Copyright information

NetScreen-Remote™ Help System
NetScreen-Remote™ Software Version 8 (07.31.02)
© 1998-2002 NetScreen Technologies, Inc. All rights reserved.

QBullets are used to indicate the function of hypertext links. QBullets appear courtesy of Matterform Media [image] . QBullets are freeware, © 1996 by Matterform Media.


What is NetScreen-Remote?

NetScreen-Remote software is a full-featured product ready for advanced IPSec communications that secures traffic sent from a desktop or laptop computer across a public or private TCP/IP network. When NetScreen-Remote operates on an unprotected public network, such as the Internet, it can create a virtual private network (VPN) tunnel between an end user and a NetScreen security appliance. NetScreen-Remote allows users to specify an internal network IP address to be used for client-to-gateway communications.

Network Applications

NetScreen-Remote supports secure client-to-gateway or client-to-client communications. Traveling “road warriors,” for example, can telecommute from their home or virtual offices to the main office through the Internet or other dial-in remote access devices for secure client-to-gateway communications. Organizations that require a low-cost solution for secure communications among their employees or members across a private LAN, WAN, or individual dial-up connections, for another example, can use NetScreen-Remote for secure client-to-client communications.

Interoperability

NetScreen-Remote is interoperable with IPSec devices from major equipment manufacturers. It has been awarded IPSec certification from the International Computer Security Association (ICSA). NetScreen-Remote interoperates with IPSec-compliant gateways such as the family of NetScreen Security Appliances. More information regarding ICSA IPSec certification can be found at www.icsa.net [image] .


How does NetScreen-Remote work?

The Encryption Methods

The Tools You Need

Setup in Three Main Steps

Daily Operations

Troubleshooting

The Encryption Methods

NetScreen-Remote secures data communications through the latest encryption technology—IPSec (Internet Protocol Security) and public key. Within IPSec there are three methods for creating a secure tunnel for transmitting data:

  • Public Key Encryption

  • Pre-Shared Key Encryption

  • Manual Key Encryption

Public Key Encryption

Public Key is different from the other main type of encryption system, which is known as Pre-shared Key or Preshared Secret, because it allows end users to communicate with each other over a TCP/IP network, such as the Internet, without advanced notice. That is, neither party needs to belong to an existing secure communications network nor have exchanged keys beforehand.

Unlike Pre-shared Key and Manual Key encryption, Public Key encryption does not require real-time, online, centralized key management to distribute the keys that are required to secure data for each communications session. Public Key employs digital certificates and is based on key pairs, comprising a private key and a public key. Each party retains his or her own private key half of the key pair, while a certificate authority (CA) or directory server distributes the public key half to anyone who requests it.

Once someone obtains another party’s Public Key and attempts to communicate, NetScreen-Remote negotiates its security parameters against the other party’s security policy to secure the transmission. The security policy determines, for example, whom it will exchange information with, the encryption strength, and the number of times it will attempt to communicate with the other party before giving up. The sender uses the recipient's Public Key to encrypt the message, and the recipient uses his or her private key to decrypt it.

Pre-Shared Key Encryption

If you do not want to use Public Keys, NetScreen-Remote can create secure communication tunnels using either Pre-Shared Key or Manual Key encryption. The Pre-Shared Key method requires the two parties to agree upon one key in a secure manner in advance. When you require secure communication, you use the secret, Pre-Shared Key as an element of the temporary tunnel. NetScreen-Remote then automatically negotiates the remaining security parameters for that session.

The Pre-Shared Key method can build a secure tunnel faster than the Public Key method, but it requires the users prearrange a shared secret before they initiate security communication negotiations.

You can use Pre-Shared Key to negotiate your AutoKey sessions. This will speed connection establishment. You can also use it in place of digital certificates for testing, troubleshooting, or one-to-one communications that do not require certificates. Using this method, you do not need to contact a CA for Pre-Shared Keys.

Manual Key Encryption

Manual Key encryption is the most basic method for creating VPN tunnels. It is primarily used for troubleshooting. Use Manual Key to help you determine if secure communications are possible.

With Manual Key, the two parties decide all the security parameters manually before attempting communication. Each parties then configures these parameters at each end of the tunnel. As with Pre-Shared Key, you must contact the party you want to communicate with and exchange keys before attempting to transmit secure communications.

Manual Key encryption eliminates the need for a digital certificate and all IKE negotiations. This method is much less secure because the session key and configuration parameters are not new each connection as with Public Key and Pre-Share Key. Be aware that this method requires a heavy advanced commitment to set up. Manual Key tunnels also require more maintenance.

The Tools You Need

NetScreen-Remote provides tools you need to implement Public Key for secure communications. When you generate a certificate request it automatically generates the public/private key pair that you need to obtain that digital certificate from a CA. You need a CA authorized to issue you private certificates. It lets you import and maintain these digital certificates in its Certificate Manager, and it allows you to import or configure your security policy in its Security Policy Editor.

Setup in Three Main Steps

Here is a basic summary of how to set up NetScreen-Remote:

Step 1: Install this product. This is a standard Windows software installation.

Step 2: Determine with your network administrator whether you will be using pre-shared key or public key and digital certificates for your security connection.

  • If you decide to use pre-shared key or manual key encryption, go on to step 3.

  • If you decide to use Public key encryption: Get digital certificates. You can do this by creating a request file and manually cutting and pasting the request to the CA. Or you can generate the request and have NetScreen-Remote send it to the CA using on-line enrollment protocol. For detailed instructions, start with the help topics listed under Certificate Manager.

Step 3: Configure a security policy in Security Policy Editor. For detailed instructions, start with the help topics listed under Security Policy Editor.

Daily Operations

NetScreen-Remote starts automatically each time your computer starts, and runs transparently at all times behind your other software applications. The NetScreen-Remote icon changes color and image to indicate the status of your communications.

In short, green means your computer is transmitting secure communications; red means it is transmitting unsecure communications. Both colors can appear at the same time, which means that your computer is transmitting both secure and unsecure information simultaneously. The yellow key means that your computer has established at least one secure connection.

Troubleshooting

NetScreen-Remote provides the following troubleshooting aids:

  • Log Viewer

  • Connection Monitor


Product features

  • Provides a turnkey installation, upgrade, and uninstallation

  • Operates transparently

  • Is Windows compatible, including communications devices, such as LAN adapters, modems, and PC Cards

  • Provides an intuitive user interface for configuring security policies and managing certificates

  • Requests certificates automatically via Certificate Enrollment Protocol (CEP) technology

  • Is IPSec standards compliant, supporting tunnel modeor transport mode security; DES, Triple-DES, MD-5, and SHA-1 algorithms; and Internet Key Exchange using ISAKMP/Oakley (IKE)

  • Allows users to specify an internal network IP address for client-to-gateway communications

  • Activates or deactivates the security policy for an easy transition from travel, home, or office use

Standards Compliance

This product is ICSA certified and fully compliant with the following IP Security (IPSec) standards:

  • Tunnel mode or transport mode security

  • DES, Triple-DES, MD-5, and SHA-1 algorithms

  • Internet Key Exchange using ISAKMP/Oakley (IKE)

  • Diffie-Hellman Groups 1, 2, and 5

  • All relevant RFCs

  • *IP Compression (IPComp) for data compression

  • PKCS#10 for certificates requests

  • *PKCS#12 for exporting and importing personal certificates and private keys all together.

Compatibility

  • Windows 95, 98, NT, 2000

  • Communications devices, such as LAN adapters, modems, and PC Cards

  • *Windows applications extended authentication, such as RADIUS

  • *Layer 2 Tunneling Protocol (L2TP) for securing non-IP communications established through Dial-Up Networking

Usability

  • Lockable security policy for distribution to end users

  • Allows users to specify internal network IP address to be used for client-to-gateway communications

  • One click Activate/Deactivate security policy for easy transmission from home, travel or office use.

