.examp
le.com
Alternatively, you can use the
<var:portal> macro to represent the portal address.
With redirection configured, the client cannot access tabs on the portal page.
To remove redirection, replace the previously specified URL with an empty string by pressing Enter at the URL prompt.
Importing banners
To import a banner to display on the portal Home page, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain, Portal Display, and
Presentation from the Navigation pane.
The Portal Display screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
314
Customization of the portal and user logon
4
5
6
To change the banner, click the Edit Banner link.
Click Browse and select the new banner.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
When the download is complete and you apply the changes, the new image replaces the existing banner image on the portal Web page.
ATTENTION
Clients who are currently logged on when the banner is updated do not notice the change unless they reload the portal Web page.
The maximum size of the banner image file is 16 MB. If several
Nortel SNAS domains exist, the total size of all imported banner image files must not exceed 16 MB. For more information about the customizable elements on the portal Web page, see
“Portal look and feel” (page 288)
.
--End--
Changing the portal colors
To customize the colors used for portal display, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Portal Display, and
Presentation from the Navigation pane.
The Portal Display screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
315
3
4
Enter the color information in the applicable fields. The following table describes the Color Settings fields:
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
For more information about the portal colors and themes, see
“Portal look and feel” (page 288) .
--End--
Variable definitions
Use the data in the following table for color settings.
Variable
Banner
Link URL
Static Link Text
Value
Uploads a new banner image to the portal.
Configures the display mode for the Link URL field on the Home tab.
Specifies the static text to display for all NSNA controller users on the portal home page. The text is displayed above the links that are specific for a user, depending on the group membership.
Number of Columns Specifies the desired number of columns to be displayed in the link table on the home tab of the portal.
Width of the Link Columns Specifies the width of the link table on the home tab of the portal.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
316
Customization of the portal and user logon
Variable
Color
Themes
Value
Customizes the colors of the portal page. Use the edit color link option provided to customize the colors. The edit option is provided for the header, the active area, nonactive area, and the background area.
Sets the predefined color themes for the portal page. The currently available color themes are default, aqua, apple, jeans, cinnamon, and candy.
Configuring custom content
To configure custom content, such as Java applets, on the portal, use the following procedure:
•
“Viewing basic information about custom content” (page 316)
•
“Importing custom content” (page 318)
•
“Exporting custom content” (page 318)
•
“Removing custom content” (page 319)
Viewing basic information about custom content
To view basic information about the existing custom content, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Portal Display, and Custom
Content from the Navigation pane.
The Custom Content screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
317
3
4
5
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to view custom content fields.
Variable Value
Available Space
Displays the remaining memory space available for custom content, in kilobytes
(KB).
Access to
Custom Content
This field is informational and cannot be modified.
Specifies the custom content state. When selected, enables client access to custom content.
The default is disabled.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
318
Customization of the portal and user logon
Importing custom content
To import custom content, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, Portal Display, and Custom
Content from the Navigation pane.
The Custom Content screen appears.
Select the secure access domain from the Secure Access
Domain, and click Refresh.
Click Import Custom Content.
--End--
Use the data in the following table to import custom content.
Variable
Protocol
Server
File
User
Password
Value
Specifies the import protocol.
Values: tftp, ftp, scp, and sftp default: ftp
Specifies the host name or IP address of the server.
Specifies the name of the content file (.zip) on the server.
Specifies the username used to connect to the FTP server.
Specifies the password used to connect to the FTP server.
Exporting custom content
To export custom content, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Portal Display, and Custom
Content from the Navigation pane.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
3
4
Customize the portal and logon
319
The Custom Content screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Export Custom Content.
--End--
Use the data in the following table to export custom content.
Variable
Protocol
Server
File
User
Password
Value
Specifies the import protocol.
Values: tftp, ftp, scp, and sftp default: ftp
Specifies the host name or IP address of the server.
Specifies the name of the content file (.zip) on the server.
Specifies the username used to connect to the FTP server.
Specifies the password used to connect to the FTP server.
Removing custom content
To remove all existing custom content from the portal, use the following procedure:
1
2
Procedure steps
Step Action
3
4
5
Select the Config tab.
Select Secure Access Domain, Portal Display, and Custom
Content from the Navigation pane.
The Custom Content screen appears.
Select the secure access domain from the Secure Access
Domain, and click Refresh.
Click Delete All Custom Content.
A confirmation dialog box appears.
Click OK.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
320
Customization of the portal and user logon
6
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring linksets
A linkset is a set of links on the portal Home tab. For more information about linksets and links, see
“Linksets and links” (page 292) .
To create or modify a linkset, use one of the following procedures:
•
“Creating a linkset” (page 320)
•
“Modifying a linkset” (page 322)
Creating a linkset
To create a linkset, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain and Portal Linksets from the
Navigation pane.
The Portal Linksets screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Click Add.
The Add New Linkset screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
321
5
6
Click Update.
The new linkset appears in the Linkset table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add Linkset.
Variable
Id
Name
Value
Specifies an integer in the range 1 to
1064 that uniquely identifies the linkset in the Nortel SNAS domain.
Specifies a name for the linkset. The name must be unique in the domain.
The maximum length of the string is 255 characters.
Reference the linkset name when you map the linkset to groups or extended profiles.
For more details about linksets, see
“Linksets and links” (page 292)
.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
322
Customization of the portal and user logon
Variable
Link Text
Autorun
Value
Specifies the text to display as a heading above the linkset links on the portal Home tab.
Text can be an ordinary string or HTML code.
The heading text is optional.
With autorun support enabled, all links defined for the portal link group are executed automatically when the user enters the Portal after they are successfully authenticated. In addition, these links are not visible on the Home tab
Modifying a linkset
To modify a linkset, use the following procedure:
7
8
4
5
6
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Secure Access Domain and Portal Linksets from the
Navigation pane.
The Linkset screen appears.
Select the secure access domain from the Secure Access
Domain list, and click Refresh.
Select the portal linkset you want to modify from the list.
Click Edit.
Enter the linkset information in the applicable fields.
ATTENTION
If you run the quick setup wizard during initial setup, two linksets are created: tg_passed
(linkset ID = 1) and tg_failed
(linkset ID = 2).
The linksets are empty.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Customize the portal and logon
323
Configuring links
After you create the linkset, add the individual links included in the linkset.
For information about links, see
“Linksets and links” (page 292)
.
Use the following procedures to create or modify the links included in the linkset:
•
“Creating an external link” (page 323)
•
“Modifying external link settings” (page 324)
•
Creating an external link
To create an external link, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Secure Access Domain, Portal Linksets, and Links from the Navigation pane.
The Links screen appears.
Select the secure access domain and the portal linkset from the respective lists, and click Refresh.
Click Add.
The Add Portal Links screen appears.
.
5
6
Enter the link information and click Continue. The corresponding screen appears.
Enter the external link information in the applicable fields.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
324
Customization of the portal and user logon
7
8
Click Update.
The new link appears in the Links table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Use the data in the following table to add portal links.
Variable
Index
Text
Value
Specifies an integer in the range 1 to 256 that uniquely identifies the link within the linkset.
Specifies the text to display as the clickable link text on the portal Home tab.
Link Type
Text can be an ordinary string or HTML code. The client sees only the link text, not the URL contained in the link.
Select the Type of link to be configured.
External link information
Link ID
Text:
Specifies the identifier for the link.
Specifies the clickable link text to appear on the Home screen of the portal.
Protocol
Host
Path
Specifies the protocol to be used for the external links.
Specifies the Web server by IP address or host name,
Specifies the path on the Web server.
You must specify a path. A single slash
(/) indicates the Web server document root.
Modifying external link settings
To modify a link, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain, Portal Linksets, and Links from the Navigation pane.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
3
4
5
6
7
Customize the portal and logon
325
The Links screen appears.
Select the secure access domain and portal linksets from the respective lists, and click Refresh.
Select the link that you want to modify, and click Edit.
Enter the link information in the applicable fields.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Reordering links
To change the order in which links display in the linkset, use the following procedure:
Procedure steps
Step
1
2
3
4
Action
Select the Config tab.
