HP Sa3110 - VPN Server Appliance Bedienungsanleitung

Hewlett-Packard Company

HP: 5971-0873

P/N: A55307-001

March 2001

hewlett-packard vpn server

appliance sa3110/sa3150/

sa3400/sa3450

network layout reference guide

iii

Disclaimer

DisclaimerDisclaimer

Disclaimer

Information in this document is provided in connection with

Hewlett-Packard Company products. No license, express or

implied, by estoppel or otherwise, to any intellectual property

rights is granted by this document. Except as provided in

Hewlett-Packard Company’s Terms and Conditions of Sale for

such products, Hewlett-Packard Company assumesno liability

whatsoever,and Hewlett-Packard Company disclaims any

express or implied warranty, relating to sale and/or use of

Hewlett-Packard Company products including liability or

warranties relating to fitness for a particular purpose,

merchantability, or infringement of any patent, copyright or

other intellectual property right. Hewlett-Packard Company

products are not intended for use in medical, life saving, or life

sustaining applications.

Hewlett-Packard Companymay make changes to specifications

and product descriptions at any time, without notice.

This

Hewlett-Packard VPN Server Appliance SA3110/SA3150/

SA3400/SA3450 Network Layout Reference Guide

, as well as

the software described in it is furnished underlicense and may

only be used or copied in accordance with the terms of the

license. The information in this manual is furnished for

informationaluse only, is subject to change without notice, and

should not be construed as a commitmentby Hewlett-Packard

Company.Hewlett-PackardCompanyassumesnoresponsibility

or liability for any errors or inaccuracies that may appear in this

document or any software that may be provided inassociation

with this document.

Except as permitted by such license, no part of this document

may be reproduced, stored in a retrieval system, or transmitted

inanyformorbyanymeanswithouttheexpresswrittenconsent

of Hewlett-Packard Company.

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide i

Contents

ContentsContents

Contents

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 NetworkHP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

Layout Reference Guide

Layout Reference GuideLayout Reference Guide

Layout Reference Guide

Network Layout Reference Guide . . .. . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

One-Armed Router Configuration With No Firewall. . . . . . . . . . . . . . . . . . . . . . . . . 2

Inline Router Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

In Parallel With Firewall (Extranet or Intranet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Bridge Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Edge Router Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Behind a Firewall With or Without NAT (One-Armed) . . . . . . . . . . . . . . . . . . . . . 11

Behind a Firewall With or Without NAT (Inline) . . . . . . . . . . . . . . . . . . . . . . . . . . 13

The VPN Device as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (Without NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (With NAT). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Behind a Firewall (One-Armed) With or Without NAT . . . . . . . . . . . . . . . . . . . . . 21

Behind a Firewall That May or May Not Use NAT (Inline) . . . . . . . . . . . . . . . . . . 24

The VPN Device as a Firewall (With or Without NAT) . . . . . . . . . . . . . . . . . . . . . 27

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide 1

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

1Network Layout Reference Guide

Network Layout Reference GuideNetwork Layout Reference Guide

Network Layout Reference Guide

The purpose of this

Network Layout Reference Guide

is to help

you install the HP VPN ServerAppliance SA3110/SA3150/

SA3400/SA3450in your network.The termVPN device isused in

this document to refer to all of these devices.

Here are some real-world examples of how the VPN device can

be incorporated into your network infrastructure. Skim through

the following scenarios and find the ones most similar to your

network configuration. Then, note the corresponding

configuration options to help you quickly install the VPN device

into your network.

Scenarios are divided into client and LAN-to-LAN.

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios • One-armed router configuration (VPN server) with no

firewall

• Inline router configuration

• In parallel with firewall (for extranet or intranet)

• Bridge configuration

• Edge router configuration

• Behind a firewall (one-armed) that may or may not use

network address translation (NAT)

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall

LAN-to-LAN

LAN-to-LANLAN-to-LAN

LAN-to-LAN

Scenarios

ScenariosScenarios

Scenarios • In parallel with a firewall and no NAT

• In parallel with a firewall with NAT

• Behind afirewall (one-armed) that mayor may not use NAT

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall (may or may notuse NAT)

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios

If you are using the VPN device with the HP SA3000 Series VPN

Client, skim the following scenarios and find the ones most

similar to your network configuration. Then, use the

corresponding table of configuration parameters as a guideline

when configuring your VPN device and VPN Client.

If you are using the VPN device in LAN-to-LAN configurations,

skip to the next section “LAN-to-LAN Scenarios.”

One-Armed

One-ArmedOne-Armed

One-Armed

Router

RouterRouter

Router

Configuration

ConfigurationConfiguration

Configuration

With No

With NoWith No

With No

Firewall

FirewallFirewall

Firewall

This scenario shows the following:

• One-armed configuration uses only one of the VPN device’s

two interfaces.

• Firewall is not enabled.

• The VPN device (VPND) acts as a VPN server.

Figure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No FirewallFigure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No Firewall

Configuring a One-Armed Router Configuration

Configuring a One-Armed Router ConfigurationConfiguring a One-Armed Router Configuration

Configuring a One-Armed Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the HP SA3000 Series VPN Manager or command shell.

Desktop

System

Desktop

System

Internal

Network

Internet Router

VPND

Internet

Connection

Direct

Dial

Laser Printer

PSTN

Router or Remote

Access Server

No Firewall

Functions

Router Mode

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 3

To set up a one-armed router configuration, use the

configuration parameters in the following table. Note that the

values of these parametersare examples only; you must enter

values specific to your network.