  • *Redundant gateway and keep alive for faster, more reliable connections

  • Central management by the NetScreen-Remote/VPN Policy Manager™ for large-scale deployment

Built-in Support

  • *Certificate Enrollment Protocol (CEP) for online certificate requests

  • Netscape [image], Baltimore, Verisign [image], Entrust [image], RSA's Keon, and Microsoft [image] certificate authorities (CAs)

  • *RSA security for strong two-factor authentication

* NetScreen-Remote contains features that are not currently supported in the NetScreen security appliances' ScreenOS.


Uninstalling

Uninstalling NetScreen-Remote

Caution: You must uninstall any previous NetScreen-Remote version before installing NetScreen-Remote 8!

When you remove this software and its components, you can keep your security policy, digital certificates, and private keys. This allows you to transfer them into the new version once the new software installation is complete. This is recommended if you are uninstalling to upgrade.

  • Click the Start button, point to Settings, and then click Control Panel.

  • Double-click Add/Remove Programs. The Add/Remove Programs Properties window appears.

  • Under the Install/Uninstall tab, select NetScreen-Remote.

  • Click Add/Remove.

  • In the InstallShield Wizard dialog box, click Remove and then click Next.

  • In the Confirm File Deletion dialog box, click OK to completely remove the selected application and all of its components.

  • In the Uninstall Security Policy dialog box, choose a button:

  • To keep security policies, digital certificates, and private keys, click No.

  • To delete security policies, digital certificates, and private keys, click Yes.

  8. When "Maintenance Complete" appears, click Finish to restart the computer.


NetScreen-Remote icon

NetScreen-Remote status icon

The NetScreen-Remote icon is in the status area of the taskbar, which is usually located in the lower right corner of your Windows desktop. This icon will change color and image to reflect the current status of your communications.

NetScreen-Remote icon disabled

NetScreen-Remote icon

NetScreen-Remote with red indicator

NetScreen-Remote icon with yellow key

Icon with yellow key and red indicator

Icon with yellow key & green indicator

Icon with yellow key & red & green indicators

Click an icon for more information.

NetScreen-Remote icon (enabled)

If you have successfully installed this application, you will see this icon before your computer establishes a connection or begins transmitting communications.

NetScreen-Remote icon (disabled)

Your Windows operating system did not start the IreIke service properly. If you see this icon, try restarting your computer. If that does not work, you may need to reinstall this application.

NetScreen-Remote icon with red indicator

Your computer has not established any secure connections, and is transmitting unsecure communications.

Yellow Key

Your computer has established at least one secure connection, but is not transmitting any communications at present.

Yellow key with green indicator

Your computer has established at least one secure connection, and is transmitting only secure communications.

Yellow key with red/green indicator

Your computer has established at least one secure connection, and is transmitting both secure and unsecure communications (i.e. some through a secure tunnel and some to unsecured sites, like public web pages).

Yellow key with red indicator

Your computer has established at least one secure connection, but is currently transmitting only unsecure communications.


Access Help topics

You can access Help three ways:

  1. Right-click the NetScreen-Remote icon [image] , and then click Help.

  2. In Security Policy Editor on the Help menu, then click Contents and Index.

  3. In Certificate Manager, press the F1 key.


Browse related Help topics

Topics within the Help file are grouped according to subject. To browse through topics that are related to the one you have selected, click the [image] and [image] buttons on the toolbar.


Create favorites for Help topics

Favorites function as bookmarks. They help you to quickly find the Help topics you reference most often.

  1. Open a topic you would like to mark as a favorite, then select the Favorite tab in the left pane.

  2. Click the Add key. The topic will appear on the Favorite menu, along with any other topics you have added.


Repackaging Overview

In some deployments of NetScreen-Remote it may be beneficial for the administrator to customize or "repackage" the installation package for easy distribution in a specific environment. This is sometimes referred to as "Repackaging" the installation. Some reasons for repackaging the installation include:

  • Defining Installation Parameters (e.g. Program Group, Install Path)

  • Installing additional programs in-conjunction with NetScreen-Remote

  • Hiding all end-user prompts during installation (Silent Install)

  • Executing an automatic reboot after installation is complete

  • Defining default policy files

  • Installing shortcuts in the start menu

  • Hiding tray icons from the end-users

  • Locking access to policy editor, certificate manager or log viewer

  • Defining Global-PRO Servers for policy retrieval

When deploying NetScreen-Remote with NetScreen Global-PRO Integration it is necessary to repackage the installation to include Global-PRO Server IP Address and other parameters.

The first step to repackaging is to copy files from the read-only CD-ROM filesystem to a writable filesystem for modification. To ensure you copy all necessary files, we have created a ZIP file of the NetScreen-Remote distribution on CD-ROM. First UnZip the file "NetScreen-Remote7a.ZIP" from the CD-ROM to suitable location for repackaging. Once files have been copied to writable filesystem a number of text-configuration files may be modified to modify install behavior.


Software Distribution

After NetScreen-Remote has been repackaged for your environment, install files may be burned on to another CD-ROM for distribution to users. If you wish to automate your installs, installation files could be placed on a web page or network drive share for which end-users will have access to and called via a login script or batch file sent to the user.

Since it is possible to run the entire installation silently, that is with no user-interface NetScreen-Remote could be installed distributed with any enterprise software management system (such as Microsoft's SMS) automatically or installed via login scripts or batch files.


Installation Configuration Files

This file is located on the NetScreen-Remote program install directory inside the OemExts directory and is used for NetScreen-Remote integration with NetScreen-Global PRO. You only need to modify this file if you wish to connect your NetScreen-Remote Clients to Global-PRO Arbitrator for policy retrieval. If you are not using Global-PRO there is no need to modify this file. The file only needs to be modified once and may be used by all users connecting to that Global-PRO Device. This configuration file tells NetScreen-Remote where to contact your Global-PRO Device, which Policy Domain you are a member of and important certificate information used to authenticate the Global-PRO Server itself to ensure you are getting a VPN Policy from a valid Global-PRO Device.

Multiple *.ANG files may exist in the installation directory, each one will be installed with NetScreen-Remote as a separate profile, during login the user may select which profile they wish to use. The filename of the *.ANG file is used as the name for the profile. For example Corperate.ang would display as profile "Corporate" If a filename default.ang exists - it will always be used as the default connection profile.


Default.ANG File Example

Corporate.ANG Example:

#MON NOV 19 20:30:00 PDT 2001

LastUser=Guest

AngName=default.ang

DefaultSuffix=cn=users,cn=AcmeDomain,o=Policy Manager

PrependPrefix=cn=

[Arbitrator]

CertificateName=CN=2435823409852304985

ArbitratorAddress=10.150.42.100

ArbitratorPort=1099

SSL=true

retrycount=1

timeout=20

[Arbitrator]

CertificateName=CN=2344023985023934424

ArbitratorAddress=10.150.42.1098

ArbitratorPort=1099

SSL=true

retrycount=1

timeout=30

LastUser defines the username last used by the application, it is used by the program to internally to keep track of which user was used as last-login.

AngName defines the profile last used by the user, it is used by the program internally to keep track of which profile was used as last-login.

DefaultSuffix defines which LDAP Container / Global-PRO Policy Domain remote users for this profile are stored in. In most configurations you will use

cn=users,cn=AcmeDomain,o=Policy Manager - Where AcmeDomain is replaced with your Global-PRO Policy Domain name, these fields are case-sensitive. This field is required

[ Arbitrator ] The Arbitrator Sections defines values for NetScreen Global-PRO Arbitrators - it is possible to have multiple Global-PRO Arbitrators defined for failover purposes. In the example above we define only two servers, the first defined [ Arbitrator ] section is used for primary communications, however if a connection cannot be made before the timeout value is exceeded, NetScreen-Remote will failover to the next [ Arbitrator ] listed.

