Secure Computing ADMINGUIDEREVA Bedienungsanleitung

VPN Administration Guide

Revision A

SafeNet/Soft-PK Version 5.1.3 Build 4

Sidewinder Version 5.1.0.02

This document and the software described in it are copyrighted. Under the copyright laws, neither this document nor this

software may be copied, reproduced, translated, or reduced to any electronic medium or machine-readable form without

rights reserved. Made in the U.S.A.

Trademarks

Secure Computing, Sidewinder, Type Enforcement, and Strikeback are either registered trademarks or trademarks of

Secure Computing Corporation. All other trademarks, tradenames, service marks, service names, product names, and

images mentioned and/or used herein belong to their respective owners.

Secure Computing Corporation Software License Agreement

CAREFULLY READ THE FOLLOWING TERMS AND CONDITIONS BEFORE LOADING THE SOFTWARE. BY LOADING

THE SOFTWARE, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS AGREEMENT, UNDERSTAND IT, AND AGREE

TO BE BOUND BY ITS TERMS AND CONDITIONS.

Secure Computing Corporation ("Secure Computing") provides its software and licenses its use either directly or through

authorized dealers. You assume responsibility for the selection of the programs to achieve your intended results, and for

the installation (unless installation is purchased from Secure Computing or an authorized dealer), use, and results

obtained from the programs.

1. Grant of License

Secure Computing grants to you, and you accept, a non-exclusive, and non-transferable license (without right to sub-

license) to use the Software Products as defined herein on a single machine.

2. Software Products

"Software Products" mean (i) the machine-readable object-code versions of the Software of Secure Computing

contained in the media (the "Software"), (ii) the published user manuals and documentation that are made available for

the Software (the "Documentation"), and (iii) any updates or revisions of the Software or Documentation that you may

receive (the "Update"). Under no circumstances will you receive any source code of the Software. Software Products

provided for use as "backup" in the event of failure of a primary unit may be used only to replace the primary unit after

a failure in fact occurs. They may not be used to provide any capability in addition to the functioning primary system

that they backup.

3. Use

You may not transfer any Software Products to any third party. You may not copy, translate, modify, sub-license, adapt,

decompile, disassemble, or reverse engineer any Software Product in whole or in part except to make one copy of the

Software solely for back-up or archival purposes.

4. Limited Warranty and Remedies

Secure Computing warrants that the disk(s) or tape(s) on which its Software is recorded is/are free from defects in

material and workmanship under normal use and service for a period of ninety (90) days from the date of shipment to

you.

Secure Computing does not warrant that the functions contained in the Software will meet your requirements or that

operation of the program will be uninterrupted or error-free. The Software is furnished "AS IS" and without warranty as

to the performance or results Licensee may obtain by using the Software. The entire risk as to the results and

performance of the Software is assumed by Licensee. If Licensee does not receive media which is free from defects in

materials and workmanship during the 90-day warranty period, Licensee will receive a refund for the amount Licensee

paid for the Software Product returned.

5. Limitation of Warranty and Remedies

THE WARRANTIES STATED HEREIN ARE IN LIEU OF ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING

ANY WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SOME STATES AND

COUNTRIES DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE EXCLUSION MAY NOT

APPLY TO YOU. THIS WARRANTY GIVES YOU SPECIFIC LEGAL RIGHTS. YOU MAY HAVE OTHER RIGHTS WHICH

VARY BY STATE OR COUNTRY.

SECURE COMPUTING’S AND ITS LICENSORS ENTIRE LIABILITY UNDER, FOR BREACH OF, OR ARISING OUT OF

THIS AGREEMENT, IS LIMITED TO A REFUND OF THE PURCHASE PRICE OF THE PRODUCT OR SERVICE THAT

GAVE RISE TO THE CLAIM. IN NO EVENT SHALL SECURE COMPUTING OR ITS LICENSORS BE LIABLE FOR YOUR

COST OF PROCURING SUBSTITUTE GOODS. IN NO EVENT WILL SECURE COMPUTING OR ITS LICENSORS BE

LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL, EXEMPLARY, OR OTHER DAMAGES

WHETHER OR NOT SECURE COMPUTING HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE.

