Nokia IP45 User Manual

Download

IP45 Security Platform

User’s Guide

Version 4.0

Part Number: N450000261 Rev. 001

December 2006

RESTRICTED RIGHTS LEGEND

Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013.

Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software, the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted Rights clause at FAR 52.227-19.

IMPORTANT NOTE TO USERS

This software and hardware is provided by Nokia Inc. as is and any express or implied warranties, including, but not limited to, implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.

Nokia reserves the right to make changes without further notice to any products herein.

TRADEMARKS

Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document are trademarks or registered trademarks of their respective holders.

060101

2 Nokia IP45 Security Platform User’s Guide v4.0

Nokia Contact Information

Corporate Headquarters

Web Site http://www.nokia.com

Telephone 1-888-477-4566 or

Fax 1-650-691-2170

Mail Address

Regional Contact Information

1-650-625-2000

Nokia Inc. 313 Fairchild Drive Mountain View, California 94043-2215 USA

Americas Nokia Inc.

Europe, Middle East, and Africa

Asia-Pacific 438B Alexandra Road

Nokia Customer Support

Web Site: https://support.nokia.com/

Email: tac.support@nokia.com

Americas Europe

Voi ce: 1-888-361-5030 or

Fax: 1-613-271-8782 Fax: +44 (0) 125-286-5666

Asia-Pacific

Voi ce: +65-67232999

Fax: +65-67232897

313 Fairchild Drive Mountain View, CA 94043-2215 USA

Nokia House, Summit Avenue Southwood, Farnborough Hampshire GU14 ONG UK

#07-00 Alexandra Technopark Singapore 119968

1-613-271-6721

Tel: 1-877-997-9199 Outside USA and Canada: +1 512-437-7089 email: info.ipnetworking_americas@nokia.com

Tel: UK: +44 161 601 8908 Tel: France: +33 170 708 166 email: info.ipnetworking_emea@nokia.com

Tel: +65 6588 3364 email: info.ipnetworking_apac@nokia.com

Voi ce: +44 (0) 125-286-8900

050602

Nokia IP45 Security Platform User’s Guide v4.0 3

4 Nokia IP45 Security Platform User’s Guide v4.0

About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

In this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Conventions this Guide uses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Command-Line Conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Text Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Menu Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Related Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

About the Nokia IP45 Security Platform. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Nokia IP45 Tele 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Nokia IP45 Satellite 16, Satellite 32, Satellite Unlimited . . . . . . . . . . . . . . . . . . . . 22

Nokia IP45 Security Platform Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

VPN Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Security Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Diagnostics and Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Network Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Nokia IP45 Security Platform Rear Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Nokia IP45 Security Platform Front Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

2 Installing the Nokia IP45 Security Platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Before you Install the Nokia IP45 Security Platform. . . . . . . . . . . . . . . . . . . . . . . . . 37

Setting Up the Nokia IP45 Security Platform with

Microsoft Windows 98 or Millennium Operating Systems . . . . . . . . . . . . . . . . . . . . 38

Setting Up the Nokia IP45 Security Platform with

Microsoft Windows XP and 2000 Operating Systems . . . . . . . . . . . . . . . . . . . . . . . 43

Setting Up the Nokia IP45 Security Platform with an Apple Computer . . . . . . . . . . 47

Connecting the Nokia IP45 Security Platform to the Network . . . . . . . . . . . . . . . . 47

Installing your Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Nokia IP45 Security Platform User’s Guide v4.0 5

3 Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

First-Time Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Configuring the Nokia IP45 Security Platform for Internet Connection . . . . . . . . . . 50

Making Initial Nokia IP45 Security Platform Settings . . . . . . . . . . . . . . . . . . . . . . . 51

Setting the Nokia IP45 Security Platform Time . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Registering with the Nokia Support Site. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Connecting to a Central Management Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Logging On to the Nokia IP45 Security Platform . . . . . . . . . . . . . . . . . . . . . . . . . 55

Accessing Nokia IP45 Securely . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Logging Off from the Nokia IP45 Security Platform . . . . . . . . . . . . . . . . . . . . . . . 58

Understanding the Nokia IP45 Web GUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Using the Nokia IP45 Security Platform Web-based User Interface . . . . . . . . . . 60

Graphical User Interface Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

4 Accessing the Nokia IP45 Security Platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Connection Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Configuration Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Connecting the Nokia IP45 Security Platform

to a Computer by Using the Console Port. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

Using Telnet to Connect to the Nokia IP45 Security Platform . . . . . . . . . . . . . . . 68

Enabling and Disabling Telnet Access to Nokia IP45 . . . . . . . . . . . . . . . . . . . . 69

Using Secure Shell to Connect to the Nokia IP45 Security Platform . . . . . . . . . . 70

Accessing Nokia IP45 with HTTP and HTTPS. . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Managing Large Scale Deployments of Nokia IP45 . . . . . . . . . . . . . . . . . . . . . . . . 70

Deploying the Nokia IP45 Security Platform with the Nokia Horizon Manager . . 71 Deploying the Nokia IP45 Security Platform with the

Check Point SmartCenter Large Scale Manager . . . . . . . . . . . . . . . . . . . . . . . 71

Deploying Nokia IP45 with SofaWare Management Portal . . . . . . . . . . . . . . . . . 71

5 Connecting to the Internet with the Nokia IP45 Security Platform . . . . . . . . . . 73

Configuring an Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Using the Setup Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Cable Modem Connection Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

MAC Cloning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Cloning a MAC Address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Manually Configuring the Internet Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Dial-Up PPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Configuring Dial-Up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Using the GUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Configuring Dial-up Setting by Using the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Multiple Dial-up Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Enabling or Disabling the Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Using Quick Internet Connect or Disconnect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

6 Nokia IP45 Security Platform User’s Guide v4.0

Configuring a Backup Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Viewing Internet Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Detecting Dead Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

6 Managing your Local Area Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

Configuring Network Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

Enabling and Disabling the DHCP Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

Customizing DHCP Server Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

Configuring a DMZ Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Configuring OfficeMode Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

VLAN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Tag-Based VLANs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Configuring a VLAN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Deleting a VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

Configuring DHCP Relay. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Backing Up DHCP Relay. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Backing Up DHCP Relay by Using CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Changing IP Addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Configuring Network Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Configuring Static NAT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Editing Static NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

Viewing Static NAT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

Deleting Static NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Configuring DHCP Reservation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Deleting Network Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Configuring Static Routes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

Configuring Source Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Managing Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Defining the Port Link Speed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

Viewing Ports Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

7 Quality of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

About QoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

Using Traffic Shaper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

QoS Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Default QoS Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

Enabling QoS Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

Adding QoS Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Editing and Deleting QoS Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

8 Setting Up the Nokia IP45 Security Platform Security Policy . . . . . . . . . . . . . 135

VStream Embedded Antivirus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Nokia IP45 Security Platform User’s Guide v4.0 7

Features Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

VStream Antivirus Actions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

Enabling and Disabling VStream Antivirus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Viewing VStream Signature Database Information . . . . . . . . . . . . . . . . . . . . . . 138

Configuring VStream Antivirus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Configuring the antivirus policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Configuring the advanced settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Updating VStream Antivirus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Setting the Firewall Security Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Configuring Virtual Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Customizing the Nokia IP45 Security Platform

Security Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Creating Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Allow and Block Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

Deleting and Editing Firewall Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Viewing the Rules Log for Accepted Connections . . . . . . . . . . . . . . . . . . . . . 157

Editing or Deleting an Exposed Host. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

SmartDefense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

SmartDefense Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Restoring Default Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Configuring SmartDefense. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Denial of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

IP and ICMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

TCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

Port Scan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

FTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

HTTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

Microsoft Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

IGMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

Peer to Peer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

Instant Messaging Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Secure HotSpot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Enabling Secure HotSpot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

9 Configuring Network Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

Changing your Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

Adding Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Adding Guest HotSpot Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Viewing and Editing Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Deleting Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Setting Up Remote VPN Access for Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Using RADIUS Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

8 Nokia IP45 Security Platform User’s Guide v4.0

RADIUS Vendor Specific Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

Telnet Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Secure Shell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Configuring SSH. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Enabling or Disabling SSH Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

SSH Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Using SSH Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Configuring Advanced Secure Shell Server Options. . . . . . . . . . . . . . . . . . . . . . 204

Configuring Server Authentication of Users . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Configuring and Managing SSH Key Pairs . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Managing Authorized Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Secure Socket Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Enabling HTTPS Web Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Generating a Self-Signed Certificate and Private Key by Using the CLI. . . . . . . 207

Installing a Certificate and Private Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

Viewing Certificate Fingerprint Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

10 Configuring and Monitoring SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

SNMP Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

SNMP Configuration from the Nokia IP45 Security Platform . . . . . . . . . . . . . . . 209

Setting Up SNMP Access to the Nokia IP45 Security Platform. . . . . . . . . . . . . . 209

Configuring the SNMP Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

Configuring SNMP Parameters from the Command-Line Interface . . . . . . . . . . 212

Setting SNMP Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Viewing SNMP Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

11 High-Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

High-Availability Sample Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Configuring Multiple HA Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

Configuring High-Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

Configuring High-Availability by Using the GUI . . . . . . . . . . . . . . . . . . . . . . . . . . 216

High-Availability over VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Dual Homing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Configuring for Dual Homing ISP Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Configuring ISP Dial-Up Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Generic High-Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Advanced High-Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Route-Based VPN and BGP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Border Gateway Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222

Configuring the BGP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

High-Availability Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

High-Availability Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228

Nokia IP45 Security Platform User’s Guide v4.0 9

High-Availability Solutions with a Single Nokia IP45 Device. . . . . . . . . . . . . . 229

High-Availability Solutions with Dual Nokia IP45 Devices. . . . . . . . . . . . . . . . 229

Generic HA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

HA Coupled With BGP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

12 Configuring Nokia IP45 Through

Out-of-Band Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

Configuring OOB from the Nokia IP45

Security Platform GUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Secure Shell and HTTPS Access Through Out-of-Band Dial-In . . . . . . . . . . . . . . 235

Remote Configuration Mode in the Nokia IP45 Security Platform . . . . . . . . . . . . 235

13 Configuring Device Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

Host Name Configuration by Using the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

Date and Time Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

System Logging Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Setting the Syslog Server by Using the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . 239

Network Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239

Managing the Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

Exporting the Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

Importing the Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

Upgrading Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Installing your Product Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Configuring DDNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Resetting the Nokia IP45 Security Platform to Factory Defaults. . . . . . . . . . . . . . 247

Resetting the Nokia IP45 Security Platform by Using the Reset Button . . . . . . 248

Restarting the Nokia IP45 Security Platform by Using the GUI . . . . . . . . . . . . . . 248

14 Viewing Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Viewing Reports on the Nokia IP45 Security Platform . . . . . . . . . . . . . . . . . . . . . 249

Viewing the Event Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Viewing the Traffic Monitor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Viewing Active Computers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252

Viewing Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Viewing the Diagnostics Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

15 Working with VPNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

About VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

Setting Up the Nokia IP45 Security Platform as a VPN Server. . . . . . . . . . . . . . . 259

Configuring Remote Access VPNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

Configuring Site-to-Site VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265

10 Nokia IP45 Security Platform User’s Guide v4.0

Completing Site Creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Configuring Route-Based VPNs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

Deleting a VPN Site. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

Logging On to a VPN Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

Logging On from the Nokia IP45 Security Platform GUI . . . . . . . . . . . . . . . . . 272

Logging On Through my.vpn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273

