Hewlett-Packard Company HP: 5971-0872 P/N: A52437-001 March 2001...
Page 3
Except as provided in Hewlett-Packard Company’s Terms and Conditions of Sale for such products, Hewlett-Packard Company assumes no liability whatsoever, and Hewlett-Packard Company disclaims any...
Page 4
Statement of Compliance for the HP VPN Statement of Compliance for the HP VPN Statement of Compliance for the HP VPN Statement of Compliance for the HP VPN Server Appliance SA3110 Server Appliance SA3110 Server Appliance SA3110 Server Appliance SA3110 This product follows the provisions of the European Directive 1999/5/EC.
VPN device. 4. Installing HP SA3000 Series VPN Manager This chapter tells you how to install the VPN Manager software on your PC, create a device list with entries for your Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 10
Viewing the IP configuration • Using Telnet 7. Appendix — Network Infrastructure Checklists This appendix provides checklist tables to complete, to help you gather all your network information together, before you install your VPN device. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
VPN Manager is a graphical tool, based in any Win32 operating system, including Windows 9 x , Windows NT, or Windows 2000, VPN Manager VPN Manager VPN Manager VPN Manager that lets you configure the VPN device. It enables administrators Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 12
IP traffic that the VPN Client is configured to process passes down the tunnel to the opposing VPN device. All other IP activities, such as Web browsing, cannot pass down the tunnel unless the VPN Client determines otherwise. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Windows NT 4.0 (Service Pack 4 or later) running on: — Intel Pentium 90 MHz (minimum) processor or better — At least 5 MB of free disk space — At least 32 MB of RAM • Windows 2000 Professional running on: Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 16
Before You Install — Intel Pentium 133 MHz (minimum) processor or better — 2 GB hard drive with 650 MB minimum free disk space — 64 MB minimum RAM Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Install and configure the Refer to Chapter 4 VPN Manager software Install and configure the Refer to Chapter 5 VPN Client software Related Info Related Info Related Info Related Info Installation Preparation Checklist (page 2-4) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
IPSec, or protocol 99, for access to the device from the Internet and, if you use certificate authentication, provide UDP 10027 for the X.509 certificate authority through your firewall. For information on how to configure your firewall, please contact the manufacturer. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 19
For example, if your internal network is 10.0.0.0 and you assign an incoming address from 192.168.x.x, all internal routers must be configured to send all 192.168.0.0 traffic to the VPN device. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 20
Before You Install Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
6. Run your setup script. 7. Configure Syslog for troubleshooting. 8. Connect your device to the network. Next Step Next Step Next Step Next Step Preparing to Configure a New VPN Device (page 3-2) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
The front panel drops down. 3. Insert the flash card vertically in the flash card receptacle. 4. Close the front panel. 5. Secure the front panel by twisting the lock mechanism counterclockwise. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 25
N is the number of the serial port to which you connected the console cable. 7. Click OK. The COM N Properties window appears. 8. In the Bits per second drop-down menu, select 9600. 9. In the Flow control drop-down menu, select None. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
You now have an active console session and can communicate from your computer to the device. Next Step Next Step Next Step Next Step Setting Up a Basic Routing Mode Configuration on a New Device (page 3-4) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
3. To capture the session to a file, select Transfer, then select Capture Text. 4. In the File menu, select Save. The Save window appears. 5. In the Save in field, select the folder in which you want to keep the session file. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 28
Note: As you enter the password, a row of asterisks (*) appears. When the VPN device accepts the password, the word Passed appears on the screen. Then the name-and-state prompt appears again: hostname:NORMAL# Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 29
Ethernet interface E0. 6. At the prompt, enter the IP address for the black (public) Ethernet interface E1. 7. At the prompt, enter the subnet mask for the black (public) Ethernet interface E1. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 30
Address Resolution Protocol (ARP) to resolve the physical address of the destination IP address. 14. At the prompt, enter ping and the full IP address of the E1 interface: Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 31
The setup script is now complete. The initial configuration is set on the new VPN device. Next Step Next Step Next Step Next Step Using Bridge Mode With the VPN Device (page 3-8) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
192.168.1.1 255.255.255.0 hostname [config] [int e 0]: NORMAL# interface e 1 hostname [config] [int e 1]: NORMAL# ip address 176.16.1.1 255.255.255.0 hostname [config] [int e 1]: NORMAL# end hostname: NORMAL# write 3-10 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 33
2. The ARP request is for an address that has been assigned to a remote user tunnel as a client IP. In router mode, the VPN device does not retransmit broadcast traffic from one interface to another interface. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide 3-11...