Select Secure Access Domain, Portal Linksets, and Links from the Navigation pane.
The Links screen appears.
Use the arrow up and arrow down buttons to move the link entry to the correct position.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
326
Customization of the portal and user logon
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
327
.
Configuration of Nortel SNAS scheduler
The Nortel SNAS scheduler allows to run automated system maintenance tasks at scheduled intervals. This chapter provides detailed procedures to configure scheduler task.
Navigation
•
“Configuring the scheduler task” (page 327)
•
“Setting scheduler status” (page 331)
•
“Deleting a scheduled task” (page 331)
•
“Viewing or searching a scheduled task” (page 332)
Configuring the scheduler task
The scheduler lists the currently configured scheduled tasks. You can create a scheduled task. To create and configure scheduler task, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Operation and Scheduler from the Navigation pane.
The Scheduler screen appears.
Click Add.
The Add New Scheduled Task screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
328
Configuration of Nortel SNAS scheduler
4
5
6
Based on the selected scheduled task (Reboot, Stoptrace,
Selftest, Upgrade, Ptcfg, Starttrace, and Export) the New
Scheduled Task page prompts you with their respective fields based on the selected task type. Enter the scheduled task information in the applicable fields.
Click Save.
The new scheduler task appears on the top of the Scheduler list table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
Task
Variable definitions
Use the data in the following table to add new scheduler task.
Day of week
Value
Specifies the scheduled task.
Values: Ptcfg | Reboot | Starttrace | Stoptrace | Selftest | Upgrade | Export
Select the day of the week. You can select the multiple days in a week.
Range: 0 - 6 (Sunday = 0) Every Day (*)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Variable
Month(s)
Day(s)
Hour(s)
Minute(s)
Comment
Selftest isd to run
Host Id
Items to Check
Upgrade
Protocol
Host
File
FTP User
Password
Starttrace
Tags
Domain
Configuring the scheduler task
329
Value
Select the month. You can select the multiple months.
Range: 1 - 12 Every Month (*)
Select the day of the month. You can select the multiple days of a month.
Range: 1 - 31 Every Day (*)
Specify the hour.
Range: 0 - 23
Specify the minute.
Range: 0 - 59
Specify the comment.
Specify the isdl.
Values: one-isd, and all-isds
Select the host id.
Select the items to check.
Values: all, gw, routes, dns, auth, links, and switches default: all
Specify the protocol.
Values: tftp, and ftp
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specify the hostname or IP address of server.
Specify the filename on server.
Specify the FTP User name.
Specify the FTP password.
Specify the tag.
1 all, 2 aaa, 3 dhcp, 4 dns, 5 ssl, 6 tg, 7 snas, 8 patchlink, 9 radius, and 10 nap default: 1 all
Specify the domain.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
330
Configuration of Nortel SNAS scheduler
Variable
Output Mode
Value
Specify the output mode.
Values: tftp, and ftp
TFTP Server
File
FTP User
Password ptcfg
Protocol
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specify the TFTP server.
Specify the filename on server.
Specify the FTP User name.
Specify the FTP password.
Specify the protocol.
Values: tftp, and ftp
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Host
File
Specify the hostname or IP address of server.
Specify the filename on server.
Secret Key
Password
Export
Specify the secret key.
Confirm Password Specify the password for private key.
FTP User Specify the FTP User name.
Specify the FTP password.
Databse to Export Specify the database to export.
Values: user and macdb
ATTENTION
If the selected value for Database to Export field is User then only Key for
Users Passwords in Db and Reconfirm key fields appear.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Deleting a scheduled task
331
Variable
Protocol
Value
Specify the protocol.
Values: tftp, and ftp
Host
File
Specify Domain
Key for Users
Passwords in Db
Reconfirm key
FTP User
Password
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specify the hostname or IP address of server.
Specify the filename on server.
Specify the domain.
Specify the key for the user password in the database.
Reconfirm the key.
Specify the FTP User name.
Specify the FTP password.
Setting scheduler status
To set the status for scheduler, use the following procedure:
4
5
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Operation and Scheduler from the Navigation pane.
The Scheduler screen appears.
Specify the status from the Scheduler Status drop-down list.
Values: enable and disable
Click Update.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Deleting a scheduled task
To delete an scheduled task, use the following procedure:
Procedure steps
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
332
Configuration of Nortel SNAS scheduler
3
4
5
Step
1
2
Action
Select the Config tab.
Select Operation and Scheduler from the Navigation pane.
The Scheduler screen appears.
Select the scheduled task from the Scheduler list.
Click Delete.
The scheduler task is deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Viewing or searching a scheduled task
To view or search the details of a scheduled task, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Operation and Scheduler from the Navigation pane.
The Scheduler screen appears.
To view the details of a scheduled task, select the scheduled task from the Scheduler list and click Show.
To search for a scheduled task, enter the Scheduler task id in the search box and click Search.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Configuration of SNMP
This chapter provides detailed procedures on how to configure SNMP.
Navigation
•
•
“Configure SNMP settings” (page 333)
•
“Configuring SSCP-Lite” (page 347)
333
.
Overview of SNMP
Simple Network Management Protocol (SNMP) is a set of protocols for managing complex networks. SNMP works by sending messages, called protocol data units (PDU), to different parts of a network. The
SNMP-compliant agents on the Nortel SNAS devices store data about themselves in Management Information Bases (MIB) and return this data to the SNMP requesters.
One SNMP agent exists on each Nortel SNAS device, and the agent listens to the Real IP address (RIP) of that particular device. On the Nortel
SNAS that currently holds the cluster Management IP address (MIP), the
SNMP agent also listens to the MIP.
The SNMP agent supports SNMP version 1, version 2c, and version 3.
You can configure notification targets (the SNMP managers receiving trap messages sent by the agent) to use SNMP v1, v2c, and v3. The default is SNMP v2c. You can specify any number of notification targets on the
Nortel SNAS.
Configure SNMP settings
This section contains information about the following procedures:
Configuring SNMP settings navigation
•
•
“Configuring SNMP targets” (page 337)
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
334
Configuration of SNMP
•
“Configuring SNMPv3 users” (page 340)
•
“Configuring SNMP events” (page 344)
Configuring SNMP
To configure SNMP, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration, SNMP, and General from the Navigation pane.
The SNMP General Settings screen appears.
3
4
5
Enter the SNMP Configuration information in the applicable fields.
Click Update on the toolbar to save the details.
Select Administration, SNMP, and System from the Navigation pane.
The SNMP System screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure SNMP settings
335
6
7
8
Enter the SNMP system information in the applicable fields.
Click Update on the toolbar to save the details.
Select Administration, SNMP, and Community from the
Navigation pane.
The SNMP Community screen appears.
9
10
11
Enter the SNMP community information in the applicable fields.
Click Update to save the details.
Select Administration and SONMP from the Navigation pane.
The SONMP screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
336
Configuration of SNMP
12
13
14
Enter the SONMP information in the applicable fields.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to configure SNMP.
Table 6
Variable Value
SNMP General settings
Status Enables or disables network management using
SNMP. The default is enabled.
Versions
Specifies the SNMP versions allowed. Select one or more of the following options: v1 (SNMP version 1), v2c (SNMP version 2c), v3 (SNMP version 3).
The default is all versions (v1, v2c, v3).
SNMP System
Contact
Authentication Traps
Designates a contact person for the managed Nortel
SNAS cluster, together with information about how to contact this person.
Enables or disables generation of authentication failure traps. The default is disabled.
SNMP Community
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure SNMP settings
337
Table 6
(cont’d.)
Variable
Read
Write
Trap
Value
Specifies the monitor community name that grants read access to the MIB. If you do not specify a monitor community name, read access is not granted. The default monitor community name is public.
Specifies the control community name that grants read and write access to the MIB. If you do not specify a control community name, neither read nor write access is granted.
Specifies the trap community name that accompanies trap messages sent to the SNMP manager. If you do not specify a trap community name, the sending of trap messages is disabled. The default trap community name is trap.
