HP Sa3110 - VPN Server Appliance Manuel utilisateur

Hewlett-Packard Company

HP: 5971-0873

P/N: A55307-001

March 2001

hewlett-packard vpn server

appliance sa3110/sa3150/

sa3400/sa3450

network layout reference guide

iii

Disclaimer

DisclaimerDisclaimer

Disclaimer

Information in this document is provided in connection with

Hewlett-Packard Company products. No license, express or

implied, by estoppel or otherwise, to any intellectual property

rights is granted by this document. Except as provided in

Hewlett-Packard Company’s Terms and Conditions of Sale for

such products, Hewlett-Packard Company assumesno liability

whatsoever,and Hewlett-Packard Company disclaims any

express or implied warranty, relating to sale and/or use of

Hewlett-Packard Company products including liability or

warranties relating to fitness for a particular purpose,

merchantability, or infringement of any patent, copyright or

other intellectual property right. Hewlett-Packard Company

products are not intended for use in medical, life saving, or life

sustaining applications.

Hewlett-Packard Companymay make changes to specifications

and product descriptions at any time, without notice.

This

Hewlett-Packard VPN Server Appliance SA3110/SA3150/

SA3400/SA3450 Network Layout Reference Guide

, as well as

the software described in it is furnished underlicense and may

only be used or copied in accordance with the terms of the

license. The information in this manual is furnished for

informationaluse only, is subject to change without notice, and

should not be construed as a commitmentby Hewlett-Packard

Company.Hewlett-PackardCompanyassumesnoresponsibility

or liability for any errors or inaccuracies that may appear in this

document or any software that may be provided inassociation

with this document.

Except as permitted by such license, no part of this document

may be reproduced, stored in a retrieval system, or transmitted

inanyformorbyanymeanswithouttheexpresswrittenconsent

of Hewlett-Packard Company.

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide i

Contents

ContentsContents

Contents

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 NetworkHP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

Layout Reference Guide

Layout Reference GuideLayout Reference Guide

Layout Reference Guide

Network Layout Reference Guide . . .. . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

One-Armed Router Configuration With No Firewall. . . . . . . . . . . . . . . . . . . . . . . . . 2

Inline Router Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

In Parallel With Firewall (Extranet or Intranet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Bridge Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Edge Router Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Behind a Firewall With or Without NAT (One-Armed) . . . . . . . . . . . . . . . . . . . . . 11

Behind a Firewall With or Without NAT (Inline) . . . . . . . . . . . . . . . . . . . . . . . . . . 13

The VPN Device as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (Without NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (With NAT). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Behind a Firewall (One-Armed) With or Without NAT . . . . . . . . . . . . . . . . . . . . . 21

Behind a Firewall That May or May Not Use NAT (Inline) . . . . . . . . . . . . . . . . . . 24

The VPN Device as a Firewall (With or Without NAT) . . . . . . . . . . . . . . . . . . . . . 27

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide 1

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

1Network Layout Reference Guide

Network Layout Reference GuideNetwork Layout Reference Guide

Network Layout Reference Guide

The purpose of this

Network Layout Reference Guide

is to help

you install the HP VPN ServerAppliance SA3110/SA3150/

SA3400/SA3450in your network.The termVPN device isused in

this document to refer to all of these devices.

Here are some real-world examples of how the VPN device can

be incorporated into your network infrastructure. Skim through

the following scenarios and find the ones most similar to your

network configuration. Then, note the corresponding

configuration options to help you quickly install the VPN device

into your network.

Scenarios are divided into client and LAN-to-LAN.

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios • One-armed router configuration (VPN server) with no

firewall

• Inline router configuration

• In parallel with firewall (for extranet or intranet)

• Bridge configuration

• Edge router configuration

• Behind a firewall (one-armed) that may or may not use

network address translation (NAT)

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall

LAN-to-LAN

LAN-to-LANLAN-to-LAN

LAN-to-LAN

Scenarios

ScenariosScenarios

Scenarios • In parallel with a firewall and no NAT

• In parallel with a firewall with NAT

• Behind afirewall (one-armed) that mayor may not use NAT

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall (may or may notuse NAT)

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios

If you are using the VPN device with the HP SA3000 Series VPN

Client, skim the following scenarios and find the ones most

similar to your network configuration. Then, use the

corresponding table of configuration parameters as a guideline

when configuring your VPN device and VPN Client.

If you are using the VPN device in LAN-to-LAN configurations,

skip to the next section “LAN-to-LAN Scenarios.”

One-Armed

One-ArmedOne-Armed

One-Armed

Router

RouterRouter

Router

Configuration

ConfigurationConfiguration

Configuration

With No

With NoWith No

With No

Firewall

FirewallFirewall

Firewall

This scenario shows the following:

• One-armed configuration uses only one of the VPN device’s

two interfaces.

• Firewall is not enabled.

• The VPN device (VPND) acts as a VPN server.

Figure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No FirewallFigure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No Firewall

Configuring a One-Armed Router Configuration

Configuring a One-Armed Router ConfigurationConfiguring a One-Armed Router Configuration

Configuring a One-Armed Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the HP SA3000 Series VPN Manager or command shell.

Desktop

System

Desktop

System

Internal

Network

Internet Router

VPND

Internet

Connection

Direct

Dial

Laser Printer

PSTN

Router or Remote

Access Server

No Firewall

Functions

Router Mode

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 3

To set up a one-armed router configuration, use the

configuration parameters in the following table. Note that the

values of these parametersare examples only; you must enter

values specific to your network.