Logging Off a VPN Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274

VPN Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274

Installing a Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274

Generating a Self-Signed Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

Importing a Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

Installing VPN Certificates from SmartCenter . . . . . . . . . . . . . . . . . . . . . . . . . 278

Uninstalling the VPN Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Viewing VPN Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Viewing IKE Traces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

Downloading the Precompiled Security Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

VPN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282

Nokia IP45 Security Platform as a VPN Server. . . . . . . . . . . . . . . . . . . . . . . . . . 282

SecuRemote to Nokia IP45 Satellite X

(VPN Client to Gateway) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282

Setting Up Nokia IP45 Satellite X. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

Nokia IP45 Security Platform as VPN Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284

Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284

Setting Up Nokia IP45 Tele 8 as a VPN Client . . . . . . . . . . . . . . . . . . . . . . . . . . 284

Adding VPN Sites by Using Nokia IP45 Tele 8 . . . . . . . . . . . . . . . . . . . . . . . . . . 284

Nokia IP45 Site-to-Site VPNs support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

Adding VPN Sites by Using Nokia IP45 Satellite X . . . . . . . . . . . . . . . . . . . . . . . 287

Nokia IP45 Tele to IP45 Satellite X (VPN Client to Gateway) . . . . . . . . . . . . . . . . 289

Setting Up Nokia IP45 Tele 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

Setting Up Nokia IP45 Satellite X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

Nokia IP45 Tele 8 to Check Point FP1, FP2, FP3, NG, NG AI, NGX R60 or NGX R61 289

Setting Up Nokia IP45 Tele 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

Setting Up Check Point Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

Nokia IP45 Tele 8 to Check Point NG AI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

Setting Up Nokia IP45 Tele 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

Setting Up Check Point NG AI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

Nokia Satellite X to Nokia Satellite X

(VPN Gateway-to-Gateway). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291

Setting Up Nokia IP45 Satellite X. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291

Nokia IP45 Satellite X in NAT and Bypass NAT Modes . . . . . . . . . . . . . . . . . . . 292

NAT Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

Bypass NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

Nokia IP45 Security Platform User’s Guide v4.0 11

Bypass Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

Defining a Backup VPN Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

Nokia IP45 Satellite X to VPN-1 (Site-to-Site VPN) . . . . . . . . . . . . . . . . . . . . . . 294

Setting Up Nokia IP45 Satellite X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

Nokia IP45 Satellite X to Check Point FP3 or DAIP. . . . . . . . . . . . . . . . . . . . . . 295

Setting Up Check Point FP3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

Setting Up Nokia IP45 Satellite X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296

Nokia IP45 Satellite X to Check Point SmartCenter FP3/NG AI . . . . . . . . . . . . 296

Setting Up Check Point SmartCenter FP3/NG AI . . . . . . . . . . . . . . . . . . . . . . 296

Setting Up Nokia IP45 Satellite X

for VPN Connection with SmartCenter FP3 . . . . . . . . . . . . . . . . . . . . . . . . . 297

Setting Up Check Point SmartCenter NG AI by Using

Certificates with Smart LSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297

Site-to-Site VPN with Windows 2000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298

Site-to-Site VPN with Nokia CryptoCluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299

Site-to-Site VPN with Cisco PIX. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299

VPN Routing Between two Nokia IP45 Security Platforms . . . . . . . . . . . . . . . . 299

IPSec NAT Traversal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299

Mesh VPN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300

Enhanced MEP Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300

16 Using Managed Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303

Starting your Subscription Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303

Viewing Service Information from the Account Page . . . . . . . . . . . . . . . . . . . . . . 306

Refreshing your Service Center Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . 307

Configuring your Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308

Disconnecting from your Service Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308

SofaWare Security Management Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

Web Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

Selecting Categories to Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310

Virus Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

Enabling or Disabling Email Antivirus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

Selecting Protocols for Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312

Temporarily Disabling Email Antivirus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312

Automatic and Manual Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314

Checking for Software Updates when Locally Managed . . . . . . . . . . . . . . . . . . 314

Checking for Software Updates when Remotely Managed . . . . . . . . . . . . . . . . 315

Managing with the Nokia Horizon Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

Check Point SmartCenter LSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316

17 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

Debugging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

Configuring Debugging Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

12 Nokia IP45 Security Platform User’s Guide v4.0

Viewing Debugging Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

Viewing Firmware Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325

Resetting the IP45 Security Platform to Factory Defaults . . . . . . . . . . . . . . . . . . 326

Failsafe Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326

Upgrading Firmware in Failsafe Mode by Using Console . . . . . . . . . . . . . . . . . . . 327

Upgrading Firmware from Failsafe Kernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327

Running Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328

Using Packet Sniffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328

A Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

Technical Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

Safety Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

B Compliance Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

Declaration of Conformity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

Compliance Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

FCC Notice (US) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337

Nokia IP45 Security Platform User’s Guide v4.0 13

14 Nokia IP45 Security Platform User’s Guide v4.0

About this Guide

This guide provides information and procedures about how to install and configure the Nokia IP45 security platform. This guide provides information about the new features incorporated in the Nokia IP45. This version of the Nokia IP45 uses the SofaWare VPN-1 Embedded NG. For a quick reference on how to configure features in the Nokia IP45, see the Nokia IP45 Security Platform Quick Start Guide v4.0 and the Nokia IP45 Security Platform Online Help, part of the graphical user interface (GUI) in the device.

Installation and maintenance should be performed by experienced technicians or Nokiaapproved service providers only.

This preface provides the following information:

 In this Guide

 Conventions this Guide uses

 Related Documentation

In this Guide

This guide is organized into the following chapters and appendixes:

 Chapter 1, “Introduction” provides the information you need to know before installing the

Nokia IP45 security platform.

 Chapter 2, “Installing the Nokia IP45 Security Platform” describes how to install the device,

lists operating system requirements, protocols and how to establish a network connection.

 Chapter 3, “Getting Started” describes how to start by using the IP45, and provides

information on first-time login and connecting to the Internet.

 Chapter 4, “Accessing the Nokia IP45 Security Platform” describes different methods of

connecting to your IP45, and methods of configuring the device.

 Chapter 5, “Connecting to the Internet with the Nokia IP45 Security Platform” describes

how to configure your IP45 for connecting to the Internet, and viewing and managing your Internet connection.

 Chapter 6, “Managing your Local Area Network,” describes how to configure the Nokia

IP45 features.

 Chapter 7, “Quality of Service” provides information about Quality of Service (QoS) and

how to configure the QoS classes.

Nokia IP45 Security Platform User’s Guide v4.0 15

 Chapter 8, “Setting Up the Nokia IP45 Security Platform Security Policy”describes methods

to define the firewall level, configure virtual servers, and create firewall rules.

 Chapter 9, “Configuring Network Access,” describes the network access procedures and

usage of SSH and SSL.

 Chapter 10, “Configuring and Monitoring SNMP,” describes the procedure to configure

Simple Network Management Protocol, set community strings, send and enable SNMP traps.

 Chapter 11, “High-Availability,” describes about the High Availability feature.

 Chapter 12, “Configuring Nokia IP45 Through Out-of-Band Management,” describes the

method to configure the Nokia IP45 through Out of Band Management.

 Chapter 13, “Configuring Device Functions,” discusses how to configure device functions

such as setting date and time, loading factory defaults and performing firmware upgrade.

 Chapter 14, “Viewing Reports,” describes how to view reports such as Event Log, Active

Computers, Active Connections, and VPN Tunnels.

 Chapter 15, “Working with VPNs,” describes how to configure a VPN by using the Nokia

IP45.

 Chapter 16, “Using Managed Services” describes methods for enabling and using

subscription services such as Web filtering, email antivirus, automatic and manual updates.

 Chapter 17, “Troubleshooting,”discusses typical problems users encounter and provides

solutions to these problems.

 Appendix A, “Specifications,” describes the Nokia IP45 specifications.

 Appendix B, “Compliance Information,” contains the compliance information of the Nokia

IP45 security platform.

Conventions this Guide uses

The following sections describe the conventions this guide uses, including notices, text conventions, and command-line conventions.

Notices

Warning

Warnings advise the user that either bodily injury might occur because of a physical hazard, or that damage to a structure, such as a room or equipment closet, might occur because of equipment damage.

Caution

Cautions indicate potential equipment damage, equipment malfunction, loss of performance, loss of data, or interruption of service.

16 Nokia IP45 Security Platform User’s Guide v4.0

Note

Notes provide information of special interest or recommendations.

Command-Line Conventions

This section defines the elements of commands that are available in Nokia products. You might encounter one or more of the following elements on a command-line path.

Table 1 Command-Line Conventions

Convention Description

Command This required element is usually the product name or other short

word that invokes the product or calls the compiler or preprocessor script for a compiled Nokia product. It might appear alone or precede one or more options. You must spell a command exactly as shown and use lowercase letters.

Italics Indicates a variable in a command that you must supply. For

example:

delete interface if_name

Conventions this Guide uses

Supply an interface name in place of the variable. For example:

delete interface nic1

Angle brackets < > Indicates arguments for which you must supply a value:

retry-limit <1–100>

Supply a value. For example:

retry-limit 60

Square brackets [ ] Indicates optional arguments.

delete [slot slot_num]

For example:

delete slot 3

Vertical bars, also called a

pipe

(|)

Separates alternative, mutually exclusive elements.

framing <sonet | sdh>

To complete the command, supply the value. For example:

framing sonet

framing sdh

Nokia IP45 Security Platform User’s Guide v4.0 17

Table 1 Command-Line Conventions (continued)

Convention Description

-flag A flag is usually an abbreviation for a function, menu, or option

.ext A filename extension, such as .ext, might follow a variable that

( . , ; + * - / ) Punctuation and mathematical notations are literal symbols that

' ' Single quotation marks are literal symbols that you must enter as

Text Conventions

Tabl e 2 describes the text conventions this guide uses.

name, or for a compiler or preprocessor argument. You must enter a flag exactly as shown, including the preceding hyphen.

represents a filename. Type this extension exactly as shown, immediately after the name of the file. The extension might be optional in certain products.

you must enter exactly as shown.

shown.

Table 2 Text Conventions

Convention Description

Monospace font

Indicates command syntax, or represents computer or window output, for example:

Log error 12453

Bold monospace font

Indicates text you enter or type, for example:

# configure nat

Key names Keys that you press simultaneously are linked by a plus sign (+):

Press Ctrl + Alt + Del.

Menu commands Menu commands are separated by a greater than sign (>):

Choose File > Open.

The words enter and type Enter indicates you type something and then press the Return or

Enter key. Do not press the Return or Enter key when an instruction says

type.

Italics

• Emphasizes a point or denotes new terms at the place where they are defined in the text.

• Indicates an external book title reference.

• Indicates a variable in a command:

delete interface

if_name

18 Nokia IP45 Security Platform User’s Guide v4.0

Menu Items

The Nokia IP45 menu items in procedures are separated by the greater than sign (>).

For example, Start > Programs > Nokia > Security indicates that you first click Start, then choose the Programs menu command, then choose Nokia, and finally choose Security.