Table:

Table:Table:

Table: O

One-Armed Router Configuration Parameters

ne-Armed Router Configuration Parametersne-Armed Router Configuration Parameters

ne-Armed Router Configuration Parameters

Inline Router

Inline RouterInline Router

Inline Router

Configuration

ConfigurationConfiguration

Configuration In this scenario, VPN Client traffic is handled either through a

router (inline) or by directly dialing into the public-switched

telephone network (PSTN).

• For inline router configurations:

— The router accepts all incoming client traffic then trans-

fers the traffic to the VPN device.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1: (not used for

one-armed)

IP: NA

Mode: NA

Interface E1: (not used for one-

armed)

IP: NA

Mode: NA

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.2

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

HP SA3000 Series VPN Client

IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

4 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

— The VPN device then transfers the traffic on to the local

network to which it is attached. The VPN device may or

may not perform firewall functions on the traffic.

• For direct dial into the PSTN:

— Traffic may go through a router or remote access server,

which may or may not perform NAT.

— The traffic then goes through the VPN device,which

may or may not perform firewall functions on the

traffic.

Figure: Inline Router Configuration

Figure: Inline Router ConfigurationFigure: Inline Router Configuration

Figure: Inline Router Configuration

Configuring an Inline Router Configuration

Configuring an Inline Router ConfigurationConfiguring an Inline Router Configuration

Configuring an Inline Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the VPN Manager or command shell.

To set up an inline router configuration, use the configuration

parameters in the following table. Note that the values of these

parameters are examples only; you must entervaluesspecific to

your network.

With/Without

Firewall

Functions

Internet Router

Internet Connection

Direct Dial

VPND

Desktop

System

File Server

Laser Printer

PSTN

May/May Not NAT

Router Mode

Internal

Network

Router or

Remote Access Server

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 5

Table:

Table:Table:

Table:

Inline Router Configuration Parameters

Inline Router Configuration ParametersInline Router Configuration Parameters

Inline Router Configuration Parameters

In Parallel With

In Parallel WithIn Parallel With

In Parallel With

Firewall

FirewallFirewall

Firewall

(Extranet or

(Extranet or(Extranet or

(Extranet or

Intranet)

Intranet)Intranet)

Intranet)

In this scenario, VPN Client traffic is handled either through a

router(inline) or by directly dialing in to the PSTN. In addition,

there is a third-party firewall on the network handling firewall

functionality.

• For inline router configurations:

— The router accepts all incoming client traffic, then trans-

fers the traffic to the VPN device.

— The VPN device then transfers the traffic to the local

network to which it is attached.

— The VPN device is in router mode and doesnot perform

firewall functions.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1:

IP: 192.168.10.2 255.255.255.0

Mode: Red

Interface E1:

IP: 210.35.129.2 255.255.255.0

Mode: Red

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.3

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

Andere Handbücher für Sa3110 - VPN Server Appliance

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere HP Server Handbücher

HP Apollo 4200 Gen9 Montageanleitung

HP Cluster Platform Express v2010 Merkblatt

HP D7171A - NetServer - LPr Bedienungsanleitung

HP DL360 - ProLiant - Photon Handbuch

HP ProLiant DL380 Generation 6 Bedienungsanleitung

HP Apollo 2000 System Handbuch

HP ProLiant ML370G4 SAS Montageanleitung

HP vc4725 - Thin Client Einrichtungshandbuch

HP 9000 A180C Montageanleitung

HP ProLiant DL140 Montageanleitung

HP L1000 - 9000 - 0 MB RAM Betriebsanleitung

HP ProLiant SL250s Gen8 Bedienungsanleitung

HP 780019-S01 Handbuch

HP 2G Leitfaden

HP Apollo a6000 Chassis Handbuch

HP ProLiant DL385 G5p Handbuch

HP ProLiant ML110 - G2 Server Montageanleitung

HP AlphaServer ES47 Kurzanleitung

HP P4522A - Traffic Management Server Sa8220 Bedienungsanleitung

HP NetServer LXr 8500 Bedienungsanleitung

HP D7171A - NetServer - LPr Bedienungsanleitung

HP t5740 - Thin Client Gebrauchsanweisung

HP t5400 - Thin Client Bedienungsanleitung

HP ProLiant DL380 G3 Gebrauchsanweisung

Beliebte Server Handbücher anderer Marken

Dell

Dell PowerEdge R410 Bedienungsanleitung

PowerNAS

PowerNAS CMA Bedienungsanleitung

Supero

Supero FatTwin F617R3-FT Bedienungsanleitung

MSI

MSI P1-109N-L70 Bedienungsanleitung

Dell

Dell PowerEdge XE9640 Handbuch

Dell

Dell PS4100 Montageanleitung

EtroVISION

EtroVISION EV3151 Bedienungsanleitung

NEC

NEC Express5800/T110j Bedienungsanleitung

Compaq

Compaq ProLiant 3000 Handbuch

Dell

Dell PowerEdge 3YPMN Bedienungsanleitung

iRobo

iRobo IPC2U Bedienungsanleitung

Nortel

Nortel 1000 Con?guration guide Bedienungsanleitung

Asus

Asus AP7500 Bedienungs- und Wartungshandbuch

Avid Technology

Avid Technology AirSpeed 5000 Bedienungsanleitung

Milestone

Milestone Husky IVO 350T Bedienungsanleitung

Planet

Planet NAS-7410 Bedienungsanleitung

Lenovo

Lenovo ThinkSystem SR635 V3 Bedienungsanleitung

Dell

Dell PowerEdge HS5610 Handbuch