Resumen del contenido incluido en la página 1
RSA SecurID Ready Implementation Guide
Last Modified: September 30, 2005
Partner Information
Product Information
Partner Name Nortel Networks
Web Site www.nortelnetworks.com
Product Name Nortel VPN Router
1050, 1740, 2700, 5000 Series
Version & Platform
Each Nortel VPN Router is a single hardware device that provides routing,
Product Description
firewall, bandwidth management, encryption, authentication, and data
integrity for secure tunneling across managed IP networks and the Inte
Resumen del contenido incluido en la página 2
Solution Summary Partner Integration Overview RADIUS Authentication Methods Supported N/A List Library Version Used No RSA Authentication Manager Name Locking No RSA Authentication Manager Replica Support Yes (3) Secondary RADIUS Server Support ‘None stored’ Location of Node Secret on Agent Communication Server RSA Authentication Agent Host Type Designated users RSA SecurID User Specification No RSA SecurID Protection of Administrative Users Yes RSA Software Token API Integr
Resumen del contenido incluido en la página 3
Product Requirements Partner Product Requirements: Nortel VPN Router Firmware Version V05_05.202 Partner Product Requirements: Nortel VPN Client Operating System Required Patches Windows XP Windows 2000 Windows 98 Windows ME Note: Nortel VPN Client Version 4.86 is the last release that provides support for the Windows NT operating system. Version 4.91 will be the last release that provides support for Windows 98 and Windows ME operating systems. 3
Resumen del contenido incluido en la página 4
Agent Host Configuration To facilitate communication between the Nortel VPN Router and the RSA Authentication Manager / RSA SecurID Appliance, an Agent Host record must be added to the RSA Authentication Manager database. The Agent Host record identifies the Nortel VPN Router within its database and contains information about communication and encryption. To create the Agent Host record, you will need the following information. • Hostname • IP Addresses for all network interfaces • RADIU
Resumen del contenido incluido en la página 5
Partner Authentication Agent Configuration Before You Begin This section provides instructions for integrating the Nortel VPN Router with RSA SecurID Authentication. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products in order to insta
Resumen del contenido incluido en la página 6
4. In the ‘RADIUS Servers’ section, fill out the info required. The Secret information for these servers should match the encryption key assigned in the Agent Host configuration. RADIUS Group Configuration Any user seeking RADIUS authentication must belong to a group specified by a group ID and password, configured in the Profiles > Groups > Edit > IPSec > Authentication > Configure page. This is a two-step process where (1) the Switch authenticates the remote user with RSA SecurID toke
Resumen del contenido incluido en la página 7
IPSec Client configuration Upon first run of the Contivity VPN Client, you will be prompted to create a connection profile via the Connection Wizard. Use the screenshots below as a guide to setting up your connection for RSA SecurID authentication. For a detailed explanation of each configuration parameter, please reference the manuals from Nortel that comes with the client software. Connection Wizard Connection Profile name and description Authentication type Token card typ
Resumen del contenido incluido en la página 8
User ID for RSA SecurID Authentication Name/IP Address of switch Do you need to initiate a dial up connection first or are you Setup complete! already connected to the internet/network? Login screen 8
Resumen del contenido incluido en la página 9
Certification Checklist Date Tested: September 30, 2005 Certification Environment Product Name Version Information Operating System 6.1 Windows 2003 Server (SP1) RSA Authentication Manager 3.0.5 Windows XP Professional (SP2) RSA Software Token 1.0 Build 25 Windows XP Professional (SP2) RSA Authentication Utility 1050 Firmware V05_05.202 Nortel VPN Router Mandatory Functionality RSA Native Protocol RADIUS Protocol New PIN Mode Force Authentication After New PIN Force Authent
Resumen del contenido incluido en la página 10
Known Issues RSA Software Token The Contivity VPN Client can be configured to detect the installation of the RSA Software Token through the presence of stauto32.dll. Users will then be prompted for their Pin only. The Tokencode displayed on the Software Token is automatically coupled with the Pin and passed along to the RSA ACE/Server. This functionality is configured within the Contivity VPN Client under (Options > Authentication Options > Response Only Token > Options > Use Installed S
Resumen del contenido incluido en la página 11
Alphanumeric PINS The Contivity VPN Client does not allow alphabetic characters to be entered in the Passcode field of the connection dialog box. There is a workaround for instances where alphanumeric PINs are allowed for SecurID users, the Contivity VPN Client must be configured to display separate Tokencode and PIN fields. This is achieved by clearing the Use Passcode Display checkbox in the Two-Factor Authentication Token Options dialog. The user can then enter an alphanumeric PIN in
Resumen del contenido incluido en la página 12
RSA Authentication Utility (SID800 Integration) Authentication fails if user enters 0000 as permanent SecurID PIN. A user may not be able to authenticate when completing the New PIN procedure if the user enters four zeros (0000) as the permanent PIN. You cannot use 0000 as a permanent PIN. System-generated RSA SecurID SID800 PIN with VPN Client If your USB token is in New PIN mode during authentication to a VPN client, and the RSA Authentication Manager requires that you accept a system-ge