SONMP
Status Enables or disables support for SynOptics Network
Management Protocol (SONMP) network topology information. The default is enabled.
Configuring SNMP targets
SNMP managers function as the notification targets for SNMP monitoring.
To configure SNMP notification targets, use the following procedures:
•
“Adding SNMP notification targets” (page 337)
•
“Managing SNMP notification targets” (page 338)
•
“Removing SNMP notification targets” (page 339)
.
Adding SNMP notification targets
To add an SNMP notification target, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Administrative, SNMP, and Notification Target from the
Navigation pane.
The Notification Target screen appears.
Click Add.
The Add Notification Target screen appears.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
338
Configuration of SNMP
4
5
Click Save Target.
The new target appears in the table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add notification target.
Variable
IP Address
Port
Value
Specifies the IP address of the SNMP manager to which trap messages are sent.
Specifies the TCP port number used by the SNMP manager.
Version
The default value is port 162.
Specifies the SNMP version used by the
SNMP manager. The options are:
• v1—use SNMPv1
• v2c—use SNMPv2c
• v3—use SNMPv3
The default value is v2c.
Managing SNMP notification targets
To manage SNMP notification targets, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure SNMP settings
339
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select the Administration, SNMP, and Notification Target from the Navigation pane.
The Notification Target screen appears.
Select the SNMP notification target that you want to modify and click Edit.
The Modify Notification Target screen appears.
Modify the SNMP notification target information in the applicable fields.
Click Save Target on the toolbar to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Removing SNMP notification targets
To delete an existing SNMP notification target, use the following procedure:
3
4
5
6
1
2
Procedure steps
Step Action
Select the Config tab.
Select the Administration, SNMP, and Notification Target from the Navigation pane.
The Notification Target screen appears.
Select the SNMP target to remove from the SNMP Target Table.
Click Delete.
A confirmation dialog box appears.
Click Yes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
340
Configuration of SNMP
Configuring SNMPv3 users
The Nortel SNAS manages SNMPv3 users based on the User-based
Security Model (USM) for SNMP version 3. For more information about
USM, see RFC2274.
To configure SNMPv3 users, use the following procedures:
•
“Adding SNMPv3 users” (page 340)
•
“Managing SNMPv3 users” (page 343)
•
“Removing SNMPv3 users” (page 343)
Adding SNMPv3 users
To add an SNMPv3 user, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select the Administration, SNMP, and Users from the
Navigation pane.
The SNMPv3 User Table screen appears.
Click Add.
The Add SNMP User screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure SNMP settings
341
4
5
Click Update.
The new SNMPv3 user appears in the table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Use the data in the following table to add SNMP user.
Variable
Id
Username
Value
Specifies a unique integer in the range 1 to 1024 to identify this SNMPv3 User on the Nortel SNAS cluster.
This field cannot be changed after an
SNMPv3 user is added.
Specifies a name for the USM user. The name must be unique in the cluster.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
342
Configuration of SNMP
Variable
Security Level
Permission
Authentication
Protocol
Value
Specifies the degree of SNMP USM security. Valid options are:
• none—SNMP access is granted without authentication.
• auth—the SNMP user must provide a verified password before SNMP access is granted. You are later prompted to specify the required password (auth password). SNMP information is transmitted in plain text.
• priv—the SNMP user must provide a verified password before SNMP access is granted, and all SNMP information is encrypted with the user’s individual key. You are later prompted to specify the required password (auth password) and encryption key (priv password).
The default is priv.
Specify the permission.
Values: get, set, and trap
Specifies the protocol to be used to authenticate the USM user.
Authentication
Password
Values: md5 and sha default: md5
Specifies the password for USM user authentication. The password is required if the security level is set to auth or priv.
The password must be at least eight characters long.
Reconfirm the password.
Authentication
Password
(again)
Privacy Protocol
Specifies the protocol used for encryption.
Valid options are:
• des
• aes
The default is des.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configure SNMP settings
343
Variable
Encryption
Password
Value
Specifies the USM user’s individual encryption key. The password is required if the security level is set to priv.
The password must be at least eight characters long.
Reconfirm the USM user’s individual encryption key.
Encryption
Password
(again)
Managing SNMPv3 users
To manage SNMPv3 users, or configure permission sets for a new
SNMPv3 user, use the following procedure:
5
6
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Administration, SNMP, and Users from the Navigation pane.
The Users screen appears.
Select the user whose details you want to modify, and click Edit.
The Modify SNMP user screen appears.
Modify SNMPv3 User information in the applicable fields, as required.
Click Update to save the details.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Removing SNMPv3 users
To delete an existing SNMPv3 user, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration, SNMP, and Users from the Navigation pane.
The Users screen appears.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
344
Configuration of SNMP
3
4
5
6
Select a user from the Users table.
Click Delete.
A dialog box appears for confirmation.
Click OK.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring SNMP events
SNMP events can be added to monitor values or give notification of specific object identifiers (OID). There are two types of SNMP events to configure, as described in the following sections:
•
“Managing monitor events” (page 344)
•
“Managing notification events” (page 346)
Managing monitor events
To manage monitor events, use the following procedures:
•
“Adding monitor events” (page 344)
•
“Removing monitor events” (page 345)
After you add monitor event, you cannot modify the monitor event. To change the settings of an existing monitor, first remove that monitor and then create a new monitor with the desired changes.
To add monitor events, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Administration, SNMP, and Event from the Navigation pane.
The Event screen appears.
Click Add Monitor.
The Add Monitors screen appears.
Click Update.
The monitor event appears in the table.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
5
Configure SNMP settings
345
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add monitor event.
Variable
Option
Other option
Name
OID
Value
• c = Comment
• f = Frequency (in seconds, default is
600 [10 minutes])
• o = OID (additional objects to send in the event)
• e = EventName (the name of a notificationEvent, only for bool/existence)
• d = OID (delta discontinuity OID)
•
D = timeTicks | timeStamp | dateAndTime (delta discontinuity type)
• b = boolean
• t = threshold
• x = existence
The unique name for the monitor.
Specifies the OID value that is monitored.
Removing monitor events
To delete a monitor event, use the following procedure:
3
4
1
2
Procedure steps
Step Action
Select the Config tab.
Select Administration, SNMP, and Event from the Navigation pane.
The Event screen appears.
Select the monitor event to be removed from the Event list.
Click Delete.
A confirmation dialog box appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
346
Configuration of SNMP
5
6
Click Yes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Managing notification events
To manage notification events, select one of the following procedures:
•
“Adding notification events” (page 346)
•
“Removing notification events” (page 347)
After you add notification events, you cannot modify notification events.
To change the settings of an existing notification event, first remove that notification and then create a new notification event with the desired changes.
To add notification events, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select the Administration, SNMP, and Event from the Navigation pane.
The Event screen appears.
Click Add Event.
The Add Events screen appears.
.
4
Click Update.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
5
Configuring SSCP-Lite
347
The notification event appears in the table.
Click Apply on the toolbar to send the current changes to the Nortel SNAS.
--End--
Use the data in the following table to add notification event.
Variable
Option
Name
OID
Value
Specifies the notification event option.
Specifies the notification event name.
Specifies the OID that trigger this notification event.
Removing notification events
To delete a notification event, use the following procedure:
3
4
5
6
1
2
Procedure steps
Step Action
Select the Config tab.
Select the Administration, SNMP, and Event from the
Navigation pane.
The Event screen appears.
Select the notification event to be removed.
Click Delete.
A confirmation dialog box appears.
In the confirmation dialog box, click Yes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Configuring SSCP-Lite
SSCP-lite is a SNAS enforcement protocol that uses SNMP to restrict a users network access using dynamically provisioned VLAN’s based on users credentials and device health assessment. SSCP-Lite supports
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
348
Configuration of SNMP
Nortel ES 325, 425, 450, 460, BPS, 470, and ERS 2500, 4500, 5500,
8300, and 8600. In addition, SSCP-lite supports Cisco 2900, 3500, and
3700 series Ethernet switches.
This section describes to configure SSCP-Lite.
