Administration HiPath 3000/5000 V7 IP systems

3000sb4.fm
HiPath 3000/5000 in the LAN Network For internal use only
HG 1500 V3.0
Since a gateway in insecure mode would represent a weak point in the VPN, it must be placed
in secure mode before the VPN can be configured. This requires a certain degree of effort to
prevent any hackers from getting into the system during this phase of the process and undermining
the subsequent steps taken.
The following steps must be taken for the gateway to be in secure mode:
1. Connect a terminal (or a PC with a terminal emulation program) to the V.24 interface of the
gateway.
2. Restart the gateway with the CLI command reset secure. When this is done, all user
settings are lost and all user data transmissions are interrupted until the gateway is reconfigured.
At this point, the gateway is in "activation of SSL" mode. In this mode it can only be configured
using CLI at the V.24 interface – WBM, Telnet, HiPath 3000 Manager E and SNMP
are disabled.
3. The gateway must be set up for SSL mode. First, the CLI command create SSL certificate
must be used to generate a server certificate with which the gateway can identify
itself to SSL clients. After that, SSL can be activated with the enable ssl command.
At this point, the gateway is in "secure administration" mode and can only be configured
using CLI at the V.24 interface or WBM via HTTPS – Telnet, HiPath 3000 Manager E and
SNMP are disabled.
4. Start the browser for access to WBM and enter the gateway address with the protocol "https://"
(you can enter the port number "443" after the gateway address). The browser displays
the previously configured server certificate which must be manually checked and approved.
It can now also be installed in the browser to avoid future requests for it.
Use WBM to set up the VPN as described in the following section.
4.5.10.2 Security Policy
The security policy determines the procedure for IP packets. The following actions are possible:
● rejecting
● forwarding (normal routing without VPN functionality)
● tunneling (forwarding over the VPN)
The handling of IP packets can be specified in the HG 1500 V3.0 according to IP address, port
number and protocol (TCP or UDP). For tunneled packets, you must determine:
● which algorithms for encryption and authentication are permissible on the connection,
● the period of validity for the security association.
P31003-H3570-Y100-4-7618, 2007-10-31
4-40 HiPath 3000/5000 V7, System Description