1 Introduction

This chapter introduces the Nokia IP45 security platform and includes the following topics:

 About the Nokia IP45 Security Platform

 Nokia IP45 Security Platform Features

 Network Requirements

 Nokia IP45 Security Platform Front Panel

 Nokia IP45 Security Platform Rear Panel

About the Nokia IP45 Security Platform

The Nokia IP45 security platform provides dependable Internet access for the remote and branch offices of a distributed enterprise. The Nokia IP45 supports features like dial-up connection, redundant WAN connection to headquarters, and dual homing with BGP to route return traffic securely, over VPN. IP45 appliances are RoHS complaint.

The Nokia IP45 security platform can be integrated with an overall enterprise security policy for maximum security. The IP45 facilitates centralized management and automatic deployment with the security management architecture of Check Point and Nokia Horizon Manager.

The Nokia IP45 security platform is available with the following licenses:

 Nokia IP45 Tele 8

 Nokia IP45 Satellite 16

 Nokia IP45 Satellite 32

 Nokia IP45 Satellite U (Unlimited)

All these versions of the Nokia IP45 provide a Web-based interface that enables you to configure and manage the Nokia IP45.

The Nokia IP45 security platform comes pre-installed with the license of your choice. You can upgrade the IP45 security platform to a more advanced configuration without replacing the hardware. For details about license upgrade, contact your local reseller.

Nokia IP45 Tele 8

Nokia IP45 Tele 8 is for home telecommuters and work extenders who also need VPN client access. The IP45 Tele 8 supports both firewall and VPN client capabilities over an eight-node

Nokia IP45 Security Platform User’s Guide v4.0 21

1 Introduction

network. The device supports VPN client capabilities for users to connect to the central office from their home with firewall protection, extending the enterprise network to the employees’ home offices.

IP45 Tele 8 can act as a VPN server, which allows a single user to securely access resources protected by the device from home or while travelling.

Note

Computers that actually pass through the firewall are counted. Devices such as network printers connected in LAN that do not normally get connected to the Internet are not counted.

Nokia IP45 Satellite 16, Satellite 32, Satellite Unlimited

Nokia IP45 Satellite 16, IP45 Satellite 32, and IP45 Satellite Unlimited provide full firewall, and VPN connectivity for remote and branch offices or independent, small, and medium enterprises with sixteen, thirty-two, and unlimited node networks, respectively. Using these solutions, remote and branch offices can securely exchange information between them with distributed enterprises and small and medium enterprises at a low price with excellent performance.

Nokia IP45 Security Platform Features

The following section contains a summary of the Nokia IP45 security platform features.

Connectivity

Table 3 provides details about the IP45 v4.0 connectivity.

Table 3 Nokia IP45 Security Platform Connectivity

Nokia IP45 Satellite

Feature Nokia IP45 Tele 8

LAN, WAN, and console ports

DMZ Support

Manual Ethernet port settings

16/32/Unlimited

22 Nokia IP45 Security Platform User’s Guide v4.0

About the Nokia IP45 Security Platform

Table 3 Nokia IP45 Security Platform Connectivity (continued)

Nokia IP45 Satellite

Feature Nokia IP45 Tele 8

Dynamic routing by using OSPF

Unnumbered PPP

Users (nodes) 8 16, 32, unlimited

PPPoE client

PPTP client

16/32/Unlimited

DHCP client

DHCP server

DHCP relay

Backup DHCP relay

DHCP reservation

Nokia IP45 Security Platform User’s Guide v4.0 23

1 Introduction

Table 3 Nokia IP45 Security Platform Connectivity (continued)

Nokia IP45 Satellite

Feature Nokia IP45 Tele 8

Customizing DHCP Options (DNS servers, WINS servers, NTP servers, Domain name, VoIP call managers, TFTP server and TFTP boot file name)

Stat ic IP

MAC cloning

MAC Cloning for WAN2

16/32/Unlimited

Static NAT, static routes

Dial-up Internet connection

Routing support by using BGP

Source routing

High-Availability (Group ID, enhanced

interface tracking, VPN effect, WAN Virtual IP)

Traffic Shaper

24 Nokia IP45 Security Platform User’s Guide v4.0

About the Nokia IP45 Security Platform

Table 3 Nokia IP45 Security Platform Connectivity (continued)

Nokia IP45 Satellite

Feature Nokia IP45 Tele 8

Traffic Shaper enhancements

Traffic Monitor

Dead Connection Detection

16/32/Unlimited

Firewall

Table 4 provides details about the IP45 security platform firewall connectivity.

Table 4 Firewall Connectivity

Feature Nokia IP45 Tele 8

Firewall Type Check Point Firewall-1

Embedded NG

Network Address Translation (NAT)

INSPECT policy rules

User defined rules

Three levels of Preset security policies

Nokia IP45 Satellite (16/32/Unlimited)

Check Point Firewall-1 Embedded NG

DoS protection

Nokia IP45 Security Platform User’s Guide v4.0 25

1 Introduction

Table 4 Firewall Connectivity (continued)

Feature Nokia IP45 Tele 8

Anti-spoofing

Attack logging

Voice over IP (H.323) support

Exposed host

Nokia IP45 Satellite (16/32/Unlimited)

DMZ network

VLAN support

SmartDefense and Application Intelligence

VPN Connectivity

Table 5 provides details about the IP45 security platform VPN connectivity.

26 Nokia IP45 Security Platform User’s Guide v4.0

Table 5 VPN Connectivity

Feature Nokia IP45 Tele8

IPSEC VPN remote access server

IPSEC VPN site-to-site gateway

IPSEC VPN remote access client

Authentication X.509 certificates

RSA secure ID

About the Nokia IP45 Security Platform

Nokia IP45 Satellite 16/32/Unlimited

Office Mode Network

VPN pass through

Enhanced MEP support

Advanced VPN configuration

Encryption AES/3DES/DES AES/3DES/DES

Authentication SHA1/MD5 SHA1/MD5

SecuRemote server

Nokia IP45 Security Platform User’s Guide v4.0 27

1 Introduction

Table 5 VPN Connectivity (continued)

Nokia IP45 Satellite

Feature Nokia IP45 Tele8

L2TP VPN server

RADIUS Client

RADIUS Enhancements (vendor specific

DAIP with VPN certificates

16/32/Unlimited

attribute (VSA), Radius Realm support,

Radius time-out and retries setting)

Backup VPN gateways

SmartCenter Connector (SSC) NG AI support

Bypass NAT

Bypass Firewall

NAT Traversal

Route all traffic

28 Nokia IP45 Security Platform User’s Guide v4.0

About the Nokia IP45 Security Platform

Table 5 VPN Connectivity (continued)

Nokia IP45 Satellite

Feature Nokia IP45 Tele8

Route-Based VPN and failover

Multiple PPP connections

Enhanced active tunnels display

16/32/Unlimited

Management

Table 6 provides details about the IP45 security platform management.

Table 6 Management

Feature Nokia IP45 Tele 8

Web-based management

Access to the IP45 through OOB, SSH and SNMP

Telnet access

HTTPS access (local and remote)

Remote firmware upgrades

Nokia IP45 Satellite (16/32/Unlimited)

Nokia IP45 Security Platform User’s Guide v4.0 29

1 Introduction

Table 6 Management (continued)

Feature Nokia IP45 Tele 8

Nokia Horizon Manager support from v1.5 SP1 onwards

Multiple administrators

Users Manager

Guest HotSpot Users

Nokia IP45 Satellite (16/32/Unlimited)

User account expiration

Nokia CLI shell

Management systems ( Nokia Horizon Manager, SofaWare SMP, Check Point SmartCenter, Check Point Smart Update)

Check Point Smart LSM Check Point Provider-1

Packet Sniffer

SmartDefense policy wizard

30 Nokia IP45 Security Platform User’s Guide v4.0

About the Nokia IP45 Security Platform

Security Services

Table 7 provides details about the IP45 security platform security services.

Table 7 Security Services

Nokia IP45 Satellite

Feature Nokia IP45 Tele 8

VStream embedded antivirus

Firewall security updates

Software updates

Web filtering

(16/32/Unlimited)

Email antivirus protection

Secure HotSpot

Dynamic DNS service (When managed by SofaWare Management Portal (SMP) and Nokia Horizon Manager (NHM)).

VPN management

Centralized logging

Nokia IP45 Security Platform User’s Guide v4.0 31

1 Introduction

Table 7 Security Services (continued)

Nokia IP45 Satellite

Feature Nokia IP45 Tele 8

Customized security policy

Protocol support for TCP/IP, ICMP, GRE, ESP and UDP

Certificate Finger print display

(16/32/Unlimited)

Diagnostics and Maintenance

Table 8 provides details about the IP45 v4.0 diagnostics and maintenance.

Table 8 Diagnostics and Maintenance

Feature Nokia IP45 Tele 8

Configuration Import or Export

Firmware upgrade

Preset configuration

Known good configuration

Nokia IP45 Satellite (16/32/Unlimited)

32 Nokia IP45 Security Platform User’s Guide v4.0

Table 8 Diagnostics and Maintenance (continued)

Feature Nokia IP45 Tele 8

OOB management

Diagnostic tools (netstat, traceroute, arp, ping, WHOIS, nslookup, tcpdump)

Network Requirements

To set up the Nokia IP45 security platform to connect to the Internet, you need the following:

 A broadband Internet connection by cable or DSL modem with Ethernet interface (RJ-45) or

a dial-up connection with a serial modem (V90 or ISDN T/A)

 10Base-T or 100Base-T Ethernet switch or hub (optional)

 10Base-T or 100Base-T network interface card installed on each computer

 TCP/IP network protocol installed on each computer

 CAT5 network cable with RJ-45 connectors for each computer

 Internet Explorer 5.0 or later, or Netscape Navigator 4.5 and later

Overview

Nokia IP45 Satellite (16/32/Unlimited)

Note

Nokia recommends that you use either Microsoft Internet Explorer 5.5 or later, or Netscape Navigator 6.2 or later.

Overview

The following sections provide an overview of the Nokia IP45 security platform rear and front panels.

Nokia IP45 Security Platform Rear Panel

All physical connections (network and power) to the IP45 are made through the rear panel.

Tabl e 9 explains the items on the rear panel of the Nokia IP45.

Nokia IP45 Security Platform User’s Guide v4.0 33

1 Introduction

Figure 1 Rear panel of the Nokia IP45

Table 9 Rear Panel of the IP45

Label Description

Console The console port is a 9-pin male connector that can be

connected to the serial (COM) port of your computer. You can then use the command-line interface (CLI) to communicate with the device.

WAN Wide area network. An Ethernet port (RJ-45) used to

connect your cable or xDSL modem.

DMZ (WAN2)

LAN Local area network. Ethernet port (RJ-45) used to

AUX The auxiliary port or dial-in port is a 9-pin male

Demilitarized zone. Ethernet port (RJ-45) used to connect computers or other network devices. Similar to LAN port in operation.

This can be used as WAN2, secondary WAN connection.

connect computers or other network devices.

connector. This port is used to dial in to the IP45 through a modem when the IP45 is unreachable through other ports.

34 Nokia IP45 Security Platform User’s Guide v4.0

Table 9 Rear Panel of the IP45 (continued)

Label Description

Power A power jack used to supply power to the device.

Connect the power adapter to this jack. The device connects to the power source.

Reset Used to reboot or reset the IP45 to its factory defaults.

Use a large flat-tipped object, such as a thick paper clip, to press the reset button.

Short press (one second): reboots the Nokia IP45 security platform.

Long press (seven seconds): resets the IP45 to its factory defaults. This results in loss of all security services and passwords.