Configuring SSCP-Lite navigation
•
“Creating an snmp profile” (page 348)
•
“Creating a community” (page 349)
•
“Creating an sscplite user” (page 350)
Creating an snmp profile
To create and configure SNMP Profile, use the following procedure:
Procedure steps
Step
1
2
3
Action
Select the Config tab.
Select Secure Access Domain and SNMP Profiles from the
Navigation pane.
The SNMP Profiles screen appears.
Click Add.
The Add SNMP Profile screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Configuring SSCP-Lite
349
4
5
6
Enter the snmp profile information in the applicable fields.
Click Create SNMP Profile.
The new snmp profile appears in the SNMP profiles table.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Variable
SNMP Profile Id
Name
SNMP versions
Port
Data Refresh Interval
CLI Login User
Variable definitions
Use the data in the following table to add an SNMP profile.
CLI Login Password
Confirm CLI Login Password
CLI Login Type
Value
Specifies the snmp profile id.
Specify the name of the snmp profile.
Specifies the snmp version supported for the profile.
Values: v1, v2c, and v3
Specify the snmp port to communicate.
default: 161
Specifies the data refresh rate interval in seconds.
default: 60 seconds
Specifies the CLI user login name.
default: admin
Specifies the CLI user login password.
Reconfirm the CLI login password.
Select the CLI login type.
Values: ssh and telnet
Creating a community
To create and configure SNMP Profile Community settings, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and Community from the
Navigation pane.
The Community screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
350
Configuration of SNMP
3
4
5
Enter the community information in the applicable fields.
Click Update to save the changes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Variable definitions
Use the data in the following table to configure the community.
Variable
Read Community String
Write Community String
Trap Community String
Value
Specifies the Read Community String. Enter the community string for read-only access. (default: public)
Specifies the Write Community String. Enter the community string for read/write access. (default: private)
Specifies the Trap Community String. Enter the community string to be included in traps. (default: trap)
Creating an sscplite user
To create and configure an sscplite user manually, use the following procedure:
ATTENTION
SSCPLite USM User configurations are not applicable when the SNMP Profile version is not v3.
Procedure steps
Step
1
Action
Select the Config tab.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
2
Configuring SSCP-Lite
351
Select Secure Access Domain and SSCPLite User from the
Navigation pane.
The SSCPLite User screen appears.
3
4
5
Enter the sscplite user information in the applicable fields.
Click Update to save the changes.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Variable
Name
Security Level
Variable definitions
Use the data in the following table to configure sscplite user.
Value
Specify the user name. (default: public)
Specifies the security level. The other fields gets displayed based on the selected security level.
Values: none, auth, and priv
Deleting an snmp profile
To delete an snmp profile, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Secure Access Domain and SNMP Profiles from the
Navigation pane.
The SNMP Profiles screen appears.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
352
Configuration of SNMP
3
4
5
Select the snmp profile from the SNMP Profiles list.
Click Delete.
The snmp profile is deleted successfully message appears.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Editing an snmp profile
To edit an snmp profile, use the following procedure:
3
4
5
6
1
2
Procedure steps
Step Action
7
Select the Config tab
Select Secure Access Domain and SNMP Profiles from the
Navigation pane.
The SNMP Profiles screen appears.
Select the snmp profile from the SNMP Profiles list.
Click Edit.
The Modify SNMP Profile screen appears.
Enter the snmp profile information in the applicable fields.
Click Update SNMP Profile.
Changes appears in the SNMP profiles table
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Management of certificates
This chapter provides detailed procedures on how to manage certificates.
Navigation
•
•
“Management of private keys and certificates” (page 357)
353
Overview
To use the encryption capabilities of the Nortel SNAS, you must add a key and certificate that conforms to the X.509 standard.
The key and certificate apply to the cluster. It does not matter whether you connect to the Management IP address (MIP) or Real IP address
(RIP) of a Nortel SNAS device in order to manage Secure Socket Layer
(SSL) certificates. When you add a key and certificate to one Nortel SNAS device in the cluster, the information is automatically propagated to all other devices in the cluster.
The Nortel SNAS can support the use of up to 1500 certificates. However, only one server certificate can be mapped to a portal server at any one time. For information about mapping a certificate to the portal server, see
“Configuring SSL settings” (page 139) .
If you run the quick setup wizard during initial setup, a test certificate gets installed and mapped to the Nortel SNAS portal.
You can install new certificates or import or renew existing certificates.
ATTENTION
The Nortel SNAS supports keys and certificates created by using Apache-SSL,
OpenSSL, or Stronghold SSL. However, for greater security, Nortel recommends creating keys and generating certificate signing requests from within the Nortel
SNAS system using the CLI, SREM, or BBI . This way, the encrypted private key never leaves the Nortel SNAS and is invisible to the user.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
354
Management of certificates
Key and certificate formats
The Nortel SNAS supports importing, saving, and exporting private keys and certificates in a number of standard formats. The following table summarizes the supported formats:
Table 7
Supported key and certificate formats
Format
PEM*
Import/Add
Yes
Export/Save
Yes
DER
NET
PKCS12
(also known as PFX)
PKCS7
PKCS8
MS IIS 4
Netscape
Enterprise
Server iPlanet
Server
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
No
No
No
No
No
Comment
Encrypts the private key. Combines the private key and certificate in the same file.
Does not encrypt the private key. Allows you to store the private key and certificate in separate files.
Encrypts the private key. Allows you to store the private key and certificate in separate files.
Encrypts the private key. Combines the private key and certificate in the same file. Most browsers allow the importing of a combined key and certificate file in the
PKCS12 format.
Certificate only.
Key only (used in WebLogic).
Key only (proprietary format).
Key only (proprietary format). Requires conversion. For information about the conversion tool, contact Nortel Technical
Support (see
“How to get help” (page 19) ).
Key only (proprietary format). Requires conversion. For information about the conversion tool, contact Nortel Technical
Support (see
“How to get help” (page 19) ).
*You must use the PEM format when:
•
you save keys and certificates by copying
•
you add a key or certificate by pasting
Creating certificates
To create a new certificate, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Overview
355
Procedure steps
Step Action
1
2
3
4
Generate a Certificate Signing Request (CSR) (see
“Generating and submitting a CSR” (page 359) ).
Send the CSR to a Certificate Authority (CA), such as Entrust or VeriSign, for certification (see
).
Install the signed certificate on the Nortel SNAS cluster (see
“Installing certificates and keys” (page 355)
).
Map the installed certificate to the Nortel SNAS portal server
(see
“Configuring SSL settings” (page 139) ).
--End--
Installing certificates and keys
Two methods are available to install a certificate and key in the Nortel
SNAS cluster:
• by pasting (this option is only available when using the CLI)
• by importing from a TFTP/FTP/SCP/SFTP server (see
“Importing a certificate or key” (page 363)
)
When you generate the CSR, the private key is created and stored in encrypted form on the Nortel SNAS using the specified certificate number.
After you receive the certificate, which contains the corresponding public key, use the same certificate number when you add the certificate to the Nortel SNAS. Otherwise, the private key and the public key in the certificate do not match.
If you do not generate a CSR but obtain the certificate by other means, you must take additional steps to add a private key that corresponds to the public key of the certificate (for the information about adding a private key, see Nortel Secure Network Access Switch Using the Command Line
Interface (NN47230-100).
If you use the certificate index number of an installed certificate when adding a new certificate, the installed certificate is overwritten.
After you install the certificate, map it to the Nortel SNAS portal (see
“Configuring SSL settings” (page 139) ).
Saving or exporting certificates and keys
You can extract copies of certificates and keys to save as backup or to install on another device.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
356
Management of certificates
There are two ways to retrieve a certificate and key from the Nortel SNAS cluster:
• by copying (see
“Displaying or saving a certificate and key” (page 365)
)
• by exporting to a TFTP/FTP/SCP/SFTP server (see
“Exporting a certificate and key from the Nortel SNAS” (page 366) )
The copy-and-paste method saves the certificate and key in PEM format.
You can use the export method to choose from a variety of file formats.