CertificateName is where the common-name (CN) of the Global-PRO Arbitrator certificate is defined. The Certificate Name (CN) is always equal to the serial number of your Global-PRO device. NetScreen-Remote will always authenticate the Global-PRO Device itself first, to ensure you the user is sending their authentication credentials to a valid Global-PRO Device. This field is required

ArbitratorAddress refers to the hostname or IP Address of the Global-PRO Arbitrator. This field is required

ArbitratorPort refers to the TCP Port number of the Global-PRO Arbitrator (default port is 1099) This field is required

SSL Must always be set to "true" as NetScreen-Global PRO will only accept connections from hosts via SSL. This field is required

RetryCount Defines the number of re-connect attempts NetScreen-Remote will attempt before failing over to the next Global-PRO Arbitrator. This field is required

Timeout Defines the number of seconds NetScreen-Remote will wait for a successful TCP connection to Global-PRO Arbitrator before attempting a retry.


OEMInstall.INI File Example

This default OEMInstall.ini file is located in the installation directory of NetScreen-Remote. You may modify some sections of this configuration file to customize the install for your environment. Environment variables defined on the local machine may be used inside this file . You should only modify sections outlined in bold, if other sections of this file are modified (labeled "Do not change") it may cause adverse effects to the installation of the software and/or target machine.

[OemExtensions]

RebootTimeout=30

The RebootTimeout key is to configure SafeNet SoftRemote installation processing to use a time-delayed reboot mechanism. When provided, the RebootTimeout key value specifies (in decimal) the number of seconds to wait before automatically rebooting the system, when a reboot is required.

[DialogWelcome]

EnableDialog=Yes

The EnableDialog key of the DialogWelcome section may be used to enable or disable presentation of the Welcome Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "Yes".

[DialogLicense]

EnableDialog=Yes

The EnableDialog key of the DialogLicense section may be used to enable or disable presentation of the License Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "Yes".

[DialogDestPathandType]

EnableDialog=Yes

The EnableDialog key of the DialogDestPathandType section may be used to enable or disable presentation of the Destination Path and Setup Type Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "Yes".

TargetDir="%ISV_PROGRAMFILES%\NetScreen\NetScreen-Remote"

The TargetDir key of the DialogDestPathandType section may be used to configured the default target directory for the installation. The default value for this is C:\Program Files\NetScreen\NetScreen-Remote

[DialogProgramFolder]

EnableDialog=No

The EnableDialog key of the DialogProgramFolder section may be used to enable or disable presentation of the Program Folder Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "No".

AdministratorGroup=Yes

The AdministratorGroup key of the DialogProgramFolder section may be used to indicate the group to receive menu shortcuts created by SafeNet SoftRemote installation processing. Defined values of the AdministratorGroup Key are "Yes" and "No". The default value used when the AdministratorGroup Key does not exist is "Yes".

ProgramFolder="NetScreen-Remote"

The ProgramFolder key of the DialogProgramFolder section may be used to indicate the group to receive menu shortcuts created by SafeNet SoftRemote installation processing. As it is defined, the ProgramFolder key value contains the menu specification of the program group to contain the menu shortcuts. The default Program Group is "NetScreen-Remote"

[DialogSummary]

EnableDialog=Yes

The EnableDialog key of the DialogSummary section may be used to enable or disable presentation of the Summary Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "Yes".

[EntriesStartup]

The EntriesStartup section of the Installation Configuration File contains information relating to the startup shortcuts created by the SafeNet SoftRemote installation process. The keys defined for the EntriesStartup section are detailed in the following subsections.

Certificate Manager=No

The "Certificate Manager" key of the EntriesStartup section may be used to enable or disable creation of the Certificate Manager shortcut by the NetScreen-Remote installation process. Defined values of the "Certificate Manager" key are "Yes" and "No". The default value used when the "Certificate Manager" key does not exist is "Yes".

Security Policy Editor=No

The "Security Policy Editor" key of the EntriesStartup section may be used to enable or disable creation of the Security Policy Editor shortcut by the NetScreen-Remote installation process. Defined values of the "Security Policy Editor" key are "Yes" and "No". The default value used when the "Security Policy Editor" key does not exist is "Yes".

Tray Icon=Yes

The "Tray Icon" key of the EntriesStartup section may be used to enable or disable creation of the Tray Icon shortcut by the NetScreen-Remote installation process. Defined values of the "Tray Icon" key are "Yes" and "No". The default value used when the "Tray Icon" key does not exist is "No".

Log Viewer=No

The "Log Viewer" key of the EntriesStartup section may be used to enable or disable creation of the Log Viewer shortcut by the NetScreen-Remote installation process. Defined values of the "Log Viewer" key are "Yes" and "No". The default value used when the "Log Viewer" key does not exist is "Yes".

Connection Monitor=No

The "Connection Monitor" key of the EntriesStartup section may be used to enable or disable creation of the Connection Monitor shortcut EntriesStartup the NetScreen-Remote installation process. Defined values of the "Connection Monitor" key are "Yes" and "No". The default value used when the "Connection Monitor" key does not exist is "Yes

Help=No

The "Help" key of the EntriesStartup section may be used to enable or disable creation of the Help shortcut by the NetScreen-Remote installation process. Defined values of the "Help" key are "Yes" and "No". The default value used when the "Help" key does not exist is "Yes".

L2TP Config Utility=No

The "L2TP Config Utility" key of the EntriesStartup section may be used to enable or disable creation of the L2TP Config Utility shortcut by the NetScreen-Remote installation process. Defined values of the "L2TP Config Utility" key are "Yes" and "No". The default value used when the "L2TP Config Utility" key does not exist is "Yes".

[EntriesMenu]

The EntriesMenu section of the Installation Configuration File contains information relating to the shortcuts displayed in Program group menu's. The keys defined for the EntriesMenu section are detailed in the following subsections.

Certificate Manager=No

The "Certificate Manager" key of the EntriesMenu section may be used to enable or disable creation of the Certificate Manager shortcut by the NetScreen-Remote installation process. Defined values of the "Certificate Manager" key are "Yes" and "No". The default value used when the "Certificate Manager" key does not exist is "Yes".

Security Policy Editor=No

The "Security Policy Editor" key of the EntriesMenu section may be used to enable or disable creation of the Security Policy Editor shortcut by the NetScreen-Remote installation process. Defined values of the "Security Policy Editor" key are "Yes" and "No". The default value used when the "Security Policy Editor" key does not exist is "Yes".

Tray Icon=Yes

The "Tray Icon" key of the EntriesMenu section may be used to enable or disable creation of the Tray Icon shortcut by the NetScreen-Remote installation process. Defined values of the "Tray Icon" key are "Yes" and "No". The default value used when the "Tray Icon" key does not exist is "No".

Log Viewer=No

The "Log Viewer" key of the EntriesMenu section may be used to enable or disable creation of the Log Viewer shortcut by the NetScreen-Remote installation process. Defined values of the "Log Viewer" key are "Yes" and "No". The default value used when the "Log Viewer" key does not exist is "Yes".

Connection Monitor=No

The "Connection Monitor" key of the EntriesMenu section may be used to enable or disable creation of the Connection Monitor shortcut by the NetScreen-Remote installation process. Defined values of the "Connection Monitor" key are "Yes" and "No". The default value used when the "Connection Monitor" key does not exist is "Yes

Help=No

The "Help" key of the EntriesMenu section may be used to enable or disable creation of the Help shortcut by the NetScreen-Remote installation process. Defined values of the "Help" key are "Yes" and "No". The default value used when the "Help" key does not exist is "Yes".

L2TP Config Utility=No

The "L2TP Config Utility" key of the EntriesMenu section may be used to enable or disable creation of the L2TP Config Utility shortcut by the NetScreen-Remote installation process. Defined values of the "L2TP Config Utility" key are "Yes" and "No". The default value used when the "L2TP Config Utility" key does not exist is "Yes".

[EntriesPopup]

The EntriesPopup section of the Installation Configuration File contains information relating to the pop-up menu displayed by the Tray Icon application. The keys defined for the EntriesPopup section are detailed in the following subsections.

