HP Sa3110 - VPN Server Appliance Manuale utente

Hewlett-Packard Company

HP: 5971-0873

P/N: A55307-001

March 2001

hewlett-packard vpn server

appliance sa3110/sa3150/

sa3400/sa3450

network layout reference guide

iii

Disclaimer

DisclaimerDisclaimer

Disclaimer

Information in this document is provided in connection with

Hewlett-Packard Company products. No license, express or

implied, by estoppel or otherwise, to any intellectual property

rights is granted by this document. Except as provided in

Hewlett-Packard Company’s Terms and Conditions of Sale for

such products, Hewlett-Packard Company assumesno liability

whatsoever,and Hewlett-Packard Company disclaims any

express or implied warranty, relating to sale and/or use of

Hewlett-Packard Company products including liability or

warranties relating to fitness for a particular purpose,

merchantability, or infringement of any patent, copyright or

other intellectual property right. Hewlett-Packard Company

products are not intended for use in medical, life saving, or life

sustaining applications.

Hewlett-Packard Companymay make changes to specifications

and product descriptions at any time, without notice.

This

Hewlett-Packard VPN Server Appliance SA3110/SA3150/

SA3400/SA3450 Network Layout Reference Guide

, as well as

the software described in it is furnished underlicense and may

only be used or copied in accordance with the terms of the

license. The information in this manual is furnished for

informationaluse only, is subject to change without notice, and

should not be construed as a commitmentby Hewlett-Packard

Company.Hewlett-PackardCompanyassumesnoresponsibility

or liability for any errors or inaccuracies that may appear in this

document or any software that may be provided inassociation

with this document.

Except as permitted by such license, no part of this document

may be reproduced, stored in a retrieval system, or transmitted

inanyformorbyanymeanswithouttheexpresswrittenconsent

of Hewlett-Packard Company.

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide i

Contents

ContentsContents

Contents

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 NetworkHP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

Layout Reference Guide

Layout Reference GuideLayout Reference Guide

Layout Reference Guide

Network Layout Reference Guide . . .. . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

One-Armed Router Configuration With No Firewall. . . . . . . . . . . . . . . . . . . . . . . . . 2

Inline Router Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

In Parallel With Firewall (Extranet or Intranet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Bridge Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Edge Router Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Behind a Firewall With or Without NAT (One-Armed) . . . . . . . . . . . . . . . . . . . . . 11

Behind a Firewall With or Without NAT (Inline) . . . . . . . . . . . . . . . . . . . . . . . . . . 13

The VPN Device as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (Without NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (With NAT). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Behind a Firewall (One-Armed) With or Without NAT . . . . . . . . . . . . . . . . . . . . . 21

Behind a Firewall That May or May Not Use NAT (Inline) . . . . . . . . . . . . . . . . . . 24

The VPN Device as a Firewall (With or Without NAT) . . . . . . . . . . . . . . . . . . . . . 27

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide 1

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

1Network Layout Reference Guide

Network Layout Reference GuideNetwork Layout Reference Guide

Network Layout Reference Guide

The purpose of this

Network Layout Reference Guide

is to help

you install the HP VPN ServerAppliance SA3110/SA3150/

SA3400/SA3450in your network.The termVPN device isused in

this document to refer to all of these devices.

Here are some real-world examples of how the VPN device can

be incorporated into your network infrastructure. Skim through

the following scenarios and find the ones most similar to your

network configuration. Then, note the corresponding

configuration options to help you quickly install the VPN device

into your network.

Scenarios are divided into client and LAN-to-LAN.

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios • One-armed router configuration (VPN server) with no

firewall

• Inline router configuration

• In parallel with firewall (for extranet or intranet)

• Bridge configuration

• Edge router configuration

• Behind a firewall (one-armed) that may or may not use

network address translation (NAT)

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall

LAN-to-LAN

LAN-to-LANLAN-to-LAN

LAN-to-LAN

Scenarios

ScenariosScenarios

Scenarios • In parallel with a firewall and no NAT

• In parallel with a firewall with NAT

• Behind afirewall (one-armed) that mayor may not use NAT

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall (may or may notuse NAT)

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios

If you are using the VPN device with the HP SA3000 Series VPN

Client, skim the following scenarios and find the ones most

similar to your network configuration. Then, use the

corresponding table of configuration parameters as a guideline

when configuring your VPN device and VPN Client.

If you are using the VPN device in LAN-to-LAN configurations,

skip to the next section “LAN-to-LAN Scenarios.”

One-Armed

One-ArmedOne-Armed

One-Armed

Router

RouterRouter

Router

Configuration

ConfigurationConfiguration

Configuration

With No

With NoWith No

With No

Firewall

FirewallFirewall

Firewall

This scenario shows the following:

• One-armed configuration uses only one of the VPN device’s

two interfaces.

• Firewall is not enabled.

• The VPN device (VPND) acts as a VPN server.

Figure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No FirewallFigure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No Firewall

Configuring a One-Armed Router Configuration

Configuring a One-Armed Router ConfigurationConfiguring a One-Armed Router Configuration

Configuring a One-Armed Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the HP SA3000 Series VPN Manager or command shell.

Desktop

System

Desktop

System

Internal

Network

Internet Router

VPND

Internet

Connection

Direct

Dial

Laser Printer

PSTN

Router or Remote

Access Server

No Firewall

Functions

Router Mode

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 3

To set up a one-armed router configuration, use the

configuration parameters in the following table. Note that the

values of these parametersare examples only; you must enter

values specific to your network.