Short press during boot up: boots the IP45 in special deployment mode. See “Resetting the Nokia IP45

Security Platform by Using the Reset Button” on page

248.

Overview

Note

Do not use a sharp pin or thin piece of metal to press the Reset button.

Nokia IP45 Security Platform Front Panel

You can monitor the IP45 operations by viewing the LEDs on the front panel.

Figure 2 Front Panel of the Nokia IP45 Security Platform

The items on the front panel of the Nokia IP45 security platform are explained in Tabl e 10 on page 36.

Nokia IP45 Security Platform User’s Guide v4.0 35

1 Introduction

Table 10 Front Panel of the Nokia IP45

Label Description

PWR Off: Device not powered on

Green Solid: Device is on

STAT Off: Device off

Green solid: Device passed hardware test and finished booting. Red solid: Hardware error Amber solid: Booting Green blinking: Device passed hardware test and is fully booted.

Device is at its default state. First-time password is not set. Red blinking: Software error Amber blinking: Device is performing a function such as setting

factory defaults, loading firmware or loading an exported configuration.

LAN

DMZ

WAN

Off: No connection Green solid: Interface connected and auto-negotiated at 10 Mbps Amber solid: Interface connected and auto-negotiated at 100

Mbps Amber/Green blinking: Traffic passing through the interface

36 Nokia IP45 Security Platform User’s Guide v4.0

2 Installing the Nokia IP45 Security

Platform

This chapter describes how to set up and install the Nokia IP45 security platform in a networking environment. The chapter includes the following topics:

 Before you Install the Nokia IP45 Security Platform

 Setting Up the Nokia IP45 Security Platform with Microsoft Windows 98 or Millennium

Operating Systems

 Setting Up the Nokia IP45 Security Platform with Microsoft Windows XP and 2000

Operating Systems

 Setting Up the Nokia IP45 Security Platform with an Apple Computer

 Connecting the Nokia IP45 Security Platform to the Network

 Installing your Network

Before you Install the Nokia IP45 Security Platform

Before you connect and set up the Nokia IP45 security platform, you must check the following:

 Whether TCP/IP is installed on your computer.

 The TCP/IP settings of your computer, to ensure that it obtains its IP address automatically.

The following sections guide you through the TCP/IP setup and installation process.

Nokia IP45 Security Platform User’s Guide v4.0 37

2 Installing the Nokia IP45 Security Platform

Setting Up the Nokia IP45 Security Platform with Microsoft Windows 98 or Millennium Operating Systems

If you are using Windows 98 or Windows ME, configure TCP/IP as follows.

To check for TCP/IP Installation

1. Choose Start > Settings > Control Panel.

The Control Panel window opens.

2. Double-click the Network icon.

The Network window opens.

38 Nokia IP45 Security Platform User’s Guide v4.0

Setting Up the Nokia IP45 Security Platform with Microsoft Windows 98 or Millennium Operating Systems

In the Network window, check if TCP/IP appears in the network components list and if it is already configured with the Ethernet card installed on your computer.

If TCP/IP is already installed and configured on your computer, skip the following procedure about how to install TCP/IP.

To install TCP/IP

1. In the Network window, click Add.

The Select Network Component Type window opens.

2. Choose Protocol and click Add.

Nokia IP45 Security Platform User’s Guide v4.0 39

2 Installing the Nokia IP45 Security Platform

The Select Network Protocol window opens.

3. In the Select Network Protocol window, choose Microsoft in Manufacturers and TCP/IP in

Network Protocols.

4. Click OK.

If you are prompted for original Windows installation files, provide the installation CD and relevant path, D:\win98, D:\win95, and so on.

5. Restart your computer if prompted.

If you are connecting the IP45 to an existing LAN, consult your network manager/system administrator for the correct configuration.

40 Nokia IP45 Security Platform User’s Guide v4.0

Setting Up the Nokia IP45 Security Platform with Microsoft Windows 98 or Millennium Operating Systems

To make TCP/IP settings

1. In the Network window, double-click the TCP/IP Service for the Ethernet card on your

computer (TCP/ IP > PCI Fast Ethernet DEC 21143 Based Adapter).

The TCP/IP Properties window opens.

2. Click the Gateway tab and delete any installed gateways.

3. Click the DNS Configuration tab and click Disable DNS.

Nokia IP45 Security Platform User’s Guide v4.0 41

2 Installing the Nokia IP45 Security Platform

4. Click the IP Address tab, and click Obtain an IP address automatically.

42 Nokia IP45 Security Platform User’s Guide v4.0

Setting Up the Nokia IP45 Security Platform with Microsoft Windows XP and 2000 Operating Systems

Note

Nokia recommends that you use DHCP to assign IP addresses instead of assigning a static IP address to your computer. To assign a static IP address, click Specify an IP address and enter an IP address in the range of 192.168.10.129 to 254. Enter 255.255.255.0 as the Subnet Mask. Click OK to save the new settings.

5. Click Yes when the Do you want to restart your computer? message appears.

Your computer must restart for the new settings to take effect.

Your computer is now ready to access the IP45.

Setting Up the Nokia IP45 Security Platform with Microsoft Windows XP and 2000 Operating Systems

Windows XP has an Internet connection firewall option. Nokia recommends that you disable the firewall option if you are using the Nokia IP45.

To check for TCP/IP installation

1. Choose Start > Settings > Control Panel (in Windows XP Start > Control Panel from.)

The Control Panel window opens.

2. Double-click the Network and Dial-up Connections icon (in Windows XP double-click the

Network Connections icon).

Nokia IP45 Security Platform User’s Guide v4.0 43

2 Installing the Nokia IP45 Security Platform

The Network and Dial-up Connections window opens.

3. Right-click the Local Area Connection icon and select Properties from the drop-down list.

The Local Area Connection Properties window opens.

4. Check for TCP/IP in the Component list and whether it is configured with the Ethernet card

installed on your computer.

If TCP/IP does not appear in the Components list, install it as described in the section “To

install TCP/IP” on page 39. If TCP/IP is already installed, skip the next section.

44 Nokia IP45 Security Platform User’s Guide v4.0

Setting Up the Nokia IP45 Security Platform with Microsoft Windows XP and 2000 Operating Systems

To install TCP/IP

1. In the Local Area Connection Properties window, click Install.

The Select Network Component Type window opens.

2. Choose Protocol and click Add.

The Select Network Protocol window opens.

3. In the Select Network Protocol window, choose Internet Protocol (TCP/IP) and click OK.

The TCP/IP protocol is installed on your computer.

Nokia IP45 Security Platform User’s Guide v4.0 45

2 Installing the Nokia IP45 Security Platform

To make TCP/IP settings

1. In the Local Area Connection Properties window, double-click Internet Protocol (TCP/IP)

and click Properties.

The Internet Protocol (TCP/IP) Properties window opens.

2. Click Obtain an IP address automatically.

Note

Nokia recommends that you use DHCP to assign IP addresses instead of assigning a static IP address to your computer. To assign a static IP address, select Specify an IP address and enter an IP address in the range of 192.168.10.129 to 254. Enter

255.255.255.0 as the subnet mask. Click Ok to save the new settings.

3. Click Obtain DNS server address automatically.

4. Click OK to save the new settings.

Your computer is now ready to access your IP45.

46 Nokia IP45 Security Platform User’s Guide v4.0

Setting Up the Nokia IP45 Security Platform with an Apple Computer

Use the following procedure to set up the TCP/IP protocol:

To make TCP/IP settings

1. Choose Apple Menus > Control Panels > TCP/IP.

The TCP/IP window opens.

2. Select Ethernet from the Connect drop-down list.

3. Select Using DHCP Server from the Configure drop-down list.

4. Close the window and save the setup.

Connecting the Nokia IP45 Security Platform to the Network

The following examples illustrate proper network cabling of the IP45 topology.

Figure 3 IP45 Topologies

Installing your Network

Plan your network and the location of the IP45 to install the network.

To install the network

1. Connect the LAN cable

a. Connect one end of the Ethernet cable to the LAN port at the rear end of the device.

b. Connect the other end of the Ethernet cable to the computer, hubs, or another network.

device.

Nokia IP45 Security Platform User’s Guide v4.0 47

2 Installing the Nokia IP45 Security Platform

2. Connect the DMZ cable

a. Connect one end of the Ethernet cable to the DMZ port at the rear end of the device.

b. Connect the other end of the Ethernet cable to the computer, hubs, or another network

device.

3. Connect the WAN cable:

a. Connect one end of the Ethernet cable to the WAN port at the rear end of the device.

b. Connect the other end of the Ethernet cable to a cable modem, xDSL modem, or a

corporate network.

4. Connect the power adapter to the power socket at the rear end of the device.

5. Plug in the AC power adapter to the electrical outlet.

48 Nokia IP45 Security Platform User’s Guide v4.0

3 Getting Started

This chapter describes the basic configurations and settings you need to perform to start using your Nokia IP45 security platform.

This chapter includes the following topics:

 First-Time Login

 Configuring the Nokia IP45 Security Platform for Internet Connection

 Making Initial Nokia IP45 Security Platform Settings

 Logging On to the Nokia IP45 Security Platform

 Accessing Nokia IP45 Securely

First-Time Login

After you connect your IP45 security platform to your network as described in “Connecting the

Nokia IP45 Security Platform to the Network” on page 47, wait for the STAT LED to turn green.

To login for the first time

1. Open your Web browser and type http://my.firewall in the location text box.

The first time login page opens, prompting for a password.

If you cannot access the GUI portal, see “Troubleshooting” on page 319 in this document.

Note

The IP45 ships without a password defined. If you are logging in for the first time, you are prompted to define the password by entering it twice. If you logged in before, enter the username and password you previously defined.

Nokia IP45 Security Platform User’s Guide v4.0 49

3 Getting Started

2. Type a password and re-type the password to confirm.

3. Click OK.

Note

The password must be between five and eleven alphanumeric characters. To change the password, click Setup on the main menu, and click Password. Enter the new password and confirm to update the change.

Configuring the Nokia IP45 Security Platform for Internet Connection

This section describes how to make the initial settings for your Nokia IP45 security platform to connect to the Internet by using the Setup wizard.

50 Nokia IP45 Security Platform User’s Guide v4.0

Making Initial Nokia IP45 Security Platform Settings

To connect to the Internet from the Nokia IP45 security platform

1. After you set the administrator password, you are prompted to make the initial settings from

the Setup wizard.

The wizard guides you through making an Internet connection, setting the device time, registering for support services, and performing other basic configurations.

2. Click OK to continue.

3. The Internet Connection Method dialog box appears.

For more information about how to connect to the Internet, see “To configure an Internet

connection by using the setup wizard” on page 74.

Making Initial Nokia IP45 Security Platform Settings

When you exit the Internet Connection Method wizard, you are prompted to set the device time. This section describes how to use the Setup wizard to set the device time, and how to make the initial Nokia IP45 security platform settings.

Nokia IP45 Security Platform User’s Guide v4.0 51

3 Getting Started

Setting the Nokia IP45 Security Platform Time

Use the following procedure to set the time of the Nokia IP45 security platform.

To set the time

1. When the IP45 Set Time wizard opens, check the appropriate setting.

 If you check Your computer’s clock, the IP45 automatically updates with the time settings

of your computer.