Certificate Manager=Yes

The "Certificate Manager" key of the EntriesPopup section may be used to enable or disable creation of the Certificate Manager shortcut by the NetScreen-Remote installation process. Defined values of the "Certificate Manager" key are "Yes" and "No". The default value used when the "Certificate Manager" key does not exist is "Yes".

Security Policy Editor=Yes

The "Security Policy Editor" key of the EntriesPopup section may be used to enable or disable creation of the Security Policy Editor shortcut by the NetScreen-Remote installation process. Defined values of the "Security Policy Editor" key are "Yes" and "No". The default value used when the "Security Policy Editor" key does not exist is "Yes".

Log Viewer=Yes

The "Log Viewer" key of the EntriesPopup section may be used to enable or disable creation of the Log Viewer shortcut by the NetScreen-Remote installation process. Defined values of the "Log Viewer" key are "Yes" and "No". The default value used when the "Log Viewer" key does not exist is "Yes".

Connection Monitor=Yes

The "Connection Monitor" key of the EntriesPopup section may be used to enable or disable creation of the Connection Monitor shortcut by the NetScreen-Remote installation process. Defined values of the "Connection Monitor" key are "Yes" and "No". The default value used when the "Connection Monitor" key does not exist is "Yes".

Help=Yes

The "Help" key of the EntriesPopup section may be used to enable or disable creation of the Help shortcut by the NetScreen-Remote installation process. Defined values of the "Help" key are "Yes" and "No". The default value used when the "Help" key does not exist is "Yes".

[OemComponents]

Component="OEM Component 2 "

[OEM Component 2]

Description="This is the description of OEM Component 2"

The Description key of an OEM Component Section contains the component description to be displayed during the Custom Installation Dialog. The default value for this key is an empty string.

Size=2048

The Size key of an OEM Component Section contains the (decimal) (installed) component size to be used in disk space calculations. The default value for this key is 0.

Selected=Yes

The Selected key of an OEM Component Section may be used to select or deselect the component as part of the Typical installation type. Defined values of the Selected Key are "Yes" and "No". The default value used when the Selected Key does not exist is "Yes".

Visible=Yes

The Visible key of an OEM Component Section may be used to indicate component visibility in the Custom Install Dialog. Defined values of the Visible Key are "Yes" and "No". The default value used when the Visible Key does not exist is "Yes".

InstallCommand="%ISV_SETUPDIR%\Oem Component 2\setup.exe"

The InstallCommand key may be used to configure a command target to be invoked when the component is installed. Any relative path specification must be relative to the location of the SafeNet SoftRemote installation executable, setup.exe. Note that the process creation for InstallCommand processing provides access to the custom environment variables detailed in Table 1 above.

InstallArgs=""Installing Component 2""

The InstallArgs key may be used to configure arguments to be passed to the command target when the component is installed. Double quote characters must be doubled (e.g. "") to be passed to the command target.

RepairCommand="%ISV_SETUPDIR%\Oem Component 2\setup.exe"

The RepairCommand key may be used to configure a command target to be invoked when the component is repaired. Any relative path specification must be relative to the location of the SafeNet SoftRemote installation executable, setup.exe. Note that the process creation for InstallCommand processing provides access to the custom environment variables detailed in Table 1 above.

RepairArgs=""Reparing Component 2""

The RepairArgs key may be used to configure arguments to be passed to the command target when the component is repaired. Double quote characters must be doubled (e.g. "") to be passed to the command target.

UninstallCommand="%ISV_SETUPDIR%\Oem Component 2\setup.exe"

The UninstallCommand key may be used to configure a command target to be invoked when the component is uninstalled. Any relative path specification must be relative to the location of the SafeNet SoftRemote installation executable, setup.exe. Note that the process creation for InstallCommand processing provides access to the custom environment variables detailed in Table 1 above.

UninstallArgs=""Uninstalling Component 2""

The UninstallArgs key may be used to configure arguments to be passed to the command target when the component is uninstalled. Double quote characters must be doubled (e.g. "") to be passed to the command target.

FileSet="%ISV_SRCDIR%\Oem Component 2\*.*"

The FileSet key may be used to specify the files particular to a component which should be cached when the Component Library is installed. When provided, the files will be cached to:

TARGETDIR\Setup\component_name where TARGETDIR is the target install directory, and component_name is the OEM component name.This default OEMInstall.ini file is located in the installation directory of NetScreen-Remote. You may modify some sections of this configuration file to customize the install for your environment. Environment variables defined on the local machine may be used inside this file . You should only modify sections outlined in bold, if other sections of this file are modified (labeled "Do not change") it may cause adverse effects to the installation of the software and/or target machine.

[OemExtensions]

RebootTimeout=30

The RebootTimeout key is to configure SafeNet SoftRemote installation processing to use a time-delayed reboot mechanism. When provided, the RebootTimeout key value specifies (in decimal) the number of seconds to wait before automatically rebooting the system, when a reboot is required.

[DialogWelcome]

EnableDialog=Yes

The EnableDialog key of the DialogWelcome section may be used to enable or disable presentation of the Welcome Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "Yes".

[DialogLicense]

EnableDialog=Yes

The EnableDialog key of the DialogLicense section may be used to enable or disable presentation of the License Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "Yes".

[DialogDestPathandType]

EnableDialog=Yes

The EnableDialog key of the DialogDestPathandType section may be used to enable or disable presentation of the Destination Path and Setup Type Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "Yes".

TargetDir="%ISV_PROGRAMFILES%\NetScreen\NetScreen-Remote"

The TargetDir key of the DialogDestPathandType section may be used to configured the default target directory for the installation. The default value for this is C:\Program Files\NetScreen\NetScreen-Remote

[DialogProgramFolder]

EnableDialog=No

The EnableDialog key of the DialogProgramFolder section may be used to enable or disable presentation of the Program Folder Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "No".

AdministratorGroup=Yes

The AdministratorGroup key of the DialogProgramFolder section may be used to indicate the group to receive menu shortcuts created by SafeNet SoftRemote installation processing. Defined values of the AdministratorGroup Key are "Yes" and "No". The default value used when the AdministratorGroup Key does not exist is "Yes".

ProgramFolder="NetScreen-Remote"

The ProgramFolder key of the DialogProgramFolder section may be used to indicate the group to receive menu shortcuts created by SafeNet SoftRemote installation processing. As it is defined, the ProgramFolder key value contains the menu specification of the program group to contain the menu shortcuts. The default Program Group is "NetScreen-Remote"

[DialogSummary]

EnableDialog=Yes

The EnableDialog key of the DialogSummary section may be used to enable or disable presentation of the Summary Dialog during SafeNet SoftRemote installation processing. Defined values of the EnableDialog Key are "Yes" and "No". The default value used when the EnableDialog Key does not exist is "Yes".

[EntriesStartup]

The EntriesStartup section of the Installation Configuration File contains information relating to the startup shortcuts created by the SafeNet SoftRemote installation process. The keys defined for the EntriesStartup section are detailed in the following subsections.

Certificate Manager=No

The "Certificate Manager" key of the EntriesStartup section may be used to enable or disable creation of the Certificate Manager shortcut by the NetScreen-Remote installation process. Defined values of the "Certificate Manager" key are "Yes" and "No". The default value used when the "Certificate Manager" key does not exist is "Yes".

Security Policy Editor=No

The "Security Policy Editor" key of the EntriesStartup section may be used to enable or disable creation of the Security Policy Editor shortcut by the NetScreen-Remote installation process. Defined values of the "Security Policy Editor" key are "Yes" and "No". The default value used when the "Security Policy Editor" key does not exist is "Yes".

Tray Icon=Yes

The "Tray Icon" key of the EntriesStartup section may be used to enable or disable creation of the Tray Icon shortcut by the NetScreen-Remote installation process. Defined values of the "Tray Icon" key are "Yes" and "No". The default value used when the "Tray Icon" key does not exist is "No".

