Related Manuals for Secure Computing ADMINGUIDEREVA
Summary of Contents for Secure Computing ADMINGUIDEREVA
- Page 1 VPN Administration Guide Revision A SafeNet/Soft-PK Version 5.1.3 Build 4 Sidewinder Version 5.1.0.02...
-
Page 3: Copyright Notice
Copyright Notice This document and the software described in it are copyrighted. Under the copyright laws, neither this document nor this software may be copied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior written authorization of Secure Computing Corporation. Copyright © 2001, Secure Computing Corporation. All rights reserved. -
Page 4: Technical Support Information
SECURE COMPUTING’S AND ITS LICENSORS ENTIRE LIABILITY UNDER, FOR BREACH OF, OR ARISING OUT OF THIS AGREEMENT, IS LIMITED TO A REFUND OF THE PURCHASE PRICE OF THE PRODUCT OR SERVICE THAT GAVE RISE TO THE CLAIM. IN NO EVENT SHALL SECURE COMPUTING OR ITS LICENSORS BE LIABLE FOR YOUR COST OF PROCURING SUBSTITUTE GOODS. -
Page 5: Table Of Contents
A B L E O N T E N T S Preface: About this Guide......v Who should read this guide? . - Page 6 Defining remote client identities in Sidewinder ... 3-13 Managing pre-shared keys (passwords) ....3-14 Configuring the VPN on the Sidewinder .
-
Page 7: Preface: About This Guide
R E F A C E About this Guide This guide provides the information needed to set up connections between remote systems running SafeNet/Soft-PK™ VPN client software and systems on a network protected by Secure Computing’s Sidewinder firewall. SafeNet/Soft-PK is a Windows-compatible program that secures data communications sent from a desktop or laptop computer across either a public network or an existing corporate dial-up line. -
Page 8: How This Guide Is Organized
How this guide is organized How this guide is This guide contains the following chapters. organized Chapter Title Description Chapter 1: Presents an overview of the Soft-PK and the Getting Started Sidewinder Virtual Private Network (VPN) environment and describes the requirements. It includes a checklist to guide you through the basic steps to setup and deploy a VPN. -
Page 9: Where To Find Additional Information
Where to find additional information When you view this document online in PDF format, you may find Viewing and printing this document online that the screen images are blurry. If you need to see the image more clearly, you can either enlarge it (which may not eliminate the blurriness) or you can print it. - Page 10 Where to find additional information To contact Secure Computing directly or inquire about obtaining a support contract, refer to our Web site at www.securecomputing.com and select “Contact Us." Or if you prefer, send us email at (be sure to include your customer ID in support@securecomputing.com the email).
-
Page 11: Chapter 1: Getting Started
H A P T E R Getting Started This chapter provides an overview of the Soft-PK™ and Sidewinder About this chapter Virtual Private Network (VPN) environment and describes the requirements. It includes a checklist to guide you through the basic steps to setup and deploy a VPN. -
Page 12: About Soft-Pk & Sidewinder Vpns
About Soft-PK & Sidewinder VPNs About Soft-PK & Soft-PK is security software for remote PC users. It is designed to provide data privacy between remote users and a corporate network. Sidewinder VPNs Industry-standard encryption and user verification routines protect the data sent over the connection. -
Page 13: Requirements
Requirements Requirements To configure VPN communication between Sidewinder and Soft-PK clients, your Sidewinder must be configured with the proper VPN parameter settings and access rules. In addition, depending on your VPN connection set up, you may also need to define the proper digital certificates. -
Page 14: Soft-Pk Requirements
Requirements Soft-PK requirements Each system on which Soft-PK will be installed must meet the requirements listed in Table 1-2 IMPORTANT: A remote system must only run one VPN client. If a VPN client program such as SecureClient was previously installed on the remote system, ensure it is properly uninstalled. -
Page 15: Roadmap To Deploying Your Vpns
Roadmap to deploying your VPNs Roadmap to Because Secure Computing products provide network security, we recommend that, as the network administrator, you carefully oversee deploying your the installation and configuration of the Soft-PK client(s). Setting up VPNs VPN connections using Soft-PK and Sidewinder involves performing procedures on each remote system running Soft-PK AND on your Sidewinder. - Page 16 Roadmap to deploying your VPNs Figure 1-2. VPN deployment 1 — Satisfy Sidewinder, network, & system requirements overview 2 — Plan your VPN configuration 3 — Enable appropriate Sidewinder servers, ACL entries, & proxies 4 — Set up VPN authentication on Sidewinder If using Sidewinder If using CA-assigned If using pre-shared...