 If you check Keep the current time, the IP45 retains its current time settings. No changes

are made.

 If you check Use a time Server, the Time Servers window opens

 Enter the IP Addresses for the Primary and Secondary time servers.

 Select the time zone

 Click Next

 Click Finish.

Note

To edit the IP addresses of the time servers, click Clear next to the Primary and Secondary servers, enter the new IP address.

52 Nokia IP45 Security Platform User’s Guide v4.0

Making Initial Nokia IP45 Security Platform Settings

 The IP45 automatically applies the time settings.

 If you check Specify date and time, the Specify Date and Time window opens.

You can manually update the IP45 time settings.

2. Click Next to change your IP45 time settings:

 If you choose to use a time server by clicking Use a Time Server, the Time Servers

window opens.

3. Specify the IP addresses of the Primary and Secondary servers, to use as NTP time servers.

Select time zone from the Time Zone drop down list.

4. Click Next.

Nokia IP45 Security Platform User’s Guide v4.0 53

3 Getting Started

The IP45 Set Time Wizard Date and Time Updated dialog box appears, indicating that time settings are changed successfully.

5. Click Finish to exit the Set Time wizard.

Registering with the Nokia Support Site

You can register with the Nokia Support Site when you make your time settings.

The IP45 Setup Wizard begins when you exit the Set Time wizard.

Check the I want to register my product check box, and click Next.

You are automatically taken to Nokia Support Web site:

https://support.nokia.com/agreement/SOHOregister.shtml.

Use the instructions on the Web site to complete the registration process and gain access to support Web resources and software updates.

54 Nokia IP45 Security Platform User’s Guide v4.0

Making Initial Nokia IP45 Security Platform Settings

Connecting to a Central Management Server

When you are registered for support, the Service Center window opens.

This window allows you to define the central management server that the IP45 connects to.

The IP45 can connect to a central management server to allow central management of the firewall and VPN policies. Central management can also allow the IP45 to subscribe to additional services such as antivirus and URL filtering. The central server can be either a Check Point Smart Center, Smart Center Pro, or SofaWare Management Portal.

If your IP45 is centrally managed by any of these servers, check Connect to a service center and enter the IP address of the central management server in the Specified IP text box, then click Next. You are then prompted to enter the authentication information that allows the IP45 to communicate with the management server where you previously defined the IP45 object.

If your IP45 is not managed by a central management server, check Connect to a service center, and click Next.

For information connecting to service centers, see “Managing Large Scale Deployments of

Nokia IP45” on page 70. For information about how to use subscription services, see “Using Managed Services” on page 303.

Logging On to the Nokia IP45 Security Platform

When you exit the Setup wizard, the IP45 Welcome page opens.

Nokia IP45 Security Platform User’s Guide v4.0 55

3 Getting Started

To access the graphical user interface of the Nokia IP45 security platform

1. Open your Web browser, and enter http://my.firewall in the address bar.

The Login page opens.

2. Enter the password for the IP45 Tele 8 license.

For IP45 Satellite X licenses, enter the username and password. If you are logging on for the first time, use admin as the username.

Note

The default user name for all Nokia IP45 licenses is admin. For the IP45 Satellite X licenses, you can define additional users. These additional users have separate usernames and passwords. For the IP45 Tele 8 license, you can only log on with the username admin. However, you can change the password. The password in all cases should be five to eleven alphanumeric characters.

You need to define your password in two instances:

 At the initial login

 When you reset the device to defaults

56 Nokia IP45 Security Platform User’s Guide v4.0

Making Initial Nokia IP45 Security Platform Settings

After the initial login, the Welcome page opens.

The Welcome page displays the license type of your device (Tele 8 or Satellite X).

Accessing Nokia IP45 Securely

You can access the IP45 graphical user interface (GUI) through HTTPS either remotely or locally (from your internal network). For information about how to access through HTTPS from a remote location, see “Enabling HTTPS Web Access” on page 206.

Note

First configure HTTPS to access the IP45 GUI from a remote location.

To access the Nokia IP45 security platform through HTTPS from the Internet

1. To access the IP45 locally, enter https://my.firewall in the address bar of your browser

Note

The URL starts with HTTPS, not HTTP.

The Welcome page opens.

To access the Nokia IP45 security platform from a remote location

1. Enter https://<external IP address of IP45>:981 in the address bar of your browser.

Note

The URL starts with HTTPS, not HTTP.

Nokia IP45 Security Platform User’s Guide v4.0 57

3 Getting Started

2. Click Yes to install the security certificate of the IP45 that you are trying to access. If you are

If you are accessing the Nokia IP45 security platform for the first time, the security certificate in the IP45 is not yet known to the browser, so a security alert appears.

using Internet Explorer 5.0 or later, do the following:

a. Click View Certificate.

The Certificate information page opens, with the General tab displayed.

b. Click Install Certificate.

The Certificate Import Wizard appears.

c. Click Next.

The Certificate Store appears.

Select Automatically select the Certificate Store based on the type of certificate.

d. Click Next.

Completing the Certificate Import Wizard message appears.

e. Click Finish.

The Root certificate Store message appears.

f. Click Yes.

The certificate is installed.

Logging Off from the Nokia IP45 Security Platform

Logging off terminates the Nokia IP45 security platform session. To connect to the IP45 again, enter the password.

To log off from IP45, perform one of the following procedures:

 If you are connected locally, click Logout.

58 Nokia IP45 Security Platform User’s Guide v4.0

Understanding the Nokia IP45 Web GUI

The Logout page opens.

 If you are connected through HTTPS, close the browser window.

For information about connecting to your device through HTTPS, see “Accessing Nokia IP45

Securely” on page 57.

Understanding the Nokia IP45 Web GUI

When you log on to the Nokia IP45 security platform by using HTTP or HTTPS, you can configure the device by using the following methods:

 Quick Setup Wizard—configures the most common settings required for the IP45 to be up

and running. The Web-based graphical user interface (GUI) automatically guides you through this wizard after your initial login.

 Advanced GUI—configures the various advanced features of the IP45.

For a configuration to take effect, click Submit.

For a brief description of the main components of the IP45 GUI, see the following sections. When you are familiar with these components, you are ready to make advanced configuration changes to the IP45 security platform.

Nokia IP45 Security Platform User’s Guide v4.0 59

3 Getting Started

Using the Nokia IP45 Security Platform Web-based User Interface

Table 11 provides a summary of the web-based GUI.

Tabl e 11 Summary of the main components of the Nokia IP45 GUI

Component Description

Navigation bar Used to access various feature sets in the IP45 security

platform

Tab bar Used to access and configure all features in the IP45

security platform

Wizard Used to configure common settings

Status bar Provides status after a specific configuration

Help Online help to assist you in configuring the IP45

60 Nokia IP45 Security Platform User’s Guide v4.0

Understanding the Nokia IP45 Web GUI

Graphical User Interface Details

This section provides details about Nokia IP45 v4.0 graphical user interface (GUI).

Figure 4 Main Components of the Nokia IP45 Security Platform GUI

Tab bar

Service center connection status

Navigation bar

Internet connection status

Click for online help

Setup wizard

Note

The Nokia IP45 Tele 8 license does not support all of the features described in Table 12. For information on features supported by the Tele configuration, see “Nokia IP45 Security

Platform Features” on page 22.

Nokia IP45 Security Platform User’s Guide v4.0 61

3 Getting Started

Table 12 provides information about the name and functionality of each element in the Nokia IP45 GUI.

Table 12 Names and Functions of the Nokia IP45 GUI Elements

Main Tab Secondary Tabs Description

Welcome Displays Welcome and configuration information.

Reports Event Log Displays the last 100 events in four different

categories: Blue, Red, Orange, and Green.

Traffic Monitor Allows you to visualize the network traffic(in

graphical representation)

Active Computers Allows you to view computers on your network.

Active Connections

VPN Tunnels Displays a list of established VPN tunnels.

Security Firewall Allows you to control firewall security level.

Servers Allows you to selectively allow incoming traffic

Rules Allows you to customize your security policy.

SmartDefense Allows you to deal with application-level attacks.

HotSpot Allows you to access the network from a public

Exposed Host Allows you to define a Demilitarized Zone, i.e. a

Antivirus Antivirus Allows you to enable or disable the antivirus

Policy Allows you to add new rules and edit existing

Advanced Allows you to select the file types to scan and

Allows you to view current connections between your network and the external world.

from known applications and Internet services.

place on authentication

computer not protected by firewall.

settings

rules of antivirus policy

block and also to define various other advanced settings such as archiving files, defining nested levels and compression ratio etc.

Services Account Provides information on services available in

your service plan, and allows you to manage security services.

Network Internet Displays information on network setup and

activity.

62 Nokia IP45 Security Platform User’s Guide v4.0

Understanding the Nokia IP45 Web GUI

Table 12 Names and Functions of the Nokia IP45 GUI Elements (continued)

Main Tab Secondary Tabs Description

My Network Allows you to configure network settings.

Ports Allows you to manage ports and view ports

status.

Traffic Shaper Allows you to define QoS classes.

Network Objects Allows you to configure network objects.

Routes Allows you to configure and edit routes

Setup Firmware Displays current firmware version and details

High Availability Allows you to configure high availability feature.

Logging Enables you to specify syslog server and syslog

port.

Management Allows you to specify the protocols and

accessing information for the IP45.

Tools Comprises several tools to effectively manage

your IP45.

Users Internal Users Allows you to view, add, edit, and delete list of

the IP45 users.

RADIUS Allows you to change your RADIUS settings.

VPN VPN Server Allows you to enable or disable a VPN server.

VPN Sites Allows you to view and edit a list of the

configured VPN sites.

VPN Login Enables you to manually log in to a VPN site.

Certificate Allows you to control certificates for site-to-site

VPN usage.

Help Online Help.

Logout Logs you out of the IP45.

Nokia IP45 Security Platform User’s Guide v4.0 63

3 Getting Started

Table 13 provides information about the elements in Status Bar.

Table 13 Status Bar

Field Description

Internet Your Internet connection status.

Service Center Displays your subscription services status.

You have different fields under Internet status. They are:

• Connected: your IP45 device is connected to the Internet

• Not Connected: your IP45 device is not connected to the

Internet

• Establishing Connection: your IP45 device is connecting to the Internet.

• Contacting Gateway: your IP45 device is trying to contact the Internet default gateway.

• Disabled: The Internet connection has been disabled, manually.

You can configure both primary and secondary Internet connections. When both the connections are configured, the Status bar shows this status.

Your Service Center offer various subscription services like firewall services, and optional services such as Web filtering, and email antivirus.

The service center status can be one of the following:

• Not Subscribed: you are not subscribe to security services

• Connection Failed: your IP45 device failed to connect to the

service center.

• Connecting: your IP45 device is connecting to the service center

• Connected: you are connected to the service center, and the

security services are active.

Note

You can view help information about a field by pointing to the help icon in the right corner of the IP45 GUI screens. The Help icon is visible only for those fields that have further information available. For information about other fields, please see related sections in the IP45 Security Platform User’s Guide Version 4.0 or choose Help from the main menu.

64 Nokia IP45 Security Platform User’s Guide v4.0

4 Accessing the Nokia IP45 Security

Platform

This chapter discusses the methods for accessing and configuring the Nokia IP45 security platform. This chapter also provides an introduction to centrally managing large scale deployments of Nokia IP45 by using Nokia Horizon Manager, SmartCenter Large Scale Manager, and the SofaWare Security Management Portal.