Log Viewer=No

The "Log Viewer" key of the EntriesStartup section may be used to enable or disable creation of the Log Viewer shortcut by the NetScreen-Remote installation process. Defined values of the "Log Viewer" key are "Yes" and "No". The default value used when the "Log Viewer" key does not exist is "Yes".

Connection Monitor=No

The "Connection Monitor" key of the EntriesStartup section may be used to enable or disable creation of the Connection Monitor shortcut EntriesStartup the NetScreen-Remote installation process. Defined values of the "Connection Monitor" key are "Yes" and "No". The default value used when the "Connection Monitor" key does not exist is "Yes

Help=No

The "Help" key of the EntriesStartup section may be used to enable or disable creation of the Help shortcut by the NetScreen-Remote installation process. Defined values of the "Help" key are "Yes" and "No". The default value used when the "Help" key does not exist is "Yes".

L2TP Config Utility=No

The "L2TP Config Utility" key of the EntriesStartup section may be used to enable or disable creation of the L2TP Config Utility shortcut by the NetScreen-Remote installation process. Defined values of the "L2TP Config Utility" key are "Yes" and "No". The default value used when the "L2TP Config Utility" key does not exist is "Yes".

[EntriesMenu]

The EntriesMenu section of the Installation Configuration File contains information relating to the shortcuts displayed in Program group menu's. The keys defined for the EntriesMenu section are detailed in the following subsections.

Certificate Manager=No

The "Certificate Manager" key of the EntriesMenu section may be used to enable or disable creation of the Certificate Manager shortcut by the NetScreen-Remote installation process. Defined values of the "Certificate Manager" key are "Yes" and "No". The default value used when the "Certificate Manager" key does not exist is "Yes".

Security Policy Editor=No

The "Security Policy Editor" key of the EntriesMenu section may be used to enable or disable creation of the Security Policy Editor shortcut by the NetScreen-Remote installation process. Defined values of the "Security Policy Editor" key are "Yes" and "No". The default value used when the "Security Policy Editor" key does not exist is "Yes".

Tray Icon=Yes

The "Tray Icon" key of the EntriesMenu section may be used to enable or disable creation of the Tray Icon shortcut by the NetScreen-Remote installation process. Defined values of the "Tray Icon" key are "Yes" and "No". The default value used when the "Tray Icon" key does not exist is "No".

Log Viewer=No

The "Log Viewer" key of the EntriesMenu section may be used to enable or disable creation of the Log Viewer shortcut by the NetScreen-Remote installation process. Defined values of the "Log Viewer" key are "Yes" and "No". The default value used when the "Log Viewer" key does not exist is "Yes".

Connection Monitor=No

The "Connection Monitor" key of the EntriesMenu section may be used to enable or disable creation of the Connection Monitor shortcut by the NetScreen-Remote installation process. Defined values of the "Connection Monitor" key are "Yes" and "No". The default value used when the "Connection Monitor" key does not exist is "Yes

Help=No

The "Help" key of the EntriesMenu section may be used to enable or disable creation of the Help shortcut by the NetScreen-Remote installation process. Defined values of the "Help" key are "Yes" and "No". The default value used when the "Help" key does not exist is "Yes".

L2TP Config Utility=No

The "L2TP Config Utility" key of the EntriesMenu section may be used to enable or disable creation of the L2TP Config Utility shortcut by the NetScreen-Remote installation process. Defined values of the "L2TP Config Utility" key are "Yes" and "No". The default value used when the "L2TP Config Utility" key does not exist is "Yes".

[EntriesPopup]

The EntriesPopup section of the Installation Configuration File contains information relating to the pop-up menu displayed by the Tray Icon application. The keys defined for the EntriesPopup section are detailed in the following subsections.

Certificate Manager=Yes

The "Certificate Manager" key of the EntriesPopup section may be used to enable or disable creation of the Certificate Manager shortcut by the NetScreen-Remote installation process. Defined values of the "Certificate Manager" key are "Yes" and "No". The default value used when the "Certificate Manager" key does not exist is "Yes".

Security Policy Editor=Yes

The "Security Policy Editor" key of the EntriesPopup section may be used to enable or disable creation of the Security Policy Editor shortcut by the NetScreen-Remote installation process. Defined values of the "Security Policy Editor" key are "Yes" and "No". The default value used when the "Security Policy Editor" key does not exist is "Yes".

Log Viewer=Yes

The "Log Viewer" key of the EntriesPopup section may be used to enable or disable creation of the Log Viewer shortcut by the NetScreen-Remote installation process. Defined values of the "Log Viewer" key are "Yes" and "No". The default value used when the "Log Viewer" key does not exist is "Yes".

Connection Monitor=Yes

The "Connection Monitor" key of the EntriesPopup section may be used to enable or disable creation of the Connection Monitor shortcut by the NetScreen-Remote installation process. Defined values of the "Connection Monitor" key are "Yes" and "No". The default value used when the "Connection Monitor" key does not exist is "Yes".

Help=Yes

The "Help" key of the EntriesPopup section may be used to enable or disable creation of the Help shortcut by the NetScreen-Remote installation process. Defined values of the "Help" key are "Yes" and "No". The default value used when the "Help" key does not exist is "Yes".

[OemComponents]

Component="OEM Component 2 "

[OEM Component 2]

Description="This is the description of OEM Component 2"

The Description key of an OEM Component Section contains the component description to be displayed during the Custom Installation Dialog. The default value for this key is an empty string.

Size=2048

The Size key of an OEM Component Section contains the (decimal) (installed) component size to be used in disk space calculations. The default value for this key is 0.

Selected=Yes

The Selected key of an OEM Component Section may be used to select or deselect the component as part of the Typical installation type. Defined values of the Selected Key are "Yes" and "No". The default value used when the Selected Key does not exist is "Yes".

Visible=Yes

The Visible key of an OEM Component Section may be used to indicate component visibility in the Custom Install Dialog. Defined values of the Visible Key are "Yes" and "No". The default value used when the Visible Key does not exist is "Yes".

InstallCommand="%ISV_SETUPDIR%\Oem Component 2\setup.exe"

The InstallCommand key may be used to configure a command target to be invoked when the component is installed. Any relative path specification must be relative to the location of the SafeNet SoftRemote installation executable, setup.exe. Note that the process creation for InstallCommand processing provides access to the custom environment variables detailed in Table 1 above.

InstallArgs=""Installing Component 2""

The InstallArgs key may be used to configure arguments to be passed to the command target when the component is installed. Double quote characters must be doubled (e.g. "") to be passed to the command target.

RepairCommand="%ISV_SETUPDIR%\Oem Component 2\setup.exe"

The RepairCommand key may be used to configure a command target to be invoked when the component is repaired. Any relative path specification must be relative to the location of the SafeNet SoftRemote installation executable, setup.exe. Note that the process creation for InstallCommand processing provides access to the custom environment variables detailed in Table 1 above.

RepairArgs=""Reparing Component 2""

The RepairArgs key may be used to configure arguments to be passed to the command target when the component is repaired. Double quote characters must be doubled (e.g. "") to be passed to the command target.

UninstallCommand="%ISV_SETUPDIR%\Oem Component 2\setup.exe"

The UninstallCommand key may be used to configure a command target to be invoked when the component is uninstalled. Any relative path specification must be relative to the location of the SafeNet SoftRemote installation executable, setup.exe. Note that the process creation for InstallCommand processing provides access to the custom environment variables detailed in Table 1 above.

UninstallArgs=""Uninstalling Component 2""

The UninstallArgs key may be used to configure arguments to be passed to the command target when the component is uninstalled. Double quote characters must be doubled (e.g. "") to be passed to the command target.

FileSet="%ISV_SRCDIR%\Oem Component 2\*.*"

The FileSet key may be used to specify the files particular to a component which should be cached when the Component Library is installed. When provided, the files will be cached to:

TARGETDIR\Setup\component_name where TARGETDIR is the target install directory, and component_name is the OEM component name.