- Page 17 Roadmap to deploying your VPNs The following checklist identifies each major step involved in the Soft-PK deployment checklist setup and deployment of your Soft-PK software (as shown in Figure 1-2). You can use the checklist as a reference point and mark off each item as you complete it to ensure a successful VPN rollout.
- Page 18 Roadmap to deploying your VPNs ISAKMP ACL entry: At a minimum, you must define and enable an ACL entry that allows ISAKMP traffic from the Internet to the Internet burb on Sidewinder (external IP address of Sidewinder). Other ACL entries: Depending on where you terminate your VPN connections on Sidewinder (e.g., in a virtual burb), you may need to create ACL entries to allow traffic between burbs.
- Page 19 Roadmap to deploying your VPNs 5 —Configure the VPN connections on the Sidewinder Use Cobra to define the VPN security association configuration. See "Configuring the VPN on the Sidewinder" on page 3-15 for details. Enable Extended Authentication. 6 — Configure the certificates and security policy(ies) for your remote users Install your copy of Soft-PK.
- Page 20 Roadmap to deploying your VPNs 8 —Troubleshoot any connection problems Use the Soft-PK Log Viewer. See "Soft-PK Log Viewer" on page A-1. Use the Soft-PK Connection Monitor. See "Soft-PK Connection Monitor" on page A-2. Use Sidewinder commands. See "Sidewinder troubleshooting commands" on page A-4 and the Sidewinder Administration Guide for details.
- Page 21 H A P T E R Planning Your VPN Configuration This chapter provides information to help you understand key About this chapter concepts and options that are involved in a VPN connection. It addresses the following topics: Š "Identifying basic VPN connection needs" on page 2-2 Š...
-
Page 22: Identifying Basic Vpn Connection Needs
Identifying basic VPN connection needs Identifying basic Before you actually begin configuring your Sidewinder or work with Soft-PK, ensure you have an understanding of the basic profile for VPN connection your VPN connections. needs Begin by doing the following: Š List the remote users that need a VPN connection Š... -
Page 23: Identifying Authentication Requirements
Identifying authentication requirements Identifying Determine how you will identify and authenticate the partners in your VPN. Sidewinder and Soft-PK both support using digital certificates authentication and pre-shared key VPN configurations. In addition, when you use requirements Sidewinder version 5.1.0.02 or later, you can set up Extended Authentication to provide increased security to your VPN network. - Page 24 Identifying authentication requirements If not already done, decide if you will use self-signed certificates generated by Sidewinder or a public/private CA server. Table 2-1. Sidewinder self-signed certificates versus CA-based certificates Scenario Profile Š No CA needed Using self-signed certificates Š Requires one VPN association for each client (for a small number of VPN clients)
-
Page 25: Understanding Pre-Shared Key Authentication
Identifying authentication requirements A VPN implemented using CA-based certificates requires access to a A closer look at CA-based certificates private or public CA. Each end-point (client, firewall, etc.) in the VPN retains a private key file that is associated with a public certificate. In addition, each end-point in the VPN needs the CA root certificate on their system. -
Page 26: Extended Authentication
Identifying authentication requirements Extended authentication In addition to the normal authentication checks inherent during the negotiation process at the start of every VPN association, Extended Authentication goes one step further by requiring the person requesting the VPN connection to validate their identity. Depending on the authentication method you select, the person must provide a unique user name and password, a special passcode, or one-time password before the VPN association is established. -
Page 27: Determining Where You Will Terminate Your Vpns
Determining where you will terminate your VPNs Determining You can configure a VPN security association on Sidewinder to terminate in any burb. For example, Figure 2-4 shows a VPN security where you will association terminating in the trusted burb. It allows all network traffic terminate your to flow between the hosts on the trusted network and the VPN client. -
Page 28: More About Virtual Burbs And Vpns
Determining where you will terminate your VPNs More about virtual burbs and VPNs Consider a VPN association that is implemented without the use of a virtual burb. Not only will VPN traffic mix with non-VPN traffic, but there is no way to enforce a different set of rules for the VPN traffic. This is because proxies and ACLs, the agents used to enforce the rules on a Sidewinder, are applied on burb basis, not to specific traffic within a burb. -
Page 29: Understanding Sidewinder Client Address Pools
Understanding Sidewinder client address pools Understanding You may choose to implement your VPN using Sidewinder client address pools. Client address pools are reserved virtual IP addresses, Sidewinder client recognized as internal addresses of the trusted network. Addresses in address pools this pool are configured on Sidewinder and assigned (or "pushed") to a VPN client (per VPN configuration) when the VPN connection is started. - Page 30 Understanding Sidewinder client address pools Š Address of the firewall Š Protected networks The client does not need to define a virtual IP for use in the VPN connection, nor do they need to concern themselves with DNS issues on the trusted network. In addition to simplifying the configuration process for your clients, client address pools give you the ability to place additional controls on VPN clients.