The main topics for this chapter include:

 Connection Methods

 Configuration Methods

 Connecting the Nokia IP45 Security Platform to a Computer by Using the Console Port

 Using Telnet to Connect to the Nokia IP45 Security Platform

 Enabling and Disabling Telnet Access to Nokia IP45

 Accessing Nokia IP45 with HTTP and HTTPS

 Managing Large Scale Deployments of Nokia IP45

Connection Methods

You can connect to your Nokia IP45 security platform locally through LAN, WAN, DMZ, or console ports for Inband management. You can also connect from a remote location by using modem dial-in for out-of-band management (OOB).

For information about how to use OOB to configure your device, see “Configuring Nokia IP45

Through Out-of-Band Management” on page 233.

Typically the WAN port for your device is connected to your Internet service provider (ISP), while the LAN port is connected to your computer, or to a hub, if you are using the IP45 between your computer network and the outside world. You can connect your computer to the console port of your IP45 to manage the device by using the command-line interface (CLI).

Configuration Methods

The Nokia IP45 security platform supports the following configuration methods:

 Command-line interface (CLI) by using console, Telnet, Secure Shell (SSH)

Nokia IP45 Security Platform User’s Guide v4.0 65

4 Accessing the Nokia IP45 Security Platform

 Web-based graphical user interface (GUI) by using HTTP, and HTTPS.

Connecting the Nokia IP45 Security Platform to a Computer by Using the Console Port

Your Nokia IP45 security platform has a console serial port. Connect the RS-232 cable (that is shipped along with the device) from the serial port of your computer to the console port of the IP45. You can then manage the device by using a terminal emulation program such as Hyper Term inal.

To connect to Nokia IP45 with HyperTerminal

1. To start the HyperTerminal program, choose: Start > Programs > Accessories >

Communications > HyperTerminal.

The Connection Description window opens.

2. Assign a name for your connection, such as IP45, and click OK.

3. Select the serial port that you will use: COM1 or COM2, and click OK.

66 Nokia IP45 Security Platform User’s Guide v4.0

Configuration Methods

4. When you select the serial port, the COM1 (or COM2) Properties window opens.

Select the following port settings:

 Bits per second: 9600

 Data bits: 8

 Parity: None

 Stop bits: 1

 Flow control: None

5. Click Ok to continue.

6. The login prompt is displayed by default.

Nokia IP45 Security Platform User’s Guide v4.0 67

4 Accessing the Nokia IP45 Security Platform

For more information about CLI commands, see the Nokia IP45 Security Platform CLI Reference Guide, Version 4.0.

Using Telnet to Connect to the Nokia IP45 Security Platform

You can access the command-line interface through a Telnet session.

Telnet access is disabled by default. You can allow Telnet access from the LAN, and WAN by configuring separate user rules. (No LAN or WAN access is available until it is configured)

Note

Before you start Telnet, ensure that the Telnet program is installed on your computer, and that you can access the IP45 by using Telnet. The method for starting Telnet differs between operating systems. You can use the method given here to start a Telnet session from Windows 2000.

To connect to the IP45 security platform by using Telnet

1. Choose Start > Run

2. In the command window that opens, type telnet followed by the IP address of your IP45

security platform.

If your device IP address is 192.168.10.1, the run window opens as follows:

3. Click OK.

68 Nokia IP45 Security Platform User’s Guide v4.0

Configuration Methods

The Telnet command window opens with a login prompt.

4. Enter your username and password.You can now manage your IP45 security platform by

using simple commands.

5. Press the tab key to view a list of useful, simple commands to start managing your IP45. For

more information, see the Nokia IP45 Security Platform CLI Reference Guide Version 4.0.

Enabling and Disabling Telnet Access to Nokia IP45

Telnet access is disabled by default.

Use the following command from the IP45 CLI to enable Telnet access to the device:

set acl service telnet enable

Use the following command to disable Telnet:

set acl service telnet disable

This command disables Telnet access from the WAN, LAN, and DMZ ports.

Nokia IP45 Security Platform User’s Guide v4.0 69

4 Accessing the Nokia IP45 Security Platform

Using Secure Shell to Connect to the Nokia IP45 Security Platform

You can use Secure Shell (SSH) to access your IP45 security platform, securely. SSH is an application protocol and software suite that allows secure network services over an insecure network such as the Internet.

Note

By default, SSH access is allowed from LAN, and DMZ.

To access your Nokia IP45 security platform with SSH

1. Install an SSH client that allows you to make SSH connections to your IP45.

2. Provide the following information to connect to the device:

 IP Address of the device

 username

 Authentication method, whether Password or Public Key

For more information about SSH, see “Configuring Network Access” on page 191.

Accessing Nokia IP45 with HTTP and HTTPS

You can access and manage your IP45 through a user-friendly GUI. For more information, see

Logging On to the Nokia IP45 Security Platform on page 55.

Managing Large Scale Deployments of Nokia IP45

You can centrally manage the Nokia IP45 security platform by using the following applications:

 Nokia Horizon Manager

 Check Point SmartCenter LSM

 SofaWare Management Portal

These centralized management applications allow you to manage large-scale deployments.

For an overview of how to manage your device, see “Using Managed Services” on page 303.

70 Nokia IP45 Security Platform User’s Guide v4.0

Managing Large Scale Deployments of Nokia IP45

Deploying the Nokia IP45 Security Platform with the Nokia Horizon Manager

You can manage the Nokia IP45 security platform by using the Nokia Horizon Manager.

Nokia Horizon Manager is a software application designed to manage, and configure a large number of Nokia IP security platforms (devices) that reside on a corporate enterprise, managed service provider (MSP), or hosted applications service provider network (ASP).

You can use Nokia Horizon Manager to perform software inventory, configuration, and image management operations.

Deploying the Nokia IP45 Security Platform with the Check Point SmartCenter Large Scale Manager

The Check Point SmartCenter Large Scale Manager (LSM) allows you to manage many Check Point Remote Office/Branch Office (ROBO) gateways from a single SmartCenter Server.

For additional information on installing and configuring LSM, see Check Point SmartCenter LSM documentation.

Deploying Nokia IP45 with SofaWare Management Portal

The SofaWare Security Management Portal (SMP) is a security platform that enables centralized management of a large number of firewalls embedded in broadband access devices or gateways.

You can use the SofaWare SMP for both policy and configuration management.

Note

Configure the management servers by using SofaWare Management Portal before you can use subscription services such as Web filtering, email antivirus, and software updates by Nokia IP45.

Using the Sofaware Management Portal, you can:

 Update security policies and user interface files.

 Configure and fine-tune SofaWare management services like Web filtering, email antivirus,

and software updates.

Nokia IP45 Security Platform User’s Guide v4.0 71

4 Accessing the Nokia IP45 Security Platform

72 Nokia IP45 Security Platform User’s Guide v4.0

5 Connecting to the Internet with the

Nokia IP45 Security Platform

This chapter explains how to configure the Internet to make a secure connection by using the Nokia IP45 security platform.

This chapter includes the following topics:

 Using the Setup Wizard

 Manually Configuring the Internet Setting

 Enabling or Disabling the Internet Connection

 Using Quick Internet Connect or Disconnect

 Configuring a Backup Internet Connection

 Detecting Dead Connections

Configuring an Internet Connection

You can configure an Internet connection by using one of the following setup tools:

 Setup Wizard—guides you through the configuration process, step by step.

 Advanced Setup—provides advanced setup options.

Note

You must configure the Internet connection on initial operation, and reset to defaults operations.

Using the Setup Wizard

You can use the Setup Wizard to configure the Internet connection for the Nokia IP45 security platform through the graphical user interface (GUI). The Setup Wizard guides you through the configuration process, step by step.

You can connect to the Internet using any of the following broadband connection methods:

 PPPoE (PPP over Ethernet)

 PPTP

Nokia IP45 Security Platform User’s Guide v4.0 73

5 Connecting to the Internet with the Nokia IP45 Security Platform

 Cable Modem

 Static IP

 DHCP (Dynamic IP)

Note

The IP45 Setup wizard, which you can use for basic configuration of the device, is always accessible from Setup > Firmware.

To configure an Internet connection by using the setup wizard

1. Choose Network from the main menu.

The Internet page opens.

2. Click Internet Wizard at the bottom of the page.

The IP45 Internet Wizard appears.

74 Nokia IP45 Security Platform User’s Guide v4.0

Configuring an Internet Connection

3. Click Next to proceed.

4. The Internet Connection Method window opens.

5. Select the Internet connection method, and click Next.

You can choose between the following modes of broadband connection:

 PPPoE (PPP over Ethernet)

 PPTP

 Cable Modem

 Static IP

 DHCP (Dynamic IP)

Note

If you select to connect by PPTP or PPPoE dialer, do not use dial-up software to connect to the Internet. The IP45 does the PPPoE negotiation.

6. Follow the wizard instructions until the Connected message appears.

Nokia IP45 Security Platform User’s Guide v4.0 75

5 Connecting to the Internet with the Nokia IP45 Security Platform

7. Click Finish.

You are now connected to the Internet.

The wizard prompts you to register and set up your subscription options, which vary from product to product.

For information about configuring device time, registering with Nokia Support Center and subscribing to additional services with the Setup wizard, see “Getting Started” on page 49.

Cable Modem Connection Settings

If you select cable modem connection through the procedure “To configure an Internet

connection by using the setup wizard” on page 74, the Identification window opens.

Type the Host name and MAC Clone address if they are required by the ISP. For more details on cloning MAC address, see “To configure for cable modem connection” on page 77.

76 Nokia IP45 Security Platform User’s Guide v4.0

To configure for cable modem connection

1. Type the Host name in the Identification window.

This field is optional. It might be required by your ISP and if so the ISP provides it.

2. Click Next.

The Confirmation message appears.

3. Click Next.

The device attempts to connect to the Internet.

At the end of the connection process, the Connected message appears. When you are connected, the wizard prompts you to register your details and set up your subscription options, which vary from product to product.

4. Follow the instructions until the wizard is done, and then click Finish.

MAC Cloning

Some ISPs require that you register any MAC addresses of the computer behind the cable modem before you establish an Internet connection.

MAC Cloning

Nokia IP45 takes the place of the computer behind the cable modem and you can use MAC cloning to enter the original computer MAC address without contacting the ISP to change that information.

Cloning a MAC Address

A MAC address is a 12-digit identifier assigned to every network device. If your ISP restricts connections to specific, recognized MAC addresses, you must clone a MAC address.

IP45 v4.0 supports MAC cloning for WAN2 (DMZ).

To clone a MAC address

1. Choose Network from the main menu.

The Internet page opens.

2. To clone the MAC address, click the Edit next to the interface.

The Internet Setup page opens.

3. Click Show Advanced Settings.

Nokia IP45 Security Platform User’s Guide v4.0 77

5 Connecting to the Internet with the Nokia IP45 Security Platform

The Internet Setup page now displays the MAC cloning option.

4. Select MAC Cloning. Do one of the following:

a. Click This Computer to automatically clone the MAC address of your computer to the

IP45.

b. If the ISP requires authentication by using the MAC address of a different computer, type

the MAC address in the Cloned MAC Address field.