Executing a Custom Installation

Before NetScreen-Remote will use your custom configuration, you must first tell the program NetScreen-Remote program the location of your configuration file. This location may be a local, relative path or a network path (e.g. \\serverA\config\install.ini) There are two ways to tell the NetScreen-Remote installer to use your custom configuration: A command-line argument to setup or in the setup.ini file. The command-line flag allows your install configuration file to reside in a separate location to your installation CD-ROM. By default, NetScreen-Remote installer will use install.ini file located in the installation directory of the CD-ROM for install configuration.


Overview

Remote Overview

NetScreen-Remote can be managed remotely in conjunction with NetScreen Policy Manager and NetScreen-Remote Login. The client is configured through Policy Manager, which retrieves the appropriate user’s configuration and sends it using NetScreen-Remote.


Configuring for NetScreen Remote

Configuring Policy Manager so that the user configurations can be accessed by NetScreen-Remote is a simple process. Only a few steps are involved.

  1. Set up the user in Policy Manager, configuring the IKE ID and Local Authentication parameters.

  2. Create security policies for the user in the Policy Manager Policy Builder. For user configuration information and procedures, see NetScreen-Global PRO Policy Manager User’s Guide.

  3. Open the NetScreen-Remote Login client software and modify the default.ang text file.

  4. Save the new file.


Logging In

Once invoked, a remote user must authenticate herself or himself with a User ID and Password. An administrator-prepared .ang text file that contains Arbitrator and other related information will be used to retrieve the user VPN policies. The Request Handler processes the login process by first, connecting to the Arbitrator and obtaining the proxy of the Remote RMI object (Request Manager). Then, the Handler sends the login credentials to the Arbitrator for authentication.


Editing Default Files

To modify the default_user.ang text file:

  1. Open the c:\program files\NetScreen\NetScreen-Remote directory.

  2. Open the default.ang text file:

  3. In the LastUser= field, enter the user name assigned in Policy Manager. For example, enter Joe to configure a user named Joe.

  4. In the ArbitratorAddress= field, enter the Policy Manager default arbitrator’s address.

If the Policy Manager administrator changes the default arbitrator address, change the information in this field to match. Also, change the arbitrator’s port number if it has changed as well. Otherwise, NetScreen-Remote is unable to obtain the authentication information and security policies applicable to the user and login fails.

  1. In the ArbitratorPort= field, enter the Policy Manager default arbitrator’s port number.

  2. In the DefaultSuffix=cn field, enter the user’s directory context; however, use the format as displayed in the .ang file rather than the format as used in Policy Manager. For example, the directory context for a user named Joe who is a member of the policy domain Engineering in Policy Manager would be entered in the .ang file as:

  3. DefaultSuffix=cn\=User\Engineering.o=netscreen.com

  4. Leave the SSL field set to true.

  5. Save the file to complete the configuration procedure.

  6. Deliver the modified default.ang to the user.


Replacing Default Files

Replacing the default.ang File

The user replaces the default.ang file in the NetScreen-Remote Login software by following these steps:

  1. Navigate to the c:\program files\NetScreen\NetScreen-Remote directory on the Windows workstation.

  2. Open the default.ang text file.

  3. Replace the empty default.ang file with the one created by the Policy Manager administrator.

  4. Save the file.

When the user first logs in to NetScreen-Remote through the NetScreen-Remote Login client, the user is immediately authenticated by the arbitrator and the security policies downloaded from Policy Manager.


Deletion of VPN Settings

User can choose the logoff button in the maximized application window to delete the VPN policy retrieved from the Arbitrator. If this button is selected, the GUI feeds the Remote Client with a pre-defined basic VPN policy similar to the default VPN setting initially provided by the Remote Client. Another option is to feed the Remote Client a set of null values for all VPN settings.

In addition to deleting and purging the VPN policy after user logoff, the VPN policies are automatically deleted whenever there is a NT shutdown or user logout.


Connection Manager

To use NetScreen-Remote Login you must have NetScreen Policy Manager product installed and properly configured. Users and Dial-Up VPNs must be configured in Policy Manager and pushed to at least one NetScreen device. Once you successfully install NetScreen-Remote and reboot your machine to establish VPN tunnels, you must do the following:

  • Launch NetScreen-Remote Login Connection Manager (Start->NetScreen-Remote Login

  • Enter a valid Username and Password

  • Press OK

The user’s configuration will be automatically downloaded from the Policy Manager Arbitrator. The download will occur over a secure channel using 3DES encryption – no VPN is required to use NetScreen-Remote Login; however, SSL/TLS ports (TCP/1099) must be open to the Policy Manager Arbitrator from all external firewalls.

When one exits the NetScreen-Remote Login, the VPN Configuration is purged from NetScreen-Remote, a user will not be able to connect to the VPN again until they re-launch NetScreen-Remote Login and authenticate again.

Configuration is user based, so if a user named Joe uses machine A to log into NetScreen-Remote Login, he will get the same configuration if he logs into machine B as Joe. Tying configurations to users as opposed to machines gives the administrator more flexibility when defining VPN access policies and gives the user the capability to login from anywhere without manually reconfiguring NetScreen-Remote.


Network administrator

Network administrator is a generic term used to describe the individual who is responsible for implementing network security policies and managing the hardware/software systems used to enforce them for the end users within an organization.


Getting started

If you are the network administrator, you should use this help file as an online book. The topics arranged under the Contents tab in the left pane are organized sequentially to logically guide you through set up and configuration. You should know the following:

  • How the Internet Key Exchange (IKE) protocol relates to your network or modem communications. For example, your network connections must be Ethernet with an NDIS-compliant driver.

  • Which network interface cards (NICs) are compatible with NetScreen-Remote.

  • Whether you will use Pre-Shared Keys or Public Keys and digital certificates to identify users during a Phase 1 IKE negotiation.

  • How to contact your certificate authority (CA) to request digital certificates. You will need to know if your CA is set up to receive automatic (online) or manual certificate requests, and exactly how you should submit each.

  • How your network is set up. For example, does your network use an HTTP proxy server? Is your CA server on the Internet? If you can answer yes to both questions, then you will need to specify the HTTP proxy server before you can request digital certificates online or automatically retrieve certificate revocation lists (CRLs).

  • How to retrieve CRLs from a directory server. Does your CA provide only the location in the directory? In this case, you would need to enter the complete address (URL) of the LDAP server.

  • How the other parties you or your end users want to communicate with are set up. If they are protected by a secure gateway, then you must enter the IP address, domain name, or distinguished name for that device whether you establish one security policy for all connections or separate security policies for individual connections.

  • Will you want your traveling remote users, who access the internal corporate network, to have specific IP addresses? You will need to check the option to Allow to Specify Internal Network Address in the Global Policy Settings dialog box and then enter the actual IP address under My Identity. This same procedure will also allow local users to have an IP address on a local network that uses network address translation (NAT).

  • How to manage this product for your end users. You should create a custom installation for them and lock the security policy when you export it. You can do this using the NetScreen-Remote as a stand-alone application, or you can use the SafeNet/VPN Policy Manager™ (Contact your authorized product distributor if you would like to learn more about this VPN management product.). You will then want to be sure to distribute the policy and/or certificates to users in a secure fashion.

  • How to troubleshoot network problems. You will need to know what Manual Key is, and you will need to know how to interpret communications messages in Log Viewer.

See Also:

Frequently Asked Configuration Questions

Step by Step Instructions

  1. Install the product.

  2. There are two things you must decide before configuring the NetScreen-Remote:

    Decide which end-user connection mechanism you will use—fixed IP addresses or dynamically assigned IP addresses.

Fixed IP addresses can be used in the following cases:

  • DSL user

  • cable user

  • one or two person office

Dynamically assigned IP addresses are used in these cases:

  • cable or DSL with PPPoE address assignment

  • traveling user using a different POP in every city, or dialing in and receiving a different IP each connection

Note: When using a dynamic IP address, you must choose the Aggressive Mode option for the Phase 1 negotiation mode in order for the connection to work properly with a NetScreen Security Appliance.