- Page 31 H A P T E R Configuring Sidewinder for Soft-PK Clients This chapter provides a summary of Sidewinder procedures associated About this chapter with setting up and configuring Soft-PK connections in your network. IMPORTANT: Perform these procedures before you configure your Soft-PK clients. This chapter addresses the following topics: Š...
-
Page 32: Enabling The Vpn Servers
Enabling the VPN servers Enabling the VPN Before you configure a VPN association on your Sidewinder, you must first enable the Sidewinder’s EGD and CMD servers. In addition, you servers must enable the ISAKMP server and set it to listen on the Internet burb. -
Page 33: Configuring Acl & Proxies Entries For Vpn Connections
Configuring ACL & proxies entries for VPN connections Configuring ACL & Depending on where you decide to terminate your VPN tunnel, you must ensure that you have the appropriate ACL entries set up to allow proxies entries for ISAKMP traffic and allow/deny the appropriate proxy traffic. At a VPN connections minimum, you must define and enable an ACL entry that allows ISAKMP traffic from the Internet to the external IP address of... -
Page 34: Managing Sidewinder Self-Signed Certs
Managing Sidewinder self-signed certs Managing If you are using Sidewinder to generate certificates, use the following procedure to create and export self-signed certificates that identify the Sidewinder self- firewall and each remote client. signed certs TIP: Typically, a VPN configuration using Sidewinder self-signed certificates is suitable if the number of clients is small. - Page 35 Managing Sidewinder self-signed certs Specify the following Firewall Certificate settings. Field Setting Certificate Name Specify a name for the firewall certificate. Distinguished Specify a set of data that identifies the firewall. Use the Name following format: cn=,ou=,o=,l=,st=,c= where: Š cn = common name Š...
-
Page 36: Creating & Exporting Remote Certificate(S)
Managing Sidewinder self-signed certs Creating & exporting remote certificate(s) Use the following procedure on Sidewinder to create a self-signed certificate file (with its embedded public key) and a private key file for each of your Soft-PK clients. Once a pair of certificate/private key files are created for a unique client, you must use Sidewinder’s command to combine each file pair into a PKCS12- pkcs12_util... - Page 37 Managing Sidewinder self-signed certs Specify the following Remote Certificate settings. Field Setting Certificate Name Specify a name for the remote certificate. Distinguished Specify a set of data that identifies the client. Use the Name following format: cn=,ou=,o=,l=,st=,c= where: Š cn = common name Š...
- Page 38 Managing Sidewinder self-signed certs Click to return to the previous window. Close To start the PKCS12 utility on the Sidewinder, from the command line, Converting the certificate file/private key file pair to enter the following command: pkcs12 format pkcs12_util The utility will prompt you for the name and location of the private key file, for the name and location of the associated certificate file, and for the name and location in which to store the resulting PKCS12-format- ted object.