Page 34
Used Used Used when the VPN device is going to be connected between an existing firewall and a corporate network (referred to as inline configuration in the Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide ). Note: Note: Note: Note: The mode of operation of the VPN device does not affect the firewall or tunneling functionality of the VPN device.
VPN Manager included on the CD-ROM. Follow the instructions in the next chapter, "Installing VPN Manager." Next Step Next Step Next Step Next Step Configuring Syslog for Troubleshooting (page 3-13) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide 3-13...
"Configuring Syslog." Some examples of customized Syslog usage are: • Setting Syslog to display tunnel messages by entering syslog priority tunnel 7 • Setting Syslog to display certificate messages by entering syslog priority certificate 7 3-14 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 37
Configuring Syslog for Troubleshooting Next Step Next Step Next Step Next Step Installing VPN Manager (page 4-1) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide 3-15...
Page 38
Performing the Initial Hardware Setup 3-16 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
3. Create a device list. 4. Save the device list. 5. Save your VPN device configuration information to a file. Next Step Next Step Next Step Next Step Installing VPN Manager (page 4-2) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
6. To accept the default directory, click Next. Setup adds an icon to the Program Folder. 7. To accept the Hewlett-Packard Company VPN folder name, click Next. The software begins to install. Then a window asks you if you would like to have a shortcut created on your desktop.
Page 43
VPN Manager application starts, and you are prompted for a password when opening the encrypted device list file. Next Step Next Step Next Step Next Step Adding a VPN device With VPN Manager (page 4-4) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
7. In the Password field, enter password . This is the same administrator password that you set when you ran the setup script in the basic routing mode configuration. (See "Setting Up a Basic Routing Mode Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 45
Note: You must create a password for VPN Manager if the Note: Note: Note: following message appears: This network layout has no password. Please enter one in the Configure Manager dialog box. See "Adding a Device" in VPN Manager’s online Help. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 46
Installing HP SA3000 Series VPN Manager Next Step Next Step Next Step Next Step Saving New Device Information to a Configuration File (page 4- Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
5. Enter a file name. 6. Click Save. The file is available immediately for use. Next Step Next Step Next Step Next Step Overview to Installing HP SA3000 Series VPN Client (page 5-1) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 48
Installing HP SA3000 Series VPN Manager Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
• User name • Certificate name • Certificate challenge phrase • Certificate authority name • Certificate authority IP address • Peer host name • Peer IP address Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 52
Before installing the VPN Client, you may want to read some background information to become familiar with firewalls and encryption terminology that you are likely to encounter when using this product. Refer to the Hewlett-Packard Company Virtual Private Networking Concepts Guide , on the software CD- ROM.
11. Unless your system administrator gave you a disk with the VPN Client configuration on it, select No. 12. In the Maximum number of WINS capable tunnels field, select the maximum number of concurrent Windows Internet Working Services (WINS) enabled tunnels you want Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 54
VPN Client. If you do not restart your computer, you cannot use the VPN Client as the virtual network interface card. Next Step Next Step Next Step Next Step Configuring the VPN Client Software for a Basic Tunnel (page 5- Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
7. Select the type of tunnel you want to use. You can choose from a Shiva Smart Tunnel (SST) or an IPSec tunnel. 8. Click Add to add a VPN device/Tunnel Server name and IP address. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 56
10. Select Enable WINS/DNS via VPN device and click OK. You now have created a basic VPN tunnel. For more information on configuring advanced features of the VPN Client, see the online Help file within the VPN Client software. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Capturing a terminal emulation session as text • Viewing a terminal emulation session • Deleting the current VPN device configuration • Reconfiguring the VPN device • Viewing the IP configuration • Using Telnet Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 60
Note: Note: Note: Note: Refer to the Regulatory Statements document included with your serial card for detailed information on installing the serial card. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
File File File File The Hewlett-Packard Company recommends that before you modify the VPN device’s internal hardware, you back up the ISBR.cfg file. You can use the VPN Manager or the TFTP Copy command to back up the ISBR.cfg file.
Page 62
The device prompts: Do you want to reboot... 9. Enter y . The device prompts: Please confirm (y/n) 10. Enter y . The VPN device reboots into production mode, whereby the License Agreement appears. Follow the instructions in this Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 63
To create the new configuration file and restore the advanced settings of your saved ISBR.cfg file: 1. Follow the instructions in this Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide in Chapter 3 in the section entitled "Setting Up a Basic Routing Mode Configuration on a New Device."...