  3. Decide which key to use Public Key (with certificates), Pre-Shared Key (AutoKey), or Manual Key.

Public Key with certificates is the most secure. The administrator can either obtain the certificate from a CA and send it to the user employing PKCS 12 (less end-user overhead, but less secure, because it could be detected in transmission), or users can request their own certificate themselves, creating a (PKCS 10) certificate request.

You can distribute the certificate using either PKCS 10 (more secure but more end-user overhead) or PKCS 12 (less end-user overhead, but less secure, because it could be detected in transmission).

Pre-Shared Key is easier to use than Public Key. However, you must communicate the secret to the users out-of-band. This is a less strong solution than certificates and PKI.

Manual Key, used for testing, is another option. It is less secure by far. All information must be painstakingly communicated out of band. Further, because the keys are fixed, if they are broken, they must be changed for everyone. This means a lot of re-configuration.

If you decide to use Pre-Shared key or Manual key encryption, go on to Step 4, Configure a security policy.

If you decide to use certificates and Public key encryption:

Get digital certificates. You can do this manually or automatically in Certificate Manager . For detailed instructions, start with the help topics listed under Certificate Manager.

  4. Configure a security policy in Security Policy Editor. For detailed instructions, start with the Help topics listed under Security Policy Editor.

See also Security Policy Options

See also Create Custom Installations for End Users

After you have made these decisions, configure a few NetScreen-Remote devices and try out the setup. When you are satisfied with the results, you are ready for deployment.


Network interface cards (NICs)

NetScreen-Remote should be compatible with all NDIS compliant Ethernet NICs (NICs tested for Soft-PK V7.0). Only plug and play on Windows 95, 98, 2000 and Windows XP is supported. Plug and play on notebook computers running Windows NT is not supported.

Co-existence (i.e. encryption over the dial-up adapter) with Token Ring cards is supported but co-existence with FDDI cards is not supported.

This is a list of Network Cards that have been tested and verified to work correctly with NetScreen-Remote. This list represents cards that have been tested with NetScreen-Remote but are by no means the only cards that are compatible.

NetScreen-Remote should be compatible with any Ethernet card with an NDIS compliant driver or dial-up adapter (modem or ISDN).

Updated: 06/13/00

Manufacturer | Model | Number
3COM* | Fast Etherlink 16-Bit PC Card | 3C574-TX
 | EtherLink III LAN PC Card | 3C589C-TP
 | EtherLink III LAN PC Card | 3C589D-TP
 | EtherLink III LAN+33.6 Modem PC card | 3C562D/3C563D
 | EtherLink 10 ISA | 3C509B-TP
 | Fast EtherLink 10/100 ISA | 3C515-TX
 | Fast EtherLink 10/100 PCI | 3C905-TX-NM
 | Fast EtherLink 10/100 PCI | 3C905B-TX
 | Fast EtherLink 10/100 PCI | 3C905C-TX
 | MegaHertz 10/100 + 56K PCMCIA | FEM-556B
 | MegaHertz 128K ISDN PC Card (USRobotics) | 167-011477
 | Megahertz 56K PC Card Modem (US Robotics) | CC1560
 | Office Connect Fast Ethernet PCI | 3CSOHO100-TX
CNET | Fast Ethernet PCI 10/100 Adapter | PRO-110
 | Fast Ethernet PCI 10/100 Adapter | PRO-110(B)
 | PowerNIC CN200EPlus ISA | CN200EPlus
 | PowerNIC CN600EPlus ISA | CN600EPlus
 | PowerNIC CN650EPlus ISA | CN650EPlus
Eicon Technology | Diva Pro PC ISDN PC Card | 305-196
Intel | Intel Pro/100 LAN+Modem56 CardBus II | MBLA3356
 | Intel Pro/100 LAN+Modem56 CardBus II | MBLA3456
 | Intel Pro 10 ISA | PCLA8225B
 | Intel Pro 10 PCI | PILA8520
 | Intel Pro 100 ISA | PILA8560
 | Intel Pro 100 PCI | PILA8460BN
Net Gear | NetGear 10/100 Fast Ethernet | FA310TX
Kingston | EtheRX 10/100 | KNE-110TX
 | EtheRX 10/100 | KNE-120TX
Samsung | SmartEther 10 | SC1010-TX
Xircom | Pocket Ethernet III | PE3-10BT
 | Credit Card Ethernet 10/100+Modem 56 | CEM56-100
 | Realport CardBus Ethernet 10/100+Modem 56 | REM56G-100BTX
 | Credit Card Ethernet Adapter 10/100 | CE3B-100BTX

* Warning: NetScreen-Remote will not work correctly (and possibly even Blue Screen) when 3Com's Smart Agent Network Management Software is installed on your computer.

If you are using a 3Com adapter and running the Smart Agent software; before installing NetScreen-Remote, remove the 3Com software, then go to 3Com's web page and get the correct driver for you adapter that does not include or require 3Com's Smart Agent software. Install the driver, reboot, then load NetScreen-Remote.


Establish global policy settings

Global policy settings are program preferences that affect all transmissions using the NetScreen-Remote. You can change these at any time.

  1. In Security Policy Editor on the Options menu, click Global Policy Settings. The Global Policy Settings dialog box appears.

  2. Change these settings according to your security policy.

  3. Click OK when done.

  4. Click Save Changes on the File menu.


Create custom installations for end users

A custom installation is a NetScreen-Remote installation that you, as the network administrator create to aid deployment of NetScreen-Remote to a number of users. Modifications you can make to customize an installation include:

  • The security policy configuration parameters.

  • The Pre-Shared Key or The CA digital certificates you require.

  • The Public/Private Key pair generated when you request a personal certificate.

Custom installations are designed to make it easy for you to Okay the deployment of corporate security policies for tens, hundreds, or thousands of end users.

Note: If you are managing the NetScreen-Remote with the VPN Policy Manager, disregard these instructions for creating a custom installation. These instructions apply to the NetScreen-Remote as a standalone software application only.

The step-by-step procedures that follow summarize how to create each custom installation. You will find more detailed instructions about configuring and exporting security policies in the Help topics listed under Security Policy Editor. You will also find more detailed instructions about requesting digital certificates and exporting them in the topics listed under Certificate Manager.

Variations

What you include in a custom installation can vary. Here are the most common combinations:

  • Security policy only

  1. Configure a security policy.

  2. Export the security policy and name the file IPSecPolicy.spd.

  3. Add the new security policy file to an unzipped image of the NetScreen-Remote installation software files.

  4. Distribute files to end users:

  5. Post these files to a network drive or Web site, or copy to a zip disk.

or

  1. Zip these files and copy to floppy disks or CD-ROM.

  5. Give end users detailed instructions on the following:

  • How to install the application

  • How to get a CA certificate

  • How to get a personal certificate

  1. Security policy with pre-shared key

  • Configure a security policy, including a pre-shared key.

  • Export the security policy and name the file IPSecPolicy.spd.

  • Add the security policy file to an unzipped image of the NetScreen-Remote installation software files.

  • Distribute files to end users:

  • Post these files to a network drive or Web site, or copy to a zip disk.

    or

  • Zip these files and copy to floppy disks or CD-ROM.

Note: Since the install image now includes a file with the Pre-shared Key in plain text, be sure the distribution method is secure. If this key is compromised, the user's secure connection will no longer be private. Once the file has been successfully installed on the end user machine, you might want to consider destroying the copy for distribution to minimize the risk of compromise.

  5. Give end users detailed instructions on how to install the application.

  • Security policy with a CA certificate

User requests and retrieves the Personal Certificate him or herself.

  1. Get a CA's certificate from your CA.

  2. Export the CA certificate and name the file IPSecCerts.cer.

  3. Configure a security policy.

  4. Export the security policy and name the file IPSecPolicy.spd.

  5. Add the CA certificate file (*.cer) and security policy file (*.spd) to an unzipped image of the NetScreen-Remote installation software files.