-
Page 39: Managing Ca-Based Certificates
Managing CA-based certificates Managing CA- If you are using a CA to authorize certificates, use the following procedures to define the CA, request the firewall and CA certificates, based certificates and define the remote identities of each client within Sidewinder (needed later when setting up your VPN connections). -
Page 40: Requesting A Certificate For The Firewall
Managing CA-based certificates Click to save the CA certificate to a file for later importation into Export client system(s). Each user must then use Soft-PK to import the CA certificate you obtained for them. Note: You can have the user request the CA certificate from the CA using Soft-PK. You must provide the necessary CA information/instructions to do so. - Page 41 Managing CA-based certificates Specify the firewall certificate information. Field Setting Certificate Name Specify a name for the firewall certificate. Distinguished Specify a set of data that identifies the firewall. Use the Name following format: cn=,ou=,o=,l=,st=,c= where: Š cn = common name Š...
-
Page 42: Determining Identifying Information For Client Certificates
Managing CA-based certificates Determining identifying information for client certificates Define the identifying information that will be used for each remote client certificate. Typically, these are the values entered in the Distinguished Name (DN) fields when defining a certificate. This information will be needed in either of the following scenarios: Š... -
Page 43: Defining Remote Client Identities In Sidewinder
Managing CA-based certificates Defining remote client identities in Sidewinder When using CA-based certificates, you must define an identity "template" in Sidewinder that matches all possible client identities used by the remote entities in your VPN. To define remote certificate identities on Sidewinder, do the following. -
Page 44: Managing Pre-Shared Keys (Passwords)
Managing pre-shared keys (passwords) Managing pre- When using pre-shared keys (passwords), you must define an identity "template" in Sidewinder that matches all possible client identities shared keys used by the remote entities in your VPN. (passwords) To define remote certificate identities on Sidewinder, use the same procedure as defined in "Defining remote client identities in Sidewinder"... -
Page 45: Configuring The Vpn On The Sidewinder
Configuring the VPN on the Sidewinder Configuring the Create a VPN security association for a VPN using the newly Tunnel created certificates. Do the following from the Sidewinder Cobra VPN on the interface: Sidewinder Select . Click VPN Configuration -> Security Associations Figure 3-8. - Page 46 Configuring the VPN on the Sidewinder Field Setting Local Network/IP Specify the network names or IP addresses to use as the destination for the client(s) in the VPN. Click the New button to specify the IP Address / Hostname and Number of bits in Netmask. The value specified identifies the network portion of the IP address.
- Page 47 Configuring the VPN on the Sidewinder Select the tab. Choose the authentication method Authentication appropriate for your configuration. Figure 3-9. Sidewinder Security Associations Properties, The "view" changes Authentication tab depending upon the Authentication Method you select from the dropdown list. Š...
- Page 48 Configuring the VPN on the Sidewinder Š If you selected (Figure 3-11), Certificate & Certificate Authority specify the following CA certificate options. Figure 3-11. "Certificate & Certificate Authority" options Table 3-3. Certificate + Certificate Authority options Field Setting Firewall Firewall Select the certificate used to Credentials Certificate...
- Page 49 Configuring the VPN on the Sidewinder Š If you selected (Figure 3-12), specify the following Password password options. Figure 3-12. "Password" options Table 3-4. Password options Field Setting General Enter Password/ Select the certificate used to Renter password authenticate the key exchange. Require Extended Enable this checkbox.
- Page 50 Configuring the VPN on the Sidewinder 3-20 Configuring Sidewinder for Soft-PK Clients...
- Page 51 H A P T E R Installing and Working with Soft-PK This chapter includes Soft-PK installation notes. It also describes the About this chapter basic Soft-PK procedures for managing certificates and creating a customized Soft-PK security policy for your remote clients. IMPORTANT: As network administrator, you need to install your own copy of Soft-PK and become familiar with the software before you deploy setup instructions and the Soft- PK software to each end user.