Nortel recommends using the PKCS12 format (also known as PFX). Most
Web browsers accept the importation of a combined key and certificate file in the PKCS12 format. For more information about the formats supported on the Nortel SNAS, see
“Key and certificate formats” (page 354)
.
Updating certificates
To update or renew an existing certificate, do not replace the existing certificate by using its certificate number when you generate the CSR or add the new certificate. Rather, keep the existing certificate until you have verified that the new certificate works as designed.
To update an existing certificate, use the following procedures:
Procedure steps
Step Action
1
2
3
4
5
Check the certificate numbers currently in use to identify an unused certificate number.
In the CLI, use the
/cfg/cur cert
command. In the BBI, use the Certificates screen to add a new certificate.
Create a new certificate by using an unused certificate number
(see
“Generating and submitting a CSR” (page 359)
).
a
Generate a CSR.
b Submit the CSR to a CA.
When you receive the new signed certificate add it to the Nortel
SNAS (see
“Installing certificates and keys” (page 355) ).
Map the new certificate to the portal server (see
).
After testing to verify that the new certificate works as intended, delete the old certificate.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Management of private keys and certificates
357
In the CLI, use the
/cfg/cert <old cert ID> /del
command.
--End--
Management of private keys and certificates
This section describes about the certificate management procedures you can perform.
Management of private keys and certificates navigation
• view existing certificates (see
“Viewing certificates” (page 357) )
• create a new certificate (see
“Creating a certificate” (page 358) )
• generate requests for signed certificates (see
“Generating and submitting a CSR” (page 359)
)
• import certificates and private keys (see
“Importing a certificate or key”
)
• save certificates and private keys (see
“Displaying or saving a certificate and key” (page 365) )
• export certificates and private keys (see
“Exporting a certificate and key from the Nortel SNAS” (page 366)
)
• view, validate, and manage certificates and private keys (see
“Viewing certificate information” (page 368)
)
Viewing certificates
To view basic information about all certificates configured for the Nortel
SNAS cluster, select Certificates from the Navigation pane.
The Certificates screen appears, with a list of all the certificates available on the Nortel SNAS cluster.
Removing an existing certificate
To remove an existing certificate, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Certificates from the Navigation pane.
The Certificates screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
358
Management of certificates
3
4
5
6
Select the certificate from the Certificates list.
Click Delete.
A confirmation dialog box appears.
Click Yes.
The certificate is removed from the Certificates list.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Creating a certificate
To create a certificate, use the following procedure:
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Certificates from the Navigation pane.
The Certificates screen appears.
Click Add.
The Add New Certificate screen appears.
4
5
Enter the certificate information in the applicable fields.
Click Update.
The new certificate appears in the Certificates list.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Management of private keys and certificates
359
6
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Before this certificate can be used, a certificate signing request (CSR) must be generated, submitted to a CA, and imported into the Nortel SNAS.
For details on this process, see
“Generating and submitting a CSR” (page
and
“Importing a certificate or key” (page 363)
.
Variable definitions
Use the data in the following table to add new certificate.
Variable
Identifier
Name
Value
An integer in the range 1 to 1500 that uniquely identifies the certificate in the Nortel SNAS domain.
Names the certificate as a mnemonic aid.
Generating and submitting a CSR
To generate a CSR, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Certificates, Generate... and Request from the
Navigation pane.
The Request screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
360
Management of certificates
3
4
5
6
7
Select the certificate from the Certificate list and click Refresh.
Enter the certificate information in the applicable fields.
Click Update to save the details.
The Signed Certificate screen appears.
Save the CSR to a file.
a
Copy the Signed Certificate text.
b Paste the CA request output into a text editor.
c
Save the file with a .csr extension. Nortel recommends using a file name that indicates the server on which the certificate is to be used.
Submit the CSR to a CA such as Entrust or VeriSign.
a
In a text editor, open the .csr file you created in
.
b Copy the entire CSR, including the
-----BEGIN
CERTIFICATE REQUEST----- and -----END
CERTIFICATE REQUEST----lines.
c
Use your Web browser to access the CA Web site and follow the online instructions. The process for submitting the CSR varies with each CA. When prompted, paste the CSR as required in the CA online request process. If the CA requires you to identify a server software vendor whose software you used to generate the CSR, specify Apache.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
8
9
Management of private keys and certificates
361
The CA processes the CSR and returns a signed certificate.
Create a backup copy of the certificate.
The certificate is ready to be added into the Nortel SNAS cluster
(see
“Importing a certificate or key” (page 363) ).
Click Apply on the toolbar to send the information to the Nortel
SNAS.
If one or more of the CA Request field values are invalid, an error message appears describing the problem. If all field values are acceptable, the CSR output appears in the Output Request box.
The private key is created and stored in encrypted form on the
Nortel SNAS by using the specified certificate number.
--End--
Variable definitions
Use the data in the following table to generate a CSR.
Variable
Country (2 letter code)
State or Province
Locality
Organization
Value
The two-letter ISO code for the country where the Web server is located. For current information about ISO country codes, see www.iana.org
.
The name of the state or province where the head office of the organization is located.
Enter the full name of the state or province.
The name of the city where the head office of the organization is located.
The registered name of the organization. The organization must own the domain name that appears in the common name of the Web server. Do not abbreviate the organization name and do not use any of the following characters:
Organization Unit
< > ~ ! @ # $ % ^ * / \ ( ) ?
The name of the department or group that uses the secure Web server.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
362
Management of certificates
Variable
Common Name
Email Address
Subject Alternative Name
URI
DNS
IP
Generate New Key Pair
New Key Size
Value
The name of the Web server as it appears in the URL. The name must be the same as the domain name of the Web server that requests a certificate. If the Web server name does not match the common name in the certificate, some browsers refuse a secure connection with your site. Do not enter the protocol specifier (http://) or any port numbers or pathnames in the common name. Wildcards
(such as * or ?) and IP address are not allowed.
Specifies the user’s e-mail address.
Specifies alternate information if you did not provide a Common Name or e-mail address. Enter a comma-separated list of
URI:<uri>, DNS:<fqdn>, IP:<ip-address>, email:<email-address>).
Specify the URI for the certificate request.
Specify the domain name.
Specify the IP address.
Specify the email address.
Specifies whether it generate a new key or not.
Values: yes and no default: yes
Specify the length of the generated key in bits.
Available options are:
Create CA Cert
•
512
•
1024
•
2048
•
4096
The default value is 1024.
Values: true and false default: false
Challenge Password (optional)
Password
Confirm Password
The password to be used during manual revocation of the certificate.
Reconfirm the password.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Management of private keys and certificates
363
Importing a certificate or key
You can import certificates and private keys into the Nortel SNAS by using
TFTP, FTP, SCP, or SFTP. For information about the formats supported for import, see
“Key and certificate formats” (page 354) .
To import a certificate and private key into the Nortel SNAS, use the following procedure:
2
3
Procedure steps
Step Action
1
Upload the certificate file and key file to the file exchange server.
ATTENTION
You can arrange to include your private key in the certificate file.
When the Nortel SNAS retrieves the specified certificate file from the file exchange server, the Nortel SNAS software analyzes the contents and automatically adds the private key, if present.
Select the Config tab.
Select Certificates, Import, and File from the Navigation pane.
The File screen appears.
4
5
Select the certificate from the Certificate list and click Refresh.
Enter the import information in the applicable fields.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
364
Management of certificates
6
7
Click Update on the toolbar to import the certificate.
Click Apply on the toolbar to save the imported certificate on the
Nortel SNAS.
The certificate and private key are now fully installed.
--End--
Variable definitions
Use the data in the following table to import a certificate or key.
Value Variable
Certificate and/or Key File
File System Select the protocol or local to import the file.
Fields appear based on the selected file system.
File System: Protocol
Protocol Select the protocol to import the file.
Values: tftp, ftp, scp, and sftp (default: tftp)
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Server
File
FTP User
FTP Password
Specify the hostname or IP address of the server.
Specify the filename on the server.
Specify the FTP User name.
Specify the FTP password.
File System: Local
Certificate and/or Key File To select the file name, click the browse to specify the name of the file to be downloaded.