5. Click Apply.

78 Nokia IP45 Security Platform User’s Guide v4.0

To connect by using a PPPoE connection

1. Select PPPoE from the Internet Connection Method window.

The PPP Configuration window opens.

2. Type the following:

a. Your username, and password and confirm the password.

MAC Cloning

b. The service name. This field is optional.

3. Click Next.

The system attempts to connect to the Internet through the PPPoE connection. At the end of the connection process, the Connected message appears.

To connect by using the PPTP connection

1. Select PPTP from the Internet Connection Method window.

The PPP Configuration window opens.

2. Type the following information:

 Username and Password, and confirm the password.

Nokia IP45 Security Platform User’s Guide v4.0 79

5 Connecting to the Internet with the Nokia IP45 Security Platform

 Service name.

 IP address of the PPTP modem in the Server IP text box.

 Local IP address required for accessing the PPTP modem in the Internal IP text box.

 Subnet Mask of the PPTP modem.

3. Click Next.

The Connecting message appears while the system attempts to connect to the Internet through the PPTP connection. At the end of the connection process, the Connected message appears.

To connect by using a static IP connection

1. Select Static IP from the Internet Connection Method window.

The Static IP Configuration window opens.

2. Type the following information:

 Static IP address of the Nokia IP45 appliance.

 Subnet Mask that applies to the static IP address.

 IP address of the Default Gateway of your Internet service provider.

 IP address of the Primary DNS Server

 IP address of the Secondary DNS Server. This field is optional.

 IP address of the WINS Server. This field is optional.

3. Click Next.

The Connecting message appears while the system attempts to connect to the Internet through the static IP connection. At the end of the connection process, the Connected message appears.

80 Nokia IP45 Security Platform User’s Guide v4.0

Manually Configuring the Internet Setting

To connect using a DHCP connection

1. Select DHCP (Dynamic IP) from the Internet Connection Method window.

2. Click Next.

The Confirmation message appears.

3. Click Next.

The Connecting message appears while the system attempts to connect to the Internet through the DHCP connection. At the end of the connection process, the Connected message appears.

Manually Configuring the Internet Setting

You can configure the Internet settings for your IP45 manually.

To configure the Internet connection

1. Proceed as per steps 1 and 2 in “Using the Setup Wizard” on page 73 to connect using PPTP

and PPPoE.

2. Click Cancel on the Internet Setup wizard.

Nokia IP45 Security Platform User’s Guide v4.0 81

5 Connecting to the Internet with the Nokia IP45 Security Platform

The Welcome page is displayed.

3. Choose Network from the main menu.

The Internet page opens.

4. Click Edit next to Primary.

The Internet Setup page with a list of connection type options appears.

5. Select the Connection Type.

The display changes according to the connection type you select. Perform the following procedures in accordance with the connection type you choose.

To use a LAN connection

The following steps provide details about the LAN connection.

1. Select LAN connection from the Internet Setup page at Connection Type.

2. Click Show Advanced Settings.

82 Nokia IP45 Security Platform User’s Guide v4.0

The following page opens.

Manually Configuring the Internet Setting

3. Select the Port: WAN, WAN2, Serial, None.

4. If you do not want the IP45 to obtain an IP address automatically by using DHCP, do the

following:

a. Uncheck the Obtain IP address automatically (using DHCP) check box.

b. Type the IP address that your service provider provides.

c. Select the subnet mask from the drop-down list that applies to the IP address you Typed.

d. Type the IP address of the default gateway of your service provider.

5. To assign an IP address automatically by using DHCP, but not configure DNS servers

automatically, do the following:

a. Uncheck the Obtain DNS Servers automatically check box.

b. Type the Primary DNS server IP address.

c. Type the Secondary DNS server IP address.

d. Type the WINS Server IP address.

6. Select the Shape Upstream and Shape Downstream to enable traffic shaper.

7. Type the Upstream Link Rate value in kbps.

8. Type the Downstream Link Rate value in kbps, slightly lower than the Upstream Link Rate

value.

Nokia IP45 Security Platform User’s Guide v4.0 83

5 Connecting to the Internet with the Nokia IP45 Security Platform

9. Click Show Advanced Settings.

10. Type the maximum transmission unit (MTU-1500)

11. Ty pe th e Hos t Nam e.

This field is optional: some ISPs might require it, and they provide the host name.

12. Click Apply.

To use a cable modem connection

1. Select Cable Modem type from the Internet Setup page at Connection Type.

2. Click Show Advanced Settings.

The Internet Setup page opens.

3. Enter the Host Name.

This field is optional: some ISPs might require it, and they provide the host name.

4. Complete the remaining fields as per the information provided in the procedure “To use a

LAN connection” on page 82.

5. Click Apply.

To use a PPPoE connection

1. Choose PPPoE from the Internet Setup page at Connection Type.

2. Click Show Advanced Settings.

84 Nokia IP45 Security Platform User’s Guide v4.0

The following page opens:

Manually Configuring the Internet Setting

3. Enter the following information:

 Enter your Username and Password, and confirm the Password.

 Enter the service name as given by your service center

Note

If your service center did not provide you with a service name, leave this text box empty.

You can set the maximum transmission unit size (MTU). Nokia recommends that you leave this field empty. However, to modify the default MTU, consult with your service provider.

4. If you are not using automatic configuration of DNS servers, do the following:

 Uncheck the Obtain Domain Name Servers automatically check box

 Enter the Primary DNS server IP address.

 Enter the Secondary DNS server IP address.

 Enter the WINS Server IP address.

Nokia IP45 Security Platform User’s Guide v4.0 85

5 Connecting to the Internet with the Nokia IP45 Security Platform

The following page opens:

5. Click Apply.

To use a PPTP connection

1. Choose PPTP Internet Setup page at Connection Type.

2. Click Show Advanced Settings.

86 Nokia IP45 Security Platform User’s Guide v4.0

The following page opens:

Manually Configuring the Internet Setting

3. Enter the following information:

a. Your username and password, and confirm the password.

b. The service name as given by your service provider.

c. The IP address of the PPTP server as given by your service provider.

d. The IP address of the PPTP client as given by your service provider.

e. Select the PPTP client subnet as given by your service provider.

You can configure the MTU size. Nokia recommends that you leave this field empty. Consult your service provider to modify the default MTU.

4. If you are not using automatic configuration of DNS servers, do the following:

a. Clear the Obtain DNS servers automatically check box.

The Internet page with DNS server options appears.

b. Enter the Primary DNS server IP address.

c. Enter the Secondary DNS server IP address.

Nokia IP45 Security Platform User’s Guide v4.0 87

5 Connecting to the Internet with the Nokia IP45 Security Platform

5. Click Apply.

Table 14 Internet Connection Fields

Field Action

Host Name Type the hostname for authentication.

If your ISP has not provided you with a host name, leave this field blank. Most ISPs do not require a specific hostname.

Port Type of port you want to use for connecting to the Internet.

Options:

• WAN: configuring an ethernet-based connection through WAN port.

• WAN2: configuring an ethernet-based connection through DMZ/ WAN2 port.

• Serial: to configure a dial-up connection.

• None: To configure none.

Username Type your user name.

Password Type your password.

Confirm password

Service Type your service name.

Server IP IP address of the server.

Internal IP Local IP address.

Obtain IP address automatically

(Using DHCP)

Obtain Domain Name Servers automatically

IP Address Type the static IP address of your IP45 device.

Re type your password to confirm.

If your ISP has not provided you with a service name, leave this field empty.

If you selected PPTP, type the IP address of the PPTP server as given by your ISP.

If you selected PPTP, type the local IP address required for accessing the PPTP modem.

Clear this option if you do not want the Nokia IP45 device to obtain an IP address automatically.

Subnet Mask Select the subnet mask that applies to the static IP

address of your device.

88 Nokia IP45 Security Platform User’s Guide v4.0

Table 14 Internet Connection Fields (continued)

Field Action

Manually Configuring the Internet Setting

Default Gateway.

Primary DNS Server

Secondary DNS Server

WINS Server

Shape Upstream

Link Rate

Shape Downstream

Link Rate

Type the IP address of your ISP’s default gateway.

Type the primary DNS server IP address.

Type the secondary DNS server IP address.

Type the WINS server IP address.

Select this option to enable traffic shaper for outgoing traffic. Type a rate (in kilobits/second) slightly lower than

lower than the maximum measured upstream speed of your Internet connection,

Try different rates in order to determine which one provides the best results.

For information on using traffic shaper, see “Using Traffic Shaper” on page 127.

Select this option to enable Traffic Shaper for incoming traffic.

Then type a rate (in kilobits/second) slightly lower than

in the field provided.

lower than the maximum measured downstream speed of your Internet connection.

You may try different rates in order to determine which one provides the best results.

Note

Traffic Shaper cannot control the number or type of packets it receives from the Internet; it can only affect the rate of incoming traffic by dropping inbound traffic less accurate than the shaping of outbound traffic. It is therefore recommended to enable traffic shaping for incoming traffic only if necessary.

For information on using Traffic Shaper, see“Using Traffic Shaper” on page 127.

Do not connect if this gateway is in passive state

If you are using High Availability, select this option to configure WAN high availability. The gateway connects to the Internet only if it is the active gateway in the high availability cluster.

This field is only enabled if high availability is configured. For information on high availability, see “High-Availability” on page

213.

Nokia IP45 Security Platform User’s Guide v4.0 89

5 Connecting to the Internet with the Nokia IP45 Security Platform

Table 14 Internet Connection Fields (continued)

Field Action

External IP If you selected PPTP, type the IP address of the PPTP client as

given by your ISP. If you selected PPPoE, this field is optional, and you need not enter this value unless specified by your ISP.

MTU This field allows you to control the maximum transmission unit

size. As a general recommendation you should leave this field empty. To modify the default MTU value, it is recommended

that you consult with your ISP first and use MTU values between 1300 and 1500.

Dial-Up PPP

You can connect the Nokia IP45 security platform to the Internet by using a dial-up connection. The device can establish a PPP connection to an ISP by using an external modem connected to an auxiliary port. The modem can be an analog modem or an ISDN terminal adapter.

You can use the following modems:

 Analog modem 56 Kbps (DTE speed: up to 115200)

 ISDN TA (using PPP) 64 Kbps (DTE speed: up to 230400)

 ISDN TA (using MLPPP) 128 Kbps (DTE speed: up to 460800)

Configuring Dial-Up

You can configure the dial-up option using either the GUI or the command-line interface (CLI).

Using the GUI

The following sections provide details about how to configure dial-up connections on the Nokia IP45 security platform by using the GUI:

90 Nokia IP45 Security Platform User’s Guide v4.0

To configure dial-up settings using the GUI

1. Choose Network from the main menu.

The Internet page opens.

Dial-Up PPP

2. Click Edit next to the Primary Internet connection.

The Internet Setup page opens.

3. Select Serial from the drop-down list next to Port.

4. Select Dialup from the drop-down list next to Connection Type.

The following page opens.

5. Click Apply.

Dialup is configured.

Nokia IP45 Security Platform User’s Guide v4.0 91

5 Connecting to the Internet with the Nokia IP45 Security Platform

Configuring Dial-up Setting by Using the CLI

To configure the dial-up by using the command line interface, log in through the console port.