  6. Distribute files to end users:

  7. Post these files to a network drive or Web site, or copy to a zip disk.

    or

  • Zip these files and copy to floppy disks or CD-ROM.

7 Give end users detailed instructions on the following:

  1. How to install the application

  2. How to add the CA certificate: Click Yes when prompted to add it to the ROOT Store.

  1. How to obtain a personal certificate and load it into the software:

    1. How to fill out the online certificate request form for a personal certificate. You may have to tell them their domain name and IP address.

    2. How to send their personal certificate request to the Certificate Authority (CA).

    3. How to import their personal certificate after it is received.

    4. How to associate that certificate in their security policy.

  • Security policy with both a CA certificate and a personal certificate

***NOT AVAILABLE IN THIS RELEASE***

Remember: Personal certificates must be unique to each individual; you cannot distribute one personal certificate to all of your end users.


Technical support

The network administrator is the end user's point of contact for technical support. You must give your end user's the information to contact either you or your organization's help desk.

If you are the network administrator, your first point of contact for technical support is your authorized product distributor.

Remember that the Help files contain valuable procedural information that you can direct end users to whenever you need them to follow step-by-step instructions.


Certificate authority

A certificate authority (CA) is an organization trusted to verify the identity of individuals, companies, or network servers by issuing, signing, managing, and revoking, when necessary, digital certificates.


Digital certificate

A digital certificate is an electronic document issued by a certificate authority (CA) that verifies the owner of a public key. The CA server you use can be owned and operated by an independent CA (built-in support for Microsoft [image] ©, Verisign [image] ©, or Entrust [image] ©) or by your own organization, in which case you become your own CA.

If you use an independent CA, you must contact them for the addresses of their CA and CRL servers (for obtaining certificates and certificate revocation lists), and for the information they require when submitting personal certificate requests.

There are two types of digital certificates:

  • CA certificates. Each CA you contact must provide you with its own digital certificate, which verifies its identity. You must have a CA certificate before you can request a personal certificate. This is also known as the root certificate.

  • Personal certificates. You must have your own digital certificate from a CA, which verifies your identity to the parties you want to communicate with.


Open certificate manager

Certificate Manager is the software module in NetScreen-Remote where users request, import, and store the digital certificates they receive from certificate authorities (CAs).

  1. Right-click the NetScreen icon [image] , located in the lower right-hand corner of your screen.

  2. Click Certificate Manager on the menu. The Certificate Manager window appears as shown below.


Configure CA certificate Enrollment Parameters

You can configure the parameters for obtaining a CA certificate if you want to request personal certificates online via CEP enrollment, but you did not request your CA certificate online. The CA certificate enrollment parameters that you enter are exactly the same as those you enter when requesting or retrieving a CA certificate online.

  • In Certificate Manager, click the CA Certificates tab.

  • Select the CA certificate whose enrollment parameters you want to configure.

  • Click Configure. The Configuration Parameters dialog box appears.

  • In the CA Domain field, enter the CA's domain name (for example, trustme.com).

  • In the Online Certificate Server field, enter the complete URL for the CA's certificate server (for example, http://entrust.com/).

  • Click OK. You can now request a personal certificate online from this CA.


Contact a CA

To communicate securely, you must have two digital certificates issued by a certificate authority (CA): a CA certificate and a personal certificate.

To use certificates you must buy, set up, and administer a CA server in house or buy service from a CA vendor/provider.

Note: Pre-shared keys are an alternative to digital certificates.

Enrollment Methods

You must enroll with a CA to get your digital certificates. There are two main enrollment methods:

  • On-line enrollment, which uses Certificate Enrollment Protocol (CEP). If you select a CA that supports this method, you must have their CA certificate before you can request a personal certificate on-line; in which case, you must know the certificate server DNS name or IP address in advance. This is the recommended enrollment method.

  • Manual enrollment, which requires cutting and pasting from a text editor. CAs handle this method various ways, but you will always start with a certificate request file. Certificate Manager automatically generates the public/private key pair you will need. The public key goes with your request; the private key resides on your hard drive.

    In some cases, you will open the file in a text editor and then copy and paste the information into a space provided on your CA's Web site. In other cases, you will have to copy and paste the personal certificate the CA returns to you, for example in an e-mail, and copy and paste it into a text editor to create a file you can then import into Certificate Manager.

List of CAs

The following CAs support on-line (CEP) enrollment:

Certificate Authority | Telephone | Web Site
VeriSign Inc. Mountain View, CA 94043 | 650-961-7500 | www.verisign.com
Netscape San Diego, CA 92127 | 619-673-5050 | www.netscape.com
Microsoft Corporation* Redmond, WA 98052 | 425-882-8080 | www.microsoft.com
Entrust Technologies, Inc.* Richardson, TX 75080 | 972-994-8000 | www.entrust.com
* These CAs support on-line (CEP) enrollment only through a registration authority (RA) that includes two RA certificates. You do not need to do anything with RA certificates unless you are troubleshooting; in which case, you can view them in Certificate Manager.


Use an HTTP proxy server for online certificate requests

An HTTP proxy server allows you to request digital certificates from a certified server over the Internet.

Some networks have been designed to only allow HTTP connections to exit their private network by first being translated through an HTTP proxy. You need a special setting for HTTP proxies within NetScreen-Remote if both of the following conditions are true:

  • You use an HTTP proxy to make connections outside your private network.

  • Your CA is located outside your private network

If neither condition applies, skip this procedure.

In order to make NetScreen aware of your Proxy, you must enter the HTTP proxy server DNS name or IP address in the Security Policy Editor Certificate Settings dialog box. When you enter the DNS name or IP address, the URL is completed automatically.

  1. In Security Policy Editor on the Options menu, click Certificate Settings.

  2. Select Use HTTP proxy server for online certificate requests and CRL updates.

  3. Enter the DNS name or IP address.

  4. Click OK.


Request a CA certificate on-line

You should have a CA certificate before you request a personal certificate. For a list of available CAs, see Contact a certificate authority.

Note: If you access the Internet through a firewall, make sure you have the HTTP proxy server option selected.

  1. In Certificate Manager, click the CA Certificates tab.

  2. Click Retrieve CA Certificate. The Retrieve CA Certificate On-line dialog box appears.

  3. In the CA Domain box, enter your CA's domain name.

  4. In the On-line Certificate Server box, enter the complete URL for your CA's certificate server. You should include the protocol connection at the beginning of the URL.

  5. Click OK. Within a few seconds, the Root Certificate Store dialog box should appear, asking if you want to add the CA certificate to the Root Store.

  6. Click Yes. Your CA's digital certificate is now listed under CA Certificates.

  7. Optional:

    • To view the CA certificate, click View. Click inside the certificate window to close it.

    • To verify the authenticity of the CA certificate, click Verify. Click OK inside the Certificate Manager dialog box to close it.

  8. Now that you have a CA certificate, you can request a personal certificate on-line.


Request a personal certificate on-line

You must have a CA certificate configured before you can request a personal certificate on-line. Contact a CA if you do not already have a CA certificate.

  1. In Certificate Manager, click the My Certificates tab.

  2. Click Request Certificate. The On-line Certificate Request dialog box appears.

  3. Optional: Select the Generate exportable key check box.

Note: You will only be able to export the private key associated with the personal certificate you are now requesting if you check this option now. For security reasons, no one can change it later.

  4. Under Enrollment method, click Online.

  5. Under Subject Information, enter all relevant personal information, pressing [image] to move through the dialog box.

    Caution! Do NOT press [image], until you are finished. You must tab between fields. If you press [image], the request will generate before you are finished.

  6. Under Online Request Information, enter or select these options:

    1. In the Challenge Phrase box, enter any combination of numbers or letters you choose. For security reasons, only asterisks appear here.