-
Page 52: Soft-Pk Installation Notes
Soft-PK installation notes Soft-PK Note the following about installing, removing, or upgrading Soft-PK software. You can customize the UserWorksheet.doc file located on the installation notes product CD to specify detailed installation instructions to your end users. (See Chapter 5 for details.) Table 4-1. -
Page 53: Starting Soft-Pk
Starting Soft-PK Starting Soft-PK Soft-PK starts automatically each time the computer on which it resides is started. It runs transparently at all times behind all other software applications including the Windows login. The Soft-PK icon in the taskbar changes color and image to indicate the status of system communications. -
Page 54: Activating/Deactivating Soft-Pk
Starting Soft-PK Activating/Deactivating Soft-PK The Soft-PK user interface defines the security mode and the action Soft-PK takes when it detects packets of various protocols and various destinations. Once configured, users need to access the user interface only to view or modify these settings. As shown in Figure 4-2, you can right-click on the Soft-PK icon in the taskbar to see all program options. -
Page 55: About The Soft-Pk Program Options
Starting Soft-PK About the Soft-PK program options This section provides a brief description of the Soft-PK main program options. Use Soft-PK’s comprehensive online help for detailed information. Š Certificate Manager The Certificate Manager allows you to request, import, and store the digital certificates received from certificate authorities (CAs). -
Page 56: Managing Certificates On Soft-Pk
Managing certificates on Soft-PK Managing If you are using digital certificate authentication in your VPN, you should provide your end users with the information and files needed certificates on to set up the necessary certificates on their Soft-PK client. This section Soft-PK provides a basic overview of what you need to do and includes (or provides cross-reference to) the appropriate procedures. -
Page 57: Setting Up Ca-Based Certificates
Managing certificates on Soft-PK Setting up CA-based certificates If you are using CA-based digital certificates, as administrator, do the following. If not already done, request and export the CA root certificate. See "Defining a CA to use and obtaining the CA root cert" on page 3-9 for details. -
Page 58: Requesting A Personal Certificate From A Ca On User's Behalf
Managing certificates on Soft-PK Requesting a personal certificate from a CA on user’s behalf Select Start -> Programs -> SafeNet/Soft-PK -> Certificate Manager right click the SafeNet icon and select Certificate Manager). Click the tab. My Certificates Click . The Online Certificate Request dialog box Request Certificate... -
Page 59: Importing Certificate In Soft-Pk
Managing certificates on Soft-PK TIP: You should select the new certificate and click Verify to validate it. In the My Certificates tab, select a personal certificate. Exporting a personal certificate Click . The Export Certificate and Private Key dialog box appears. Export In the box, enter the drive, directory, and filename for the... - Page 60 Managing certificates on Soft-PK Figure 4-4. Soft-PK Certificate Manager: CA Certificates tab, Import CA Certificate Insert the diskette containing the self-signed firewall or certificate file. From the field, select and then navigate to Files of type: All Files (*.*) display the files located on the diskette. Select the appropriate certname.pem file and click .
- Page 61 Managing certificates on Soft-PK Use the following procedure to import a personal certificate into the Importing a personal certificate into Soft-PK Soft-PK system. This procedure is done at the client system and assumes Soft-PK is already installed. Note: This procedure is summarized on the UserWorksheet.doc file, customize that procedure as needed for your end users.
- Page 62 Managing certificates on Soft-PK Note: You must provide this password to the end user so they can later import this certificate file. Click . A prompt appears to confirm you want to import the Import selected Personal Certificate. Figure 4-9. Verification window Click [Optional] From the...
-
Page 63: Configuring A Security Policy On The Soft-Pk
Configuring a security policy on the Soft-PK Configuring a As an administrator, you can configure end user security policies on your Soft-PK system, save them to a diskette, and distribute them to security policy on your users. Your end users then simply import the security policy the Soft-PK you’ve set up. - Page 64 Configuring a security policy on the Soft-PK Start defining a new policy. Select to create a Edit -> Add -> Connection new policy. Figure 4-11. Soft-PK: Security Policy Editor New connection named SecureVPN Note: By default, the "Other Connections" policy handles all traffic not defined in other policies Specify a descriptive name for the connection.
- Page 65 Configuring a security policy on the Soft-PK — Click on the button, in the window that appears Edit Name (Figure 4-12, enter the information. Input Distinguished Name all fields from the Firewall Certificate and click Figure 4-12. Soft-PK: Edit Distinguished Name window to specify This is case sensitive, Firewall public certificate...
- Page 66 Configuring a security policy on the Soft-PK Select the authentication method for this connection. Š If using shared password: Click and enter the Pre-Shared Key shared password. Š If using digital certificates: Select the personal certificate previously imported from the drop-down list. Notice the ID Type automatically changes to Distinguished Name.