6. Term and Termination

This license is effective until terminated. If you are using this license with a limited term, it shall expire at the end of

the license term. You may terminate it at any time by destroying the Software Product, including all computer programs

and documentation, and erasing any copies residing on computer equipment. This Agreement also will automatically

terminate if you do not comply with any terms or conditions of this Agreement. Upon such termination, you agree to

destroy the Software Product and erase all copies residing on computer equipment.

7. Ownership

All intellectual property rights including trademarks, service marks, patents, copyrights, trade secrets, and other

proprietary rights in or related to the Software Products are, and will remain the property of Secure Computing or its

licensors, whether or not specifically recognized or protected under local law.

8. Export Restrictions

You agree to comply with all applicable United States export control laws and regulations, including without limitation,

the laws and regulations administered by the United States Department of Commerce and the United States Department

of State.

9. U.S. Government Rights

Software Products furnished to the U.S. Government are provided on these commercial terms and conditions as set

forth in DFARS 227.7202-1(a).

10. General

Any waiver of or modification to the terms of this Agreement will not be effective unless executed in writing and

signed by Secure Computing. If any provision of this Agreement is held to be unenforceable, in whole or in part, such

holding shall not affect the validity of the other provisions of this Agreement. In the event of any inconsistency

between this Agreement and any other related agreements between you and Secure Computing, the terms of this

Agreement shall prevail.

Technical Support Information

Secure Computing works closely with our Channel Partners to offer worldwide Technical Support services. If you

purchased this product through a Secure Computing Channel Partner, please contact your reseller directly for support

needs.

To contact Secure Computing directly or inquire about obtaining a support contract, refer to our “Contact Secure" Web

page for the latest contact information at www.securecomputing.com. Or if you prefer, send us an email at

support@securecomputing.com.

Comments?

If you have comments or suggestions you would like to make regarding this document, please send an email to

techpubs@securecomputing.com.

Printing History

Date Part number SoftwareRelease

March2001 86-0935037-A Soft-PK 5.1.3 Build 4 and Sidewinder 5.1.0.02

TableofContents iii

TABLE OF CONTENTS

Preface: About this Guide. . . . . . . . . . . . . . . . . . . . . . . . . . . .v

Who should read this guide? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .v

How this guide is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi

Where to find additional information . . . . . . . . . . . . . . . . . . . . . . .vii

Chapter 1: Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . 1-1

About Soft-PK & Sidewinder VPNs . . . . . . . . . . . . . . . . . . . . . . . 1-2

Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-3

Sidewinder and other network requirements . . . . . . . . . . . . . . 1-3

Soft-PK requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4

Roadmap to deploying your VPNs . . . . . . . . . . . . . . . . . . . . . . . 1-5

Chapter 2: Planning Your VPN Configuration. . . . . . . . . . 2-1

Identifying basic VPN connection needs . . . . . . . . . . . . . . . . . . . 2-2

Identifying authentication requirements . . . . . . . . . . . . . . . . . . .2-3

Using digital certificate authentication . . . . . . . . . . . . . . . . . . . 2-3

Understanding pre-shared key authentication . . . . . . . . . . . . 2-5

Extended authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-6

Determining where you will terminate your VPNs . . . . . . . . . . . . 2-7

More about virtual burbs and VPNs . . . . . . . . . . . . . . . . . . . . 2-8

Defining a virtual burb . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-8

Understanding Sidewinder client address pools . . . . . . . . . . . . . 2-9

Chapter 3: Configuring Sidewinder for Soft-PK Clients . 3-1

Enabling the VPN servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2

Configuring ACL & proxies entries for VPN connections . . . . . . 3-3

Managing Sidewinder self-signed certs . . . . . . . . . . . . . . . . . . .3-4

Creating & exporting a firewall certificate . . . . . . . . . . . . . . . . 3-4

Creating & exporting remote certificate(s) . . . . . . . . . . . . . . . .3-6

Managing CA-based certificates . . . . . . . . . . . . . . . . . . . . . . . . . 3-9