Private Key Password (if required)
Private Key Password Password used to encrypt the private key
(used only if the key is encrypted).
Confirm Private Key Password Confirms the password used to encrypt the private key.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Management of private keys and certificates
365
Displaying or saving a certificate and key
You can display the current certificate and private key and then save copies as backup or for export to another device.
When you display the certificate and private key, you have the option to protect it with a password phrase. Nortel recommends that you add a password phrase because this adds an extra layer of security.
Save the certificate and private key by copying and pasting into a text editor and then save the text file with a .PEM extension.
To display the current certificate and key or save a copy, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Certificates, Export, and Text from the Navigation pane.
The Text screen appears.
3
4
5
Select the certificate from the Certificate list, and click Refresh.
If you want to encrypt the key, specify a password phrase in the applicable fields. The password phrase must be at least four characters in length.
If you specify a password phrase, the password phrase must be provided on all future occasions when the private key file is accessed (for example, when adding, importing, or exporting private keys and certificates).
Click Export.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
366
Management of certificates
6
7
8
9
The private key and certificate are displayed in the text box.
Copy the certificate text.
Paste the private key and certificate into a text editor.
Save the file with a .PEM extension.
To save a certificate and key in another format, use the Export
Certificate screen (see
“Exporting a certificate and key from the
).
--End--
Variable definitions
Use the data in the following table to display or save a certificate and key.
Variable
Password
Confirm Password
Value
Specifies the password phrase used to encrypt the certificate. The password phrase must be at least four characters in length.
Confirms the password phrase used to encrypt the certificate.
Exporting a certificate and key from the Nortel SNAS
You can export certificate files and key files from the Nortel SNAS using
TFTP, FTP, SCP, or SFTP. For information about the formats supported for export, see
“Key and certificate formats” (page 354) .
To export a certificate and key from the Nortel SNAS, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Certificates, Export, and File from the Navigation pane.
The File screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Management of private keys and certificates
367
3
4
5
Select the certificate from the Certificate list, and click Refresh.
Enter the export information in the applicable fields.
Click Export on the toolbar to export the certificate.
The certificate and private key are immediately exported.
--End--
Variable definitions
Use the data in the following table to export a certificate and key.
Value Variable
Certificate and/or Key File
Output Format
The key and certificate format in which you want to export the key and certificate.
Values:
•
PEM
•
DER
•
NET
•
PKCS12 (also known as PFX)
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
368
Management of certificates
Variable
File System
Value
The PEM and PKCS12 formats always combine the private key and certificate in the same file.
Nortel recommends that you use the PKCS12 format. Most Web browsers accept the importation of a combined key and certificate file in the PKCS12 format.
The formats have different capabilities regarding private key encryption and the ability to save the key and certificate in separate files.
For more information about the formats, see
“Key and certificate formats” (page 354) .
Select the protocol or local to import the file.
Fields appear based on the selected file system.
File System: Protocol
Protocol Select the protocol to import the file.
Values: tftp, ftp, scp, and sftp (default: tftp)
Server
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specify the hostname or IP address of the server.
Specify the filename on the server.
Specify the FTP User name.
Specify the FTP password.
File
FTP User
FTP Password
Key Encryption (if required)
Password
Confirm Password
Specifies the password phrase used to encrypt the certificate. The password phrase must be at least four characters in length.
Confirms the password phrase used to encrypt the certificate.
Viewing certificate information
To view a certificate information, use the following procedure:
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Management of private keys and certificates
369
1
2
Procedure steps
Step Action
3
Select the Config tab.
Select Certificates from the Navigation pane.
The certificate screen appears listing all current certificates.
Select the certificate from the list and click Show.
The Certificates screen appears.
--End--
Importing a revocation list
To import a revocation list from the Nortel SNAS, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Certificates, Revoke, and Import from the Navigation pane.
The Import Revocation List screen appears.
.
3
4
Enter the import information in the applicable fields.
Click Update on the toolbar to import the revocation list.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
370
Management of certificates
5
Click Apply on the toolbar to save the imported certificate on the
Nortel SNAS.
--End--
Variable definitions
Use the data in the following table to import revocation list.
Variable
File System
Value
Select the protocol or local to import the file.
Fields appear based on the selected file system.
File System: Protocol
Protocol Select the protocol to import the revocation list.
Values: tftp, ftp, scp, and sftp (default: tftp)
Server
File
FTP User
FTP Password
File System: Local
File
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specify the hostname or IP address of the server.
Specify the filename on the server.
Specify the FTP User name.
Specify the FTP password.
To select the file name, click the browse to specify the name of the file to be imported.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
View system information and performance statistics
This chapter provides detailed procedures on how to view system information and performance statistics.
Navigation
•
“Overview of Statistics” (page 371)
•
“Monitor system information and performance statistics” (page 371)
•
“Viewing IP or MAC session information” (page 385)
•
•
371
Overview of Statistics
You can view the current status information and events for the cluster and for individual Nortel SNAS hosts. You can also view performance statistics for the Nortel SNAS cluster as a whole or for individual hosts in the cluster since the system started.
Monitor system information and performance statistics
You can view configuration, status, and performance information for a
Nortel SNAS device or for the cluster as a whole:
•
To view configuration and status information for the Nortel SNAS cluster, see
“Viewing cluster information” (page 372) .
•
To view AAA statistics, see
“Viewing authentication statistics” (page
.
•
To view Ethernet statistics for an interface, see
“Viewing Ethernet statistics” (page 382) .
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
372
View system information and performance statistics
Viewing cluster information
To view cluster information, use one of the following procedures:
•
“Viewing the controller list” (page 372)
•
“Viewing SONMP topology information” (page 372)
•
“Viewing switch distribution” (page 373)
•
•
“Viewing the connected client list” (page 375)
•
Viewing the controller list
To view the controller list, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Controller Information from the Navigation pane.
The Controller Information screen appears.
--End--
Viewing SONMP topology information
To view the SynOptics Network Management Protocol (SONMP) topology information, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Monitor system information and performance statistics
373
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Cluster and SONMP Topology from the Navigation pane.
The SONMP Topology screen appears.
--End--
Use the data in the following table to view SONMP topology.
Variable
SONMP State
Table
Value
Displays information about the system topology, including the IP address,
MAC address, chassis type, and the state of all Nortel SNAS and
SONMP-enabled network devices in the system.
Viewing switch distribution
To view the switch distribution status information, use the following procedure:
Procedure steps
Step Action
1
Select the Monitor tab.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
374
View system information and performance statistics
2
Select Switch Distribution from the Navigation pane.
The Switch Distribution screen appears.
--End--
Use the data in the following table to view switch distribution.
Variable Value
Switch Distribution
Displays information about the Nortel
SNAS hosts in the cluster and the network access devices they control.
Information for the Nortel SNAS host includes the Real IP address (RIP), portal Virtual IP addresses (pVIPs), operational status, and number of switches under its control. For each network access device, information includes the switch IP address and
Nortel SNAS status.
Viewing switches
To view the switch status information, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Monitor system information and performance statistics
375
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Switches from the Navigation pane.
The Switches screen appears.
--End--
Viewing the connected client list
To view a list of clients that are connected to a particular switch, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Connected Clients from the Navigation pane.
The Connected Clients screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
376
View system information and performance statistics
3
Select the secure access domain and the switch from the respective lists, and click Refresh.
The Connected Clients screen appears, displaying information about the connection status and a list of all connected clients.
--End--
Use the data in the following table to view the list of connected clients.
Variable
Refresh this page every
Switch Connection
Status
Currently controlled by NSNAS
Switch Software
Version
SSCP Version
Value
Specifies the interval in seconds before the screen is automatically refreshed. Only applicable if Auto
Refresh is selected.
Displays a brief description of the switch connection status.
Displays number of clients controlled by Nortel SNAS.
Displays the software version used by the switch.
Displays the SSCP version.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Monitor system information and performance statistics
377
Variable
Number of NSNA clients
Connected Clients
Table
Value
Displays the number of NSNA clients.
Displays a list of all connected clients.