Table:

Table:Table:

Table: O

One-Armed Router Configuration Parameters

ne-Armed Router Configuration Parametersne-Armed Router Configuration Parameters

ne-Armed Router Configuration Parameters

Inline Router

Inline RouterInline Router

Inline Router

Configuration

ConfigurationConfiguration

Configuration In this scenario, VPN Client traffic is handled either through a

router (inline) or by directly dialing into the public-switched

telephone network (PSTN).

• For inline router configurations:

— The router accepts all incoming client traffic then trans-

fers the traffic to the VPN device.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1: (not used for

one-armed)

IP: NA

Mode: NA

Interface E1: (not used for one-

armed)

IP: NA

Mode: NA

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.2

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

HP SA3000 Series VPN Client

IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

4 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

— The VPN device then transfers the traffic on to the local

network to which it is attached. The VPN device may or

may not perform firewall functions on the traffic.

• For direct dial into the PSTN:

— Traffic may go through a router or remote access server,

which may or may not perform NAT.

— The traffic then goes through the VPN device,which

may or may not perform firewall functions on the

traffic.

Figure: Inline Router Configuration

Figure: Inline Router ConfigurationFigure: Inline Router Configuration

Figure: Inline Router Configuration

Configuring an Inline Router Configuration

Configuring an Inline Router ConfigurationConfiguring an Inline Router Configuration

Configuring an Inline Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the VPN Manager or command shell.

To set up an inline router configuration, use the configuration

parameters in the following table. Note that the values of these

parameters are examples only; you must entervaluesspecific to

your network.

With/Without

Firewall

Functions

Internet Router

Internet Connection

Direct Dial

VPND

Desktop

System

File Server

Laser Printer

PSTN

May/May Not NAT

Router Mode

Internal

Network

Router or

Remote Access Server

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 5

Table:

Table:Table:

Table:

Inline Router Configuration Parameters

Inline Router Configuration ParametersInline Router Configuration Parameters

Inline Router Configuration Parameters

In Parallel With

In Parallel WithIn Parallel With

In Parallel With

Firewall

FirewallFirewall

Firewall

(Extranet or

(Extranet or(Extranet or

(Extranet or

Intranet)

Intranet)Intranet)

Intranet)

In this scenario, VPN Client traffic is handled either through a

router(inline) or by directly dialing in to the PSTN. In addition,

there is a third-party firewall on the network handling firewall

functionality.

• For inline router configurations:

— The router accepts all incoming client traffic, then trans-

fers the traffic to the VPN device.

— The VPN device then transfers the traffic to the local

network to which it is attached.

— The VPN device is in router mode and doesnot perform

firewall functions.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1:

IP: 192.168.10.2 255.255.255.0

Mode: Red

Interface E1:

IP: 210.35.129.2 255.255.255.0

Mode: Red

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.3

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

Altri manuali per Sa3110 - VPN Server Appliance

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali HP Server

HP D7171A - NetServer - LPr Manuale utente

HP ProLiant ML110 Generation 6 (G6) Istruzioni utente

HP ProLiant SL250s Gen8 Manuale utente

HP ProLiant DL385p Gen8 Manuale utente

HP Sa3110 - VPN Server Appliance Manuale del proprietario

HP DL385 - ProLiant - G5 Istruzioni utente

HP ProLiant ML110 G6 Manuale

HP 16 processor Manuale utente

HP ProLiant DL560 Generation9 Istruzioni utente

HP StorageWorks HA-Fabric Manager Manuale utente

HP ProLiant DL370 G6 Manuale utente

HP BL30p - ProLiant - 1 GB RAM Manuale

HP Cisco MDS 8/12c Manuale di istruzioni

HP ProLiant XL250a Gen9 Istruzioni utente

HP ProLiant BL465c G6 Manuale utente

HP t5300 - Thin Client Manuale utente

HP Compaq t5515 Manuale di servizio

HP Compaq t5730 Manuale utente

HP Tc2120 - Server - 256 MB RAM Manuale utente

HP P5389A - Intel Pentium III-S 1.4 GHz Processor... Manuale operativo

HP T5520 - Compaq Thin Client Manuale di servizio

HP ProLiant DL380 Istruzioni utente

HP 850 Unified Wired-WLAN Appliance Manuale utente

HP ML350 - ProLiant - G2 Manuale utente

Manuali Server popolari di altre marche

Dell

Dell PowerEdge R410 Manuale utente

PowerNAS

PowerNAS CMA Manuale utente

Supero

Supero FatTwin F617R3-FT Manuale utente

MSI

MSI P1-109N-L70 Manuale utente

Dell

Dell PowerEdge XE9640 Manuale

Dell

Dell PS4100 Istruzioni di montaggio

EtroVISION

EtroVISION EV3151 Manuale utente

NEC

NEC Express5800/T110j Manuale utente

Compaq

Compaq ProLiant 3000 Manuale

Dell

Dell PowerEdge 3YPMN Manuale utente

iRobo

iRobo IPC2U Manuale utente

Nortel

Nortel 1000 Con?guration guide Manuale utente

Asus

Asus AP7500 Manuale operativo e di manutenzione

Avid Technology

Avid Technology AirSpeed 5000 Manuale utente

Milestone

Milestone Husky IVO 350T Manuale utente

Planet

Planet NAS-7410 Manuale utente

Lenovo

Lenovo ThinkSystem SR635 V3 Manuale utente

Dell

Dell PowerEdge HS5610 Manuale