Defining a CA to use and obtaining the CA root cert . . . . . . .3-9

Requesting a certificate for the firewall . . . . . . . . . . . . . . . . . 3-10

Determining identifying information for client certificates . . .3-12

iv TableofContents

Defining remote client identities in Sidewinder . . . . . . . . . . . 3-13

Managing pre-shared keys (passwords) . . . . . . . . . . . . . . . . . .3-14

Configuring the VPN on the Sidewinder . . . . . . . . . . . . . . . . . . 3-15

Chapter 4: Installing and Working with Soft-PK. . . . . . . . 4-1

Soft-PK installation notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-2

Starting Soft-PK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-3

Determining Soft-PK status from icon variations . . . . . . . . . . . 4-3

Activating/Deactivating Soft-PK . . . . . . . . . . . . . . . . . . . . . . . 4-4

About the Soft-PK program options . . . . . . . . . . . . . . . . . . . . 4-5

Managing certificates on Soft-PK . . . . . . . . . . . . . . . . . . . . . . . .4-6

Setting up Sidewinder self-signed certificates . . . . . . . . . . . . .4-6

Setting up CA-based certificates . . . . . . . . . . . . . . . . . . . . . . . 4-7

Requesting a personal certificate from a CA on user’s behalf 4-8

Importing certificate in Soft-PK . . . . . . . . . . . . . . . . . . . . . . . . 4-9

Configuring a security policy on the Soft-PK . . . . . . . . . . . . . . .4-13

Chapter 5: Deploying Soft-PK to Your End Users . . . . . . 5-1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-2

Customizing the user worksheet . . . . . . . . . . . . . . . . . . . . . . . . . 5-4

Specifying dial-up network instructions . . . . . . . . . . . . . . . . . . 5-4

Specifying installation instructions . . . . . . . . . . . . . . . . . . . . .5-4

Specifying certificate import/request instructions . . . . . . . . . .5-5

Specifying security policy instructions . . . . . . . . . . . . . . . . . . . 5-6

Specifying basic connection information . . . . . . . . . . . . . . . . . 5-6

Appendix A: Troubleshooting . . . . . . . . . . . . . . . . . . . . . .A-1

Soft-PK Log Viewer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .A-1

Soft-PK Connection Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . .A-2

More about the Connection Monitor . . . . . . . . . . . . . . . . . . . .A-3

To view the details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .A-3

Sidewinder troubleshooting commands . . . . . . . . . . . . . . . . . . .A-4

Preface:AboutthisGuide v

PREFACE

About this Guide

This guide provides the information needed to set up connections

between remote systems running SafeNet/Soft-PK™VPN client

software and systems on a network protected by Secure Computing’s

Sidewinder firewall. SafeNet/Soft-PK is a Windows-compatible

program that secures data communications sent from a desktop or

laptop computer across either a public network or an existing

corporate dial-up line.

Note: TheSafeNet/Soft-PKproductisreferredtoas simply"Soft-PK"throughoutthe

remainderofthisdocument.

IMPORTANT: ThisguidedescribesadministrationofVPNsbetweenSoft-PKVersion5.1.3

Build4andSidewinderVersion5.1.0.02.Ifyouareworkingwithalaterversionofeither

product,checkourWebpageatwww.securecomputing.comforthelatest

documentation(selectDownloads & Activations -> ProductDocumentation).

Who should read

this guide? This guide is written for the person assigned to administer

Sidewinder-based VPN connections involving a Soft-PK VPN client.

Setting up VPN connections involves procedures done on Sidewinder

and procedures done using Soft-PK to pre-configure the VPN client

security policy for each remote user (road warrior, telecommuter,

etc.).