- Page 67 Configuring a security policy on the Soft-PK Specify the Key Exchange settings. Select Key Exchange (Phase 2) -> Proposal 1 Figure 4-16. Soft-PK: Key Exchange (Phase 2) -> Proposal 1 fields Š : Select to default to Sidewinder settings. SA Life Unspecified Š...
- Page 68 Configuring a security policy on the Soft-PK 4-18 Installing and Working with Soft-PK...
-
Page 69: Chapter 5: Deploying Soft-Pk To Your End Users
H A P T E R Deploying Soft-PK to Your End Users This chapter summarizes the final preparation steps for deploying the About this chapter Soft-PK software, digital certificate files, and security policy to your end users. It is based on a worksheet that you edit and send to each remote end user. -
Page 70: Overview
Overview Overview You should deploy the Soft-PK installation program with a customized security policy and the necessary digital certificates. Custom installations are designed to make it easy to manage corporate security policies for tens, hundreds, or thousands of end users. Along with the necessary software and files, you should provide specific Soft-PK installation and setup instructions for each end user. - Page 71 Overview Prior to customizing the worksheet, take a few minutes to organize the files and information you need to deploy to your end users. Table 5-1. Organize the files/software for each client (end user) Deployment Notes item Soft-PK software Soft-PK setup.exe file and supporting files. program Digital certificate If deploying Sidewinder self-signed certificates:...
-
Page 72: Customizing The User Worksheet
Customizing the user worksheet Customizing the This section provides summary information about each section in the default UserWorksheet.doc file. user worksheet Specifying dial-up network instructions Figure 5-2 shows the text in the initial UserWorksheet.doc file that pertains to setting up dial-up networking. Delete or change this text as needed for your end user’s particular environment. -
Page 73: Specifying Certificate Import/Request Instructions
Customizing the user worksheet Specifying certificate import/request instructions Figure 5-4 shows the text in the initial UserWorksheet.doc file that pertains to digital certificates. The default text covers a basic instructions for importing certificate files from a disk you provide. Change this text according to how you want users to set up digital certificates (or delete if not using certificates). -
Page 74: Specifying Security Policy Instructions
Customizing the user worksheet Specifying security policy instructions Figure 5-5 shows the text in the initial UserWorksheet.doc file that pertains to the Soft-PK security policy. The default text covers a basic instructions for importing a security policy from a disk you provide. Change this text according to how you want users to set up the security policy. -
Page 75: Appendix A: Troubleshooting
P P E N D I X Troubleshooting This appendix provides a summary of troubleshooting techniques About this appendix available for resolving Soft-PK and Sidewinder VPN connection problems. This appendix addresses the following topics: Š "Soft-PK Log Viewer" on page A-1 Š... -
Page 76: Soft-Pk Connection Monitor
Soft-PK Connection Monitor The following summarizes the tasks you can perform. Button Summary Clear Clears the communications log. IMPORTANT: You cannot retrieve this information once you clear it. Freeze Freezes/Unfreezes the communications log. Because the communications log scrolls through IKE negotiations as they occur, you may need to freeze the log in order to save or print specific messages. -
Page 77: More About The Connection Monitor
Soft-PK Connection Monitor You will see an icon to the left of the connection name: Š indicates that the connection has a Phase 2 IPSec SA, or both a Phase 1 and Phase 2 SA. When there is a single Phase 1 SA to a gateway that is protecting multiple Phase 2 SAs, there will be a single Phase 1 connection with the SA icon and individual Phase 2 connections with the key icon listed above that entry. -
Page 78: Sidewinder Troubleshooting Commands
Sidewinder troubleshooting commands that the selected connection has established SAs. Š To view Authentication (Phase 1) security associations negotiated by IKE, click the Phase 1 tab. Š To view Key Exchange (Phase 2) security associations negotiated by IPSec, click the Phase 2 tab. Sidewinder In addition to standard logging, the Sidewinder also performs auditing of certain system events which allows you to generate information on... - Page 80 Part Number: 86-0935037-A Software Version : Soft-PK 5.1.3 Build 4 and Sideiwnder 5.1.0.02 Product names used within are trademarks of their respective owners. Copyright © 2001 Secure Computing Corporation. All rights reserved.
Need help?
Do you have a question about the ADMINGUIDEREVA and is the answer not in the manual?
Questions and answers