Dial-up mode can be enabled by using the following options available in the CLI:

 Disable—WAN connection is established regardless of any interesting traffic.

 Immediate—WAN connection is established only when no other higher priority connection

(primary) exists, regardless of any interesting traffic. This connection becomes inactive when primary becomes active.

Note

Any traffic that goes to the Internet through LAN is called interesting traffic.

 Activity—WAN connection is established only when interesting traffic is initiated from

internal network to WAN and when no other higher priority connection (primary) exists. The dialup connection terminates if another higher priority connection becomes active or if there is no traffic for 1 minute.

Note

Dial-up connection option (always on, demand dialing) and other parameters (number, username, password, and so on) can be configured by using CLI.

Use the following commands to configure the dialup profile:

set interface wan mode dialup connectondemand <disable |immediate | activity>

set interface wan2 mode dialup connectondemand <disable activity>

For more information about dial-up commands, see the Nokia IP45 Security Platform CLI Reference Guide Version 4.0.

CLI Wizard

Use the following command to configure dial-up by using the CLI wizard:

wizard dialup

For more information about how to use other dialup commands, see the Nokia IP45 Security Platform CLI Reference Guide, Version 4.0.

Multiple Dial-up Profiles

The Nokia IP45 security platform supports 10 dial-up profiles. A round-robin mechanism is used to choose the profiles for connecting to the Internet. By default, the first dial-up profile is used. On failure of the first dial-up, the device attempts to use the successive profiles for successful Internet connection.

|immediate |

92 Nokia IP45 Security Platform User’s Guide v4.0

Enabling or Disabling the Internet Connection

Either dial-up or an out-of-band management (OOB) instance alone can exist on the device at any given time.

Note

You can configure ten dial-up profiles. Only one profile will be active at a time.You cannot configure dial-up for both primary and secondary Internet connections.

Enabling or Disabling the Internet Connection

You can enable or disable the Internet connection by using the following procedure.

To enable or disable the Internet connection

1. Choose Network from the main menu.

The Internet page opens.

2. Next to the Internet connection, do one of the following:

a. To enable the connection, click the adjacent sign (x) mark

The button changes to a check mark, and the connection is enabled.

b. To disable the connection, click the adjacent check mark.

The button changes to sign (x) mark, and the connection is disabled.

Using Quick Internet Connect or Disconnect

By using connect or disconnect (depending on the connection status) on the Internet page, you can establish a quick Internet connection by using the currently selected connection type. In the same manner, you can terminate the active connection.

The Internet connection retains its connected or not connected status until the Nokia IP45 is rebooted. The IP45 then connects to the Internet if the connection is enabled. For information on how to enable the Internet connection, see “Enabling or Disabling the Internet Connection” on page 93.

Configuring a Backup Internet Connection

You can configure both a primary and a secondary Internet connection for the Nokia IP45 security platform. The secondary connection acts as a backup, so that even if the primary connection fails, the IP45 remains connected to the Internet.

You can configure different DNS servers for the two connections. The IP45 device acts as a DNS relay and routes requests from computers within the network to the appropriate DNS server for the active Internet connection.

Nokia IP45 Security Platform User’s Guide v4.0 93

5 Connecting to the Internet with the Nokia IP45 Security Platform

The two connections can be of different types. But they both cannot be LAN, and DHCP connections.

To set up backup Internet connection

1. Choose Networks from the main menu.

The Internet page opens.

2. Click Edit next to Primary, and Secondary connection types to configure a backup Internet

connection.

For basic topology illustrations, see “Connecting the Nokia IP45 Security Platform to the

Network” on page 47.

Note

To physically connect multiple WAN devices to Nokia IP45, you must have a switch, connected to the WAN port.

Viewing Internet Information

To view the status, duration, and activity information, choose Network from the main menu. The Internet page opens.

Table 15 displays the Internet connection information.

Table 15 Internet Connection Information

Field Description

Status Indicates the connection status.

Duration Indicates the connection duration, if active. The duration is given in

the format hh:mm:ss, where: hh = hours mm = minutes ss = seconds

IP Address Your IP address

Enabled Indicates whether or not the connection is enabled.

WAN MAC Address

Cloned MAC Address

MAC address of IP45.

Cloned MAC address.

94 Nokia IP45 Security Platform User’s Guide v4.0

Table 15 Internet Connection Information (continued)

Field Description

Detecting Dead Connections

Received Packets

Sent Packets Number of data packets sent in the active connection.

Number of data packets received in the active connection.

Detecting Dead Connections

The Nokia IP45 security platform v4.0 supports dead internet connection detection. If the Internet connection is identified to be inactive, a failover is performed to the secondary Internet connection to insure continuous connectivity.

You can detect dead connection by using the methods as described in the following procedure.

To configure dead connection detection

1. Choose Internet from the main menu.

2. Click Edit next to the type of connection to choose. For example Primary LAN.

The following page opens.

3. Click Show Advanced Settings.

The following page opens displaying the dead connection configuration details.

Nokia IP45 Security Platform User’s Guide v4.0 95

5 Connecting to the Internet with the Nokia IP45 Security Platform

4. To automatically detect the loss of connectivity to the default gateway, select Probe Next

Hop.

5. Select probing method from the options provided in Connection Probing Method drop-down

list.

6. Choose the values for the option selected by using the information provided in Tab le 16.

7. Click Apply.

96 Nokia IP45 Security Platform User’s Guide v4.0

Table 16 Dead Connection Detection

Field Description

Detecting Dead Connections

Probe Next Hop

Connection Probing Method

Select this option to automatically detect loss of connectivity to the default gateway. If the default gateway does not respond and the Internet connection is considered to be down, a failover is performed to the second Internet connection, (if configured) to ensure continuous Internet connectivity.

By default, this option is selected.

Select the method for probing by using this option. The probing methods available are:

• None (default value)—does not perform Internet connection

probing. Next hop probing is still used, if the Probe Next Hop check box is selected. This is the default value

• Ping Addresses—ping anywhere from one to three servers

specified by IP address or DNS name in the 1, 2, and 3 fields. If no response is received for 45 seconds from the defined servers, the Internet connection is considered to be inactive. Use this method if you have reliable servers that can be pinged.

• Probe DNS Servers—probes the primary and secondary DNS

servers. If no response is received for 45 seconds from any of the gateways, the Internet connection is considered to be inactive.

• Probe VPN Gateway (RDP)—sends RDP echo requests to up to

three Check Point VPN gateways specified by IP address or DNS name in the 1, 2, and 3 fields. If no response is received for 45 seconds from any of the defined gateways, the Internet connection is considered to be inactive.

For information about how to configure dead connection detection by using the CLI, see the

Nokia IP45 Security Platform CLI Reference Guide Version 4.0.

Nokia IP45 Security Platform User’s Guide v4.0 97

5 Connecting to the Internet with the Nokia IP45 Security Platform

98 Nokia IP45 Security Platform User’s Guide v4.0

6 Managing your Local Area Network

This chapter provides detailed information to manage your local area network by using the Nokia IP45 security platform.

You can manage and configure your network connection and settings, and view the connections information on the connection in terms of status, connection duration, and activity.

This chapter includes the following topics:

 Configuring Network Settings

 Enabling and Disabling the DHCP Server

 Changing IP Addresses

 Configuring Network Objects

 Configuring DHCP Reservation

 OSPF

 Viewing Ports Status

 Configuring Source Routes

 Defining the Port Link Speed

Configuring Network Settings

Caution

Network settings are advanced settings. Nokia recommends that these settings not be changed unless it is necessary and you are qualified to do so. Changing network settings might result in losing the connection to the device.

If you change the network settings to incorrect values, and you are unable to correct the error, reset the IP45 to its factory settings.

To reset the Nokia IP45 security platform to its factory default settings, choose Setup > Firmware > Tools > Factory Settings. You can also press the Reset button at the rear panel of the device.

Nokia IP45 Security Platform User’s Guide v4.0 99

6 Managing your Local Area Network

Note

To set the device to factory defaults by using the Reset button, press the Reset button for a minimum of seven seconds.

Enabling and Disabling the DHCP Server

The Nokia IP45 security platform has a built-in Dynamic Host Configuration Protocol (DHCP) server that is enabled by default. This allows the IP45 to configure all the devices on your network automatically.

If you have another DHCP server configured in your network, you must disable the DHCP server in your IP45 before you connect the IP45 to the network.

To enable or disable the DHCP server

1. Choose Network from the main menu.

The Internet page opens.

2. Click My Network.

The My Network page opens.

3. To configure the DHCP server for LAN/DMZ settings, click Edit next to LAN/DMZ.

100 Nokia IP45 Security Platform User’s Guide v4.0

Nokia IP45 User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

Contents

About this Guide

In this Guide

Conventions this Guide uses

Notices

Command-Line Conventions

Text Conventions

Menu Items

Related Documentation

1 Introduction

About the Nokia IP45 Security Platform

Nokia IP45 Tele 8

Nokia IP45 Satellite 16, Satellite 32, Satellite Unlimited

Nokia IP45 Security Platform Features

Connectivity

Firewall

VPN Connectivity

Management

Security Services

Diagnostics and Maintenance

Network Requirements

Overview

Nokia IP45 Security Platform Rear Panel

Nokia IP45 Security Platform Front Panel

Before you Install the Nokia IP45 Security Platform

Setting Up the Nokia IP45 Security Platform with Microsoft Windows XP and 2000 Operating Systems

Setting Up the Nokia IP45 Security Platform with an Apple Computer

Connecting the Nokia IP45 Security Platform to the Network

Installing your Network

3 Getting Started

First-Time Login

Configuring the Nokia IP45 Security Platform for Internet Connection

Making Initial Nokia IP45 Security Platform Settings

Setting the Nokia IP45 Security Platform Time

Registering with the Nokia Support Site

Connecting to a Central Management Server

Logging On to the Nokia IP45 Security Platform

Accessing Nokia IP45 Securely

Logging Off from the Nokia IP45 Security Platform

Understanding the Nokia IP45 Web GUI

Using the Nokia IP45 Security Platform Web-based User Interface

Graphical User Interface Details

Connection Methods

Configuration Methods

Connecting the Nokia IP45 Security Platform to a Computer by Using the Console Port

Using Telnet to Connect to the Nokia IP45 Security Platform

Enabling and Disabling Telnet Access to Nokia IP45

Using Secure Shell to Connect to the Nokia IP45 Security Platform

Accessing Nokia IP45 with HTTP and HTTPS

Managing Large Scale Deployments of Nokia IP45

Deploying the Nokia IP45 Security Platform with the Nokia Horizon Manager

Deploying the Nokia IP45 Security Platform with the Check Point SmartCenter Large Scale Manager

Deploying Nokia IP45 with SofaWare Management Portal

Configuring an Internet Connection

Using the Setup Wizard

Cable Modem Connection Settings

MAC Cloning

Cloning a MAC Address

Manually Configuring the Internet Setting

Dial-Up PPP

Configuring Dial-Up

Using the GUI

Configuring Dial-up Setting by Using the CLI

Multiple Dial-up Profiles

Enabling or Disabling the Internet Connection

Using Quick Internet Connect or Disconnect

Configuring a Backup Internet Connection

Viewing Internet Information

Detecting Dead Connections

6 Managing your Local Area Network

Configuring Network Settings

Enabling and Disabling the DHCP Server