Information about each client includes:
•
Port ID
•
VLAN
•
Device
•
MAC Address
•
Client IP
Viewing alarms
You can view system alarms that are activated. You can also delete alarms.
To alert the operator at system logon, a notice is displayed if active alarms are present. Alarms are also sent as syslog messages.
To view system alarms, use the following procedures:
•
“Viewing active alarms” (page 377)
•
To view the active alarms for the Nortel SNAS cluster, use the following procedure:
1
2
Procedure steps
Step Action
Select Monitor tab.
Select Cluster and Alarms from the Navigation pane.
The Alarms screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
378
View system information and performance statistics
--End--
Use the data in the following table to view the active alarms.
Variable
Refresh the page every
Value
Specifies the interval in seconds before the screen is automatically refreshed.
1
2
Procedure steps
Step Action
3
Select the Config tab.
To delete an alarm, select Cluster and Alarms from the
Navigation pane.
The Alarms screen appears.
Select the alarm you want to delete from the Alarms table, and click Delete.
--End--
Viewing authentication statistics
You can view authentication statistics for the Nortel SNAS cluster as a whole or for one specific Nortel SNAS host in the cluster.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Monitor system information and performance statistics
379
For each configured authentication method and authentication server, the following information displays:
• the number of authentication requests accepted and rejected
• for external LDAP and RADIUS servers, the number of authentication requests timed out
The external LDAP and RADIUS servers are listed by IP address and
TCP port number.
Statistics are reported for all authentication methods configured in the cluster, whether or not they have been included in the authentication order scheme (see
“Specifying authentication fallback order” (page 270) ). If the
statistics for a particular authentication method is always zero, this might be because the method is not included in the authentication order scheme.
This section includes the following procedures:
•
“Viewing AAA statistics for a host” (page 379)
•
“Viewing authentication statistics for a cluster” (page 380)
Viewing AAA statistics for a host
To view AAA statistics for a particular Nortel SNAS host, use the following procedure:
1
2
Procedure steps
Step Action
Select the Config tab.
Select Statistics, Authentication, and Host from the Navigation pane.
The Host screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
380
View system information and performance statistics
3
Select the host number and the secure access domain from the respective lists and click Refresh.
The corresponding details appears.
--End--
Viewing authentication statistics for a cluster
Procedure steps
Step
1
2
Action
Select the Monitor tab.
Select Statistics, Authentication, and Cluster from the
Navigation pane.
The Cluster screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Monitor system information and performance statistics
381
3
Select the scecure access domain from the Secure Access
Domain list and click Refresh.
The corresponding details appears.
--End--
1
2
Viewing hosts statistics
Procedure steps
Step Action
Select the Monitor tab.
Select Cluster and Hosts from the Navigation pane.
The Hosts screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
382
View system information and performance statistics
--End--
Viewing Ethernet statistics
You can view statistics for the Ethernet network interface card (NIC) on the particular Nortel SNAS device to which you are connected. If you are connected to the MIP, the information relates to the Nortel SNAS device in the cluster that is currently in control of the MIP.
To view Ethernet interface statistics, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Cluster and Ethernet from the Navigation pane.
The Ethernet screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Monitor system information and performance statistics
383
3
Select the Ethernet host from the Hosts list and click Refresh.
The corresponding details appear.
--End--
Viewing users statistics
To view the details of users currently logged into the system, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Cluster and Users from the Navigation pane.
The Users screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
384
View system information and performance statistics
3
4
Enter the user information in the applicable fields.
To view the user details, click List.
The corresponding details appear.
--End--
Use the data in the following table to view user statistics.
Variable
Domain
Switch
Prefix
Max
Value
Specifies the domain.
Specifies the switch.
Specifies one or more initial letters of a user name, directly followed by an asterix
(*).
Specifies the maximum number of entries displayed.
Current Users
Number Of
Currently
Logged In Users
Specifies the currently logged in users.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Viewing IP or MAC session information
385
Variable
Kick Users
IP/MAC
User
Group
Value
Specify the IP/MAC address, user name, or group to kick the user.
Viewing license usage
To view the license usage details, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Statistics and License Usage from the Navigation pane.
The License Usage screen appears.
--End--
Viewing IP or MAC session information
To view the details of IP or MAC addresses session information, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select the IP / MAC - Session Information from the Navigation pane.
The IP / MAC - Session Information screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
386
View system information and performance statistics
3
4
Enter the information in the applicable fields.
To view the details, click List.
The corresponding details appear.
--End--
Variable definitions
Use the data in the following table to view IP or MAC address session information.
Variable
MAC / IP
Domain
Switch
Port
Source IP
Source MAC
Login
Type
VLAN
Host IP
MAC
User
Group
Value
Specify the MAC or IP address.
Specifies the domain.
Specifies the switch.
Specifies the port.
Specifies the source IP.
Specifies the source MAC address.
Specifies the login detail.
Specifies the type.
Specifies the VLAN.
Specifies the currently logged in host IP.
Specify the MAC address, user name, or group to kick the user.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Viewing IP or MAC session information
387
Viewing group session information
To view the details of group session information, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select the Group - Session Information from the Navigation pane.
The Group - Session Information screen appears.
3
4
Enter the information in the applicable fields.
To view the details, click List.
The corresponding group details appear.
--End--
Variable definitions
Use the data in the following table to view group session information.
Value Variable
Current Users
Number Of Currently active sessions
Specifies the number of currently active sessions.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
388
View system information and performance statistics
Variable
List Users
Group
Domain
Switch
Port
User
Source IP
Source MAC
Login
Type
VLAN
Portal IP
Session Type
Value
Specify the group to view the details.
Specifies the domain.
Specifies the switch.
Specifies the port.
Specifies the users in the specified group.
Specifies the source IP.
Specifies the source MAC address.
Specifies the login detail.
Specifies the type.
Specifies the VLAN.
Specifies the currently logged in portal IP.
Specifies the session type.
Switch templates
It shows the currently available switch templates. Choose from one of the following tasks:
•
“Viewing switch templates” (page 388)
•
“Removing switch templates” (page 389)
•
“Importing or exporting switch templates” (page 389)
Viewing switch templates
To view predefined switch templates, select Operation and Switch
Templates from the Navigation pane. The Switch Templates screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Switch templates
389
Removing switch templates
To delete switch template, use the following procedure:
1
2
Procedure steps
Step Action
3
4
Select the Config tab.
Select Operation and Switch Templates from the Navigation pane.
The Switch Templates screen appears.
To delete a custom template, select the template and click
Delete.
Click Apply on the toolbar to send the current changes to the
Nortel SNAS.
--End--
Importing or exporting switch templates
To import or export a switch template, use the following procedure:
Procedure steps
Step Action
1
2
Select Operation and Switch Templates from the Navigation pane.
The Switch Template screen appears.
To import a switch template click Import. Are you sure you want to import a Switch Template to SNAS message appears click
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
390
View system information and performance statistics
3
4
5
OK. The Import screen appears.
To export a switch template, select a switch template and click
Export. The selected switch templates Export screen appears.
Enter the information in the applicable fields.
ATTENTION
Default Templates and Templates used by SSCPLite Switches can not deleted.
To import the switch template, click Import.
ATTENTION
You cannot import a switch template if there are any unapplied changes.
To export the switch template, click Export.
--End--
Variable definitions
Use the data in the following table to import/export switch templates.
Variable
Protocol
Value
Select the protocol used to import or export the switch template.
Values: tftp, ftp, scp, and sftp
Server
File
FTP User
FTP Password
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specify the host name or IP address of the server.
Specify the name of the switch template file.
Specify the FTP User name.
Specify the FTP password.
Charting
Charting is used to monitor CPU, Memory and DHCP statistics online. You can specify the polling interval, which is used to chart the data.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
To plot the CPU & Memory chart, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Chart from the Navigation pane.
The Chart screen appears.
Charting
391
3
Click Chart.
The CPU & Memory Chart window appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
392
View system information and performance statistics
4
Click Close to close the CPU & Memory Chart window.
--End--
To plot the DHCP chart, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Chart from the Navigation pane.
The Chart screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
3
Click Chart.