As a network administrator, you should read and understand all the

procedures in this document. You will then be able to provide all

remote users with the information, files, and software they need to set

up Soft-PK software to communicate with your trusted network(s).

This guide assumes you are familiar with networks and network

terminology. Because Soft-PK will use a security association with a

Sidewinder firewall, you should be familiar with Sidewinder

administration. Knowledge of the Internet and of Windows operating

systems are also key requirements.

Howthisguideisorganized

vi Preface:AboutthisGuide

How this guide is

organized This guide contains the following chapters.

Finding information This guide is in Acrobat (softcopy) format only and does not contain

an index. However, you can use Acrobat’s Find feature to search for

every instance of any word or phrase that you want.

ChapterTitle Description

Chapter 1:

Getting Started Presents an overview of the Soft-PK and the

Sidewinder Virtual Private Network (VPN)

environment and describes the requirements. It

includes a checklist to guide you through the

basic steps to setup and deploy a VPN.

Chapter 2:

Planning your VPN

Configuration

Provides information to help you understand key

concepts and options that are involved in a VPN

connection.

Chapter 3:

Configuring Sidewinder

for Soft-PK Clients

Provides a summary of Sidewinder procedures

associated with setting up and configuring Soft-

PK connections in your network.

Note: Performtheseproceduresbefore you

configureyourSoft-PK clients.

Chapter 4:

Installing and Working

with Soft-PK

Includes Soft-PK installation notes anddescribes

the basic Soft-PK procedures for managing

certificates and creating a customized Soft-PK

security policy for your remote clients.

Chapter 5:

Deploying Soft-PK to Your

End Users

Summarizes the steps for preparing and

deploying the Soft-PK software, digital certificate

files, and security policy to your end users. It is

based on a worksheet (in MS Word format) that

you edit and send to each remote end user.

Appendix A:

Troubleshooting Provides a summary of troubleshooting

techniques available for resolving Soft-PK and

Sidewinder VPN connection problems.

Wheretofindadditionalinformation

Preface:AboutthisGuide vii

Viewing and printing this

documentonline When you view this document online in PDF format, you may find

that the screen images are blurry. If you need to see the image more

clearly, you can either enlarge it (which may not eliminate the

blurriness) or you can print it. (The images are very clear when

printed out.)

For the best results, print this PDF document using a PostScript printer

driver.

If your printer understands PostScript but does not have a

PostScript driver installed, you need to install a PostScript driver.

You can download one for your printer from www.adobe.com.

If your printer is not a PostScript printer and this document does

not print as expected, try one of the following:

—If your printer has the option, Printas Image, enable this option

and then try printing.

—Print specific page(s) at a time rather than sending the entire

document to the printer.

Where to find

additional

information

Refer to the following for related information.

About Soft-PK

For additional information about configuring and troubleshooting

Soft-PK software, refer to the online help that is integrated into the

program’s user interface. Soft-PK online help provides detailed

step-by-step procedures for individual VPN client tasks.

About Sidewinder

For more information about setting up VPN connections on

Sidewinder, refer to Chapter 11 in the Sidewinder Administration

Guide. In addition, be sure to review documentation associated

with patch releases.

Aboutdigitalcertificates

For information on digital certificates and Public Key Infrastructure

(PKI) technology, see:

—Understanding Public-Key Infrastructure, by Carlisle Adams

and Steve Lloyd (1999)

—Internet X.509 Public Key Infrastructure, Certificate and CRL

Profile, RFC 2459, R. Housley, W. Ford, W. Polk, D. Solo

(January 1999)

Wheretofindadditionalinformation

viii Preface:AboutthisGuide

To contact Secure Computing directly or inquire about obtaining a

support contract, refer to our Web site at www.securecomputing.com,

and select “Contact Us." Or if you prefer, send us email at

support@securecomputing.com (be sure to include your customer ID in

the email).

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Secure Computing Software Handbücher

Secure Computing

Secure Computing SSL Scanner Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Novell

Novell GROUPWISE 8 - INTERNET AGENT Bedienungsanleitung

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung