HP Sa3110 - VPN Server Appliance Manuale utente

Hewlett-Packard Company

HP: 5971-0873

P/N: A55307-001

March 2001

hewlett-packard vpn server

appliance sa3110/sa3150/

sa3400/sa3450

network layout reference guide

iii

Disclaimer

DisclaimerDisclaimer

Disclaimer

Information in this document is provided in connection with

Hewlett-Packard Company products. No license, express or

implied, by estoppel or otherwise, to any intellectual property

rights is granted by this document. Except as provided in

Hewlett-Packard Company’s Terms and Conditions of Sale for

such products, Hewlett-Packard Company assumesno liability

whatsoever,and Hewlett-Packard Company disclaims any

express or implied warranty, relating to sale and/or use of

Hewlett-Packard Company products including liability or

warranties relating to fitness for a particular purpose,

merchantability, or infringement of any patent, copyright or

other intellectual property right. Hewlett-Packard Company

products are not intended for use in medical, life saving, or life

sustaining applications.

Hewlett-Packard Companymay make changes to specifications

and product descriptions at any time, without notice.

This

Hewlett-Packard VPN Server Appliance SA3110/SA3150/

SA3400/SA3450 Network Layout Reference Guide

, as well as

the software described in it is furnished underlicense and may

only be used or copied in accordance with the terms of the

license. The information in this manual is furnished for

informationaluse only, is subject to change without notice, and

should not be construed as a commitmentby Hewlett-Packard

Company.Hewlett-PackardCompanyassumesnoresponsibility

or liability for any errors or inaccuracies that may appear in this

document or any software that may be provided inassociation

with this document.

Except as permitted by such license, no part of this document

may be reproduced, stored in a retrieval system, or transmitted

inanyformorbyanymeanswithouttheexpresswrittenconsent

of Hewlett-Packard Company.

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide i

Contents

ContentsContents

Contents

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 NetworkHP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network

Layout Reference Guide

Layout Reference GuideLayout Reference Guide

Layout Reference Guide

Network Layout Reference Guide . . .. . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Client Scenarios . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

One-Armed Router Configuration With No Firewall. . . . . . . . . . . . . . . . . . . . . . . . . 2

Inline Router Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

In Parallel With Firewall (Extranet or Intranet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Bridge Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Edge Router Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Behind a Firewall With or Without NAT (One-Armed) . . . . . . . . . . . . . . . . . . . . . 11

Behind a Firewall With or Without NAT (Inline) . . . . . . . . . . . . . . . . . . . . . . . . . . 13

The VPN Device as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (Without NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

In Parallel With a Firewall (With NAT). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Behind a Firewall (One-Armed) With or Without NAT . . . . . . . . . . . . . . . . . . . . . 21

Behind a Firewall That May or May Not Use NAT (Inline) . . . . . . . . . . . . . . . . . . 24

The VPN Device as a Firewall (With or Without NAT) . . . . . . . . . . . . . . . . . . . . . 27

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide 1

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

1Network Layout Reference Guide

Network Layout Reference GuideNetwork Layout Reference Guide

Network Layout Reference Guide

The purpose of this

Network Layout Reference Guide

is to help

you install the HP VPN ServerAppliance SA3110/SA3150/

SA3400/SA3450in your network.The termVPN device isused in

this document to refer to all of these devices.

Here are some real-world examples of how the VPN device can

be incorporated into your network infrastructure. Skim through

the following scenarios and find the ones most similar to your

network configuration. Then, note the corresponding

configuration options to help you quickly install the VPN device

into your network.

Scenarios are divided into client and LAN-to-LAN.

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios • One-armed router configuration (VPN server) with no

firewall

• Inline router configuration

• In parallel with firewall (for extranet or intranet)

• Bridge configuration

• Edge router configuration

• Behind a firewall (one-armed) that may or may not use

network address translation (NAT)

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall

LAN-to-LAN

LAN-to-LANLAN-to-LAN

LAN-to-LAN

Scenarios

ScenariosScenarios

Scenarios • In parallel with a firewall and no NAT

• In parallel with a firewall with NAT

• Behind afirewall (one-armed) that mayor may not use NAT

• Behind a firewall (inline) that may or may not use NAT

• VPN device as a firewall (may or may notuse NAT)

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

Client Scenarios

Client ScenariosClient Scenarios

Client Scenarios

If you are using the VPN device with the HP SA3000 Series VPN

Client, skim the following scenarios and find the ones most

similar to your network configuration. Then, use the

corresponding table of configuration parameters as a guideline

when configuring your VPN device and VPN Client.

If you are using the VPN device in LAN-to-LAN configurations,

skip to the next section “LAN-to-LAN Scenarios.”

One-Armed

One-ArmedOne-Armed

One-Armed

Router

RouterRouter

Router

Configuration

ConfigurationConfiguration

Configuration

With No

With NoWith No

With No

Firewall

FirewallFirewall

Firewall

This scenario shows the following:

• One-armed configuration uses only one of the VPN device’s

two interfaces.

• Firewall is not enabled.

• The VPN device (VPND) acts as a VPN server.

Figure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No FirewallFigure: One-Armed Configuration With No Firewall

Figure: One-Armed Configuration With No Firewall

Configuring a One-Armed Router Configuration

Configuring a One-Armed Router ConfigurationConfiguring a One-Armed Router Configuration

Configuring a One-Armed Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the HP SA3000 Series VPN Manager or command shell.

Desktop

System

Desktop

System

Internal

Network

Internet Router

VPND

Internet

Connection

Direct

Dial

Laser Printer

PSTN

Router or Remote

Access Server

No Firewall

Functions

Router Mode

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 3

To set up a one-armed router configuration, use the

configuration parameters in the following table. Note that the

values of these parametersare examples only; you must enter

values specific to your network.

Table:

Table:Table:

Table: O

One-Armed Router Configuration Parameters

ne-Armed Router Configuration Parametersne-Armed Router Configuration Parameters

ne-Armed Router Configuration Parameters

Inline Router

Inline RouterInline Router

Inline Router

Configuration

ConfigurationConfiguration

Configuration In this scenario, VPN Client traffic is handled either through a

router (inline) or by directly dialing into the public-switched

telephone network (PSTN).

• For inline router configurations:

— The router accepts all incoming client traffic then trans-

fers the traffic to the VPN device.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1: (not used for

one-armed)

IP: NA

Mode: NA

Interface E1: (not used for one-

armed)

IP: NA

Mode: NA

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.2

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

HP SA3000 Series VPN Client

IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

4 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide

— The VPN device then transfers the traffic on to the local

network to which it is attached. The VPN device may or

may not perform firewall functions on the traffic.

• For direct dial into the PSTN:

— Traffic may go through a router or remote access server,

which may or may not perform NAT.

— The traffic then goes through the VPN device,which

may or may not perform firewall functions on the

traffic.

Figure: Inline Router Configuration

Figure: Inline Router ConfigurationFigure: Inline Router Configuration

Figure: Inline Router Configuration

Configuring an Inline Router Configuration

Configuring an Inline Router ConfigurationConfiguring an Inline Router Configuration

Configuring an Inline Router Configuration

When setting up a VPN device, you must configure many global

configuration settings. You configure the VPN device through

the VPN Manager or command shell.

To set up an inline router configuration, use the configuration

parameters in the following table. Note that the values of these

parameters are examples only; you must entervaluesspecific to

your network.

With/Without

Firewall

Functions

Internet Router

Internet Connection

Direct Dial

VPND

Desktop

System

File Server

Laser Printer

PSTN

May/May Not NAT

Router Mode

Internal

Network

Router or

Remote Access Server

VPN Client

Client Scenarios

Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 5

Table:

Table:Table:

Table:

Inline Router Configuration Parameters

Inline Router Configuration ParametersInline Router Configuration Parameters

Inline Router Configuration Parameters

In Parallel With

In Parallel WithIn Parallel With

In Parallel With

Firewall

FirewallFirewall

Firewall

(Extranet or

(Extranet or(Extranet or

(Extranet or

Intranet)

Intranet)Intranet)

Intranet)

In this scenario, VPN Client traffic is handled either through a

router(inline) or by directly dialing in to the PSTN. In addition,

there is a third-party firewall on the network handling firewall

functionality.

• For inline router configurations:

— The router accepts all incoming client traffic, then trans-

fers the traffic to the VPN device.

— The VPN device then transfers the traffic to the local

network to which it is attached.

— The VPN device is in router mode and doesnot perform

firewall functions.

NAT by Router

NAT by RouterNAT by Router

NAT by Router No NAT

No NATNo NAT

No NAT

Interface E0:

IP: 10.250.128.2 255.255.255.0

Mode: Red

Interface E0:

IP: 205.25.128.2 255.255.255.0

Mode: Red

Interface E1:

IP: 192.168.10.2 255.255.255.0

Mode: Red

Interface E1:

IP: 210.35.129.2 255.255.255.0

Mode: Red

Configuration file entries/

routing info:

security profile remote user

remote tunnel johndoe

security-profile remote

user

client-ip 10.250.128.3

255.255.255.255

Configuration file entries/routing

info:

security profile remote user

remote tunnel johndoe

security-profile remote user

ip route 209.29.128.50

255.255.255.255 john doe

VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no

client IP)

Subnet: 10.250.128.0 (net-

include) Subnet: 205.25.128.0 (net-include)

ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

Altri manuali per Sa3110 - VPN Server Appliance

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali HP Server

HP 2533t - Compaq Mobile Thin Client Manuale utente

HP A4500A - VMEbus Single Board Computer 744... Manuale utente

HP Integrity rx2660 Manuale utente

HP ProLiant series Manuale utente

HP D7171A - NetServer - LPr Manuale utente

HP t5400 - Thin Client Manuale utente

HP NetServer LC 3 Manuale utente

HP Integrity rx5670 Manuale

HP 9000 Integrity rp8440 Manuale utente

HP rp4410 Manuale utente

HP ProLiant BL e-Class Manuale

HP DesignJet T610 Manuale utente

HP ProLiant TM200 Manuale

HP ProBook 4320t Manuale

HP DL360 - ProLiant - Photon Manuale utente

HP 850 Unified Wired-WLAN Appliance Manuale utente

HP Dl180 - G6 E5504 2X2gb 4Lff Svr Guida di riferimento rapido

HP Proliant DL580 Istruzioni utente

HP ProLiant M800 Istruzioni operative

HP Integrity rx4640 Manuale di installazione e funzionamento

HP Proliant DL580 Manuale utente

HP rp8420 Guida all'installazione

HP Integrity NonStop i NS2300 Manuale tecnico

HP ProLiant ML310 Generation 5p Istruzioni utente

Manuali Server popolari di altre marche

Dell

Dell PowerEdge R410 Manuale utente

PowerNAS

PowerNAS CMA Manuale utente

Supero

Supero FatTwin F617R3-FT Manuale utente

MSI

MSI P1-109N-L70 Manuale utente

Dell

Dell PowerEdge XE9640 Manuale

Dell

Dell PS4100 Istruzioni di montaggio

EtroVISION

EtroVISION EV3151 Manuale utente

NEC

NEC Express5800/T110j Manuale utente

Compaq

Compaq ProLiant 3000 Manuale

Dell

Dell PowerEdge 3YPMN Manuale utente

iRobo

iRobo IPC2U Manuale utente

Nortel

Nortel 1000 Con?guration guide Manuale utente

Asus

Asus AP7500 Manuale operativo e di manutenzione

Avid Technology

Avid Technology AirSpeed 5000 Manuale utente

Milestone

Milestone Husky IVO 350T Manuale utente

Planet

Planet NAS-7410 Manuale utente

Lenovo

Lenovo ThinkSystem SR635 V3 Manuale utente

Dell

Dell PowerEdge HS5610 Manuale