7. From the Console window or the VPN Manager window, issue a reboot command to the device, then press Enter. You are prompted to confirm your reboot command. 8. To confirm your reboot command, enter Y . Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 65
Using the Copy Command (TFTP) The device reboots and the new settings take effect upon restart. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
You return to the Console-HyperTerminal window. 5. To minimize the HyperTerminal screen and leave the program running, click the Minimize icon. You return to your desktop. 6. To close the program, in the File menu, select Exit. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
3. In the File menu, select Open. The Open window appears. 4. In the list box, select the desired session. 5. Click Open. You return to the Notepad window. The selected HyperTerminal session appears. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
When the VPN device accepts the password, the word Passed appears on the screen. 5. The name-and-state prompt appears again: namevpn:NORMAL# 6. At the name-and-state prompt, enter show dir . A directory listing for the VPN device appears. 6-10 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Ensure that the deleted files no longer appear in the list. 4. Leave the terminal emulation program by entering exit . The VPN device is restored to near-factory default condition while retaining the existing passwords. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide 6-11...
DNS server on your network; to step through the DNS servers available on your network, click on the Lookup icon to the right of the DNS servers text Node Enter, 6-12 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 71
Lease Obtained, showing the date and time the lease began for the temporary IP address issued from the pool (this lease actually is measured in seconds, but appears in larger units of time) Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide 6-13...
Page 72
Renews the current TCP/IP binding for the displayed adapter only Release All Releases the current TCP/IP bindings for all adapters so that a new stack can be created Renew All Renews the current TCP/IP binding for all adapters 6-14 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
7. To open Telnet, from the Start menu, select Run, then Telnet. The Run window appears. 8. In the Open field, enter mstelnet.exe. 9. Click OK. The Telnet window appears. 10. In the Terminal menu, select Preferences. The Preferences window appears. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide 6-15...
Page 74
A row of asterisks (*) appears as you enter your password. The status Passed appears. Information concerning the device to which you are connected appears. You are provided with the command line prompt of the destination host. 6-16 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Port Combinations Table ..........A-12 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 76
Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 77
You provide authentication method and Checklists IP address of authentication server. The Port Combinations table at the end of this appendix provides the ports you use, depending upon which protocols you support on your corporate network. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Subnet Mask Subnet Mask Subnet Mask Interface Interface IP Address IP Address Subnet Mask Subnet Mask Interface Interface IP Address IP Address Subnet Mask Subnet Mask Internal External Additional Interface 1 Additional Interface 2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 79
IP address and subnet mask to both Subnet Mask Subnet Mask Subnet Mask Subnet Mask interfaces. Interface Interface Interface Interface IP Address IP Address IP Address IP Address Subnet Mask Subnet Mask Subnet Mask Subnet Mask Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Provide the IP addresses of the interfaces on your existing firewall. Interface Interface Interface Interface Addresses Addresses Addresses Addresses Interface Interface Interface Interface IP Address IP Address IP Address IP Address Internal External Additional 1 Additional 2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
10Base5/thick Ethernet (transceiver required for interface) WAN Cables and WAN Cables and WAN Cables and WAN Cables and Provide the physical type of your WAN: Connectors Connectors Connectors Connectors _______________________________________________________ Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 84
DTE interface, use a DCE adapter cable. • If you connect the VPN device in frame relay bridge mode, it connects a frame relay device (having a DTE interface) with a DSU/CSU (having a DCE interface). Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 85
Network IP Addresses and Addresses and Addresses and Addresses and Subnet Masks Subnet Masks Subnet Masks Subnet Masks IP Addresses IP Addresses IP Addresses IP Addresses Subnet Masks Subnet Masks Subnet Masks Subnet Masks Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 86
Subnet Masks Subnet Masks Network Network Network Network Provide the protocols you run on your network in the following table: Protocols Protocols Protocols Protocols Protocols Protocols Protocols Protocols TCP/IP IPX/SPX NETBEUI AppleTalk Other_________________ A-10 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Security Type Security Type Version Version Security Type Security Type Version Version Users Users Site Site Users Users Site Site Certificate Authority Challenge Phrases SecurID RADIUS NT Domain Other 1 Other 2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide A-11...
Out: 10025 encrypted management packets between the HP SA3000 Series VPN Manager and the VPN device. You should not open this firewall rule unless the VPN Manager is running outside the firewall. A-12 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide...
Page 89
VPN Manager is running outside the firewall. In: 10027 These packets are Out: 10027 certificate requests between the certificate authority server and a VPN device or HP client. Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Installation Guide A-13...
Page 91
Index Index Index Index IndexIndex HP SA3000 Series VPN Manager ........functions of A A A A ........installing ......administrator password ........HyperTerminal B B B B I I I I ........bridge mode 3-10 initial session ........establishing C C C C installation cables...
Page 92
........using Telnet 6-15 ..required components, VPN device ....requirements, for installing restoring factory-default settings ........passwords ........VPN device 6-11 ........router mode 3-10 S S S S ..........safe mode setup script .......... running ......software requirements Syslog ..