The DHCP Chart window appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Charting
393
394
View system information and performance statistics
4
Click Close to close the DHCP Chart window.
--End--
Variable definitions
Use the data in the following table to plot the CPU & Memory chart and
DHCP chart.
Value Variable
CPU & Memory chart
Active SNAS Devices in
Cluster
Refresh Time
Specifies the IP address of the device.
Specify the time.
Range: 10 - 300 seconds
DHCP chart
IP Address Type
Refresh Time
Specifies the IP address Type of the device.
Values: Red, Green, Yellow, Unknown, Known, and Standard
Specify the time.
Range: 10 - 300 seconds
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Maintenance and management of the system
395
This chapter provides detailed procedures on how to manage and maintain the system and individual Nortel SNAS devices.
Navigation
•
“Manage and maintain the system” (page 395)
•
“Perform maintenance” (page 395)
•
“Managing diagnostics” (page 401)
Manage and maintain the system
You can perform the following activities to collect maintenance information for troubleshooting and technical support (see
):
•
Dump log file or system internal status information and send it to a file exchange server.
•
Check connectivity between the Nortel SNAS and all configured gateways, routers, and servers.
•
Start and stop tracing to log information about a client session. You can limit the trace to specific features, such as SSL handshake, authentication method, user name, group, and profile, DNS lookups, and the Nortel Health Agent check.
You can use the trace feature as a debugging tool (for example, to find out why authentication fails).
Perform maintenance
This section describes the procedure to perform maintenance activities.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
396
Maintenance and management of the system
Perform maintenance navigation
•
“Dumping logs and status information” (page 396)
•
“Starting and stopping a trace” (page 397)
•
“Checking configuration” (page 400)
•
“Managing diagnostics” (page 401)
Dumping logs and status information
You can dump logs and statistics about the current internal status of the system to a file exchange server. The information can then be used for technical support purposes.
To dump logs or statistics, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Diagnostics, Maintenance, and Dump Logs and Status from the Navigation pane.
The Dump Logs and Status screen appears.
3
4
Enter the Dump information in the applicable fields.
Click Dump Logs to dump system log file information.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
5
Manage and maintain the system
397
Click Dump status to dump system internal status information.
--End--
Use the data in the following table to dump logs and status information.
Variable
Protocol
Server
File
Dump All
Hosts
Value
Select the export protocol.
Values: ftp and tftp default: tftp
Specify the host name or IP address of the file exchange server.
Specify the name of the destination file on the file exchange server. The file is in gzip compressed tar format.
Enables dumping of information for all hosts in the cluster or for the local host only.
Values: yes and no default: yes
Starting and stopping a trace
You can perform a trace to log information about a client session.
To start or stop a trace, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Diagnostics, Maintenance, and Trace from the
Navigation pane.
The Trace screen appears.
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
398
Maintenance and management of the system
3
4
5
Enter the Trace information in the applicable fields.
To start the trace, click Start Trace.
To stop the trace, click Stop Trace.
--End--
Use the data in the following table to start and stop a trace.
Variable
SAD Number
Tags
Value
Specifies the Nortel SNAS domain to which you want to limit tracing.
Specifies the specific features or subsystems to which you want to limit tracing. Options are:
• aaa—logs authentication method, user name, group, and extended profile
• dhcp
• dns—logs failed DNS lookups made during the session
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
.
Variable
Protocol
FTP Server
File
FTP User
FTP Password
Manage and maintain the system
399
Value
• ssl—logs information related to the SSL handshake procedure (for example, the cipher used)
• tg—logs information related to the Nortel Health Agent check
(for example, Nortel Health Agent session status and the SRS rule check result)
• snas—logs operations and events of Nortel SNAS-controlled switches
• all—logs information related to features or sysbsystems
• patchlink
• radius
• nap
ATTENTION
If listed, the following options are not supported in Nortel Secure Network
Access Switch Software Release
1.6.1: pptp, upref, smb, ftp.
Specifies the file export protocol. The options are TFTP, FTP, SFTP. The default is TFTP.
ATTENTION
The User and Password get prefixed with the selected protocol type.
ATTENTION
The User and Password is not displayed while selecting the tftp protocol.
Specifies the hostname or IP address of the host where a trace file is created.
Specifies the filename on the server for the uploaded information.
Specifies the user name to access a file exchange server.
Specifies the password to access a file exchange server.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
400
Maintenance and management of the system
Checking configuration
You can check connectivity to verify that the Nortel SNAS is able to contact gateways, routers, DNS servers, and authentication servers in the system configuration. The command also checks if the Nortel SNAS can connect to Web servers specified in group links. The Check Configuration screen displays the result of the connectivity check as well as the method used for the check (for example, ping).
To check the configuration, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Diagnostics, Maintenance , and Check Configuration from the Navigation pane.
The Check Configuration screen appears.
3
Click Check Configuration.
When the check is complete, results are displayed on the screen.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Manage and maintain the system
401
Managing diagnostics
Performance statistics are available in real-time via the GUI window or as a CSV (Comma Separated Value), whereas DHCP statistics are only available through the GUI window.
Viewing events statistics
To view events statistics, use the following procedure:
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Diagnostics and Events from the Navigation pane.
The Events screen appears.
3
4
5
Select the host from the Host list.
Specify the begin and the end time filter for displaying event information.
Click Refresh.
The corresponding details appear.
--End--
Viewing audit log statistics
To view audit log statistics, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
402
Maintenance and management of the system
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Diagnostics and Audit Log from the Navigation pane.
The Audit Log screen appears.
3
4
5
Select the host from the Host list.
Specify the begin and the end time filter for displaying event information.
Click Refresh.
The corresponding details appear.
--End--
Viewing log browser statistics
To launch the log browser, use the following procedure:
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Manage and maintain the system
403
1
2
Procedure steps
Step Action
Select the Monitor tab.
Select Diagnostics and Log Browser from the Navigation pane.
The Log Browser screen appears.
3
Click Launch to download the low browser. The Log Browser window appears.
--End--
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
404
Maintenance and management of the system
.
Copyright © 2007, 2008 Nortel Networks
Nortel Secure Network Access Switch
Configuration — Using BBI
NN47230-500 03.02
24 October 2008
Nortel Secure Network Access Switch
Configuration — Using BBI
Copyright © 2007, 2008 Nortel Networks
All Rights Reserved.
Release: 2.0
Publication: NN47230-500
Document revision: 03.02
Document release date: 24 October 2008
To provide feedback or to report a problem in this document, go to www.nortel.com/documentfeedback.
www.nortel.com
Sourced in Canada, the United States of America, and India
LEGAL NOTICE
While the information in this document is believed to be accurate and reliable, except as otherwise expressly agreed to in writing
NORTEL PROVIDES THIS DOCUMENT "AS IS "WITHOUT WARRANTY OR CONDITION OF ANY KIND, EITHER EXPRESS
OR IMPLIED. The information and/or products described in this document are subject to change without notice.
Nortel, the Nortel logo, and the Globemark are trademarks of Nortel Networks.
All other trademarks are the property of their respective owners.
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Secure network access
Clientless solution
Access zone management
Device integrity checking
Dynamic and static IP clients
Detailed configuration options
Comprehensive management capabilities
Integration with various network devices
Enhanced security features
Frequently asked questions
Nortel Secure Network Access Solution (Nortel SNAS) is a protective framework to completely secure the network from endpoint vulnerability. The Nortel SNAS addresses endpoint security and enforces policy compliance. Nortel SNAS delivers endpoint security by enabling only trusted, role-based access privileges premised on the security level of the device, user identity, and session context.
The essential elements of the Nortel SNAS include the Nortel Secure Network Access Switch 4050 or 4070 (Nortel SNAS 4050 or 4070), network access device, and DHCP and DNS servers. The network access device can be an Ethernet Routing Switch 8300 or an Ethernet Routing Switch 5510, 5520, or 5530. Each Nortel SNAS device can support up to five network access devices.
The Nortel Health Agent provides continual device integrity checking in the Nortel SNAS. It ensures that devices meet certain security requirements before granting network access.