Table:

Table:Table:

Table: O

One-Armed Router Configuration Parameters

ne-Armed Router Configuration Parametersne-Armed Router Configuration Parameters

ne-Armed Router Configuration Parameters

Inline Router

Inline RouterInline Router

Inline Router

Configuration

ConfigurationConfiguration

Configuration In this scenario, VPN Client traffic is handled either through a

router (inline) or by directly dialing into the public-switched

telephone network (PSTN).

• For inline router configurations:

— The router accepts all incoming client traffic then trans-

fers the traffic to the VPN device.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1: (not used for

one-armed)

IP: NA

Mode: NA

Interface E1: (not used for one-

armed)

IP: NA

Mode: NA

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.2

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

HP SA3000 Series VPN Client

IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

4 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

— The VPN device then transfers the traffic on to the local

network to which it is attached. The VPN device may or

may not perform firewall functions on the traffic.

• For direct dial into the PSTN:

— Traffic may go through a router or remote access server,

which may or may not perform NAT.

— The traffic then goes through the VPN device,which

may or may not perform firewall functions on the

traffic.

Figure: Inline Router Configuration

Figure: Inline Router ConfigurationFigure: Inline Router Configuration

Figure: Inline Router Configuration

Configuring an Inline Router Configuration

Configuring an Inline Router ConfigurationConfiguring an Inline Router Configuration

Configuring an Inline Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the VPN Manager or command shell.

To set up an inline router configuration, use the configuration

parameters in the following table. Note that the values of these

parameters are examples only; you must entervaluesspecific to

your network.

With/Without

Firewall

Functions

Internet Router

Internet Connection

Direct Dial

VPND

Desktop

System

File Server

Laser Printer

PSTN

May/May Not NAT

Router Mode

Internal

Network

Router or

Remote Access Server

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 5

Table:

Table:Table:

Table:

Inline Router Configuration Parameters

Inline Router Configuration ParametersInline Router Configuration Parameters

Inline Router Configuration Parameters

In Parallel With

In Parallel WithIn Parallel With

In Parallel With

Firewall

FirewallFirewall

Firewall

(Extranet or

(Extranet or(Extranet or

(Extranet or

Intranet)

Intranet)Intranet)

Intranet)

In this scenario, VPN Client traffic is handled either through a

router(inline) or by directly dialing in to the PSTN. In addition,

there is a third-party firewall on the network handling firewall

functionality.

• For inline router configurations:

— The router accepts all incoming client traffic, then trans-

fers the traffic to the VPN device.

— The VPN device then transfers the traffic to the local

network to which it is attached.

— The VPN device is in router mode and doesnot perform

firewall functions.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1:

IP: 192.168.10.2 255.255.255.0

Mode: Red

Interface E1:

IP: 210.35.129.2 255.255.255.0

Mode: Red

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.3

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

Autres manuels pour Sa3110 - VPN Server Appliance

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels HP Serveur

HP D7171A - NetServer - LPr Manuel utilisateur

HP Integrity BL890c - i2 Server Guide de démarrage rapide

HP StoreOnce 4900 Backup Guide d'installation et d'utilisation

HP ProLiant DL140 Manuel

HP DL385 - ProLiant - G5 Manuel utilisateur

HP D7171A - NetServer - LPr Manuel utilisateur

HP D7171A - NetServer - LPr Manuel

HP ML370 - ProLiant - G3 Guide d'installation

HP HP-UX 11i v2 Instructions d'installation

HP ProLiant SL4545 Mode d’emploi

HP ML570 - ProLiant - G2 Instructions d'utilisation

HP 9000 A-180 Manuel utilisateur

HP Integrity rx1620 Guide de démarrage rapide

HP Compaq t5515 Manuel de service

HP P5389A - Intel Pentium III-S 1.4 GHz Processor... Manuel utilisateur

HP ML530 - ProLiant - 128 MB RAM Guide de référence

HP Tc4100 - Server - 256 MB RAM Manuel utilisateur

HP 9000 Series Manuel utilisateur

HP Integrity BL860c Instructions d'utilisation

HP ProLiant XL730f Gen9 Server Mode d'emploi

HP ProLiant DL120 G7 Manuel utilisateur

HP ProLiant DL185 Generation 5 Manuel

HP T5720 - Compaq Thin Client Manuel d'utilisation et d'entretien

HP ProLiant Gen10 Manuel utilisateur

Manuels Serveur populaires d'autres marques

Dell

Dell PowerEdge R410 Manuel utilisateur

PowerNAS

PowerNAS CMA Manuel utilisateur

Supero

Supero FatTwin F617R3-FT Manuel utilisateur

MSI

MSI P1-109N-L70 Manuel utilisateur

Dell

Dell PowerEdge XE9640 Manuel

Dell

Dell PS4100 Instructions de montage

EtroVISION

EtroVISION EV3151 Manuel utilisateur

NEC

NEC Express5800/T110j Manuel utilisateur

Compaq

Compaq ProLiant 3000 Manuel

Dell

Dell PowerEdge 3YPMN Manuel utilisateur

iRobo

iRobo IPC2U Manuel utilisateur

Nortel

Nortel 1000 Con?guration guide Manuel utilisateur

Asus

Asus AP7500 Manuel d'utilisation et d'entretien

Avid Technology

Avid Technology AirSpeed 5000 Manuel utilisateur

Milestone

Milestone Husky IVO 350T Manuel utilisateur

Planet

Planet NAS-7410 Manuel utilisateur

Lenovo

Lenovo ThinkSystem SR635 V3 Manuel utilisateur

Dell

Dell PowerEdge HS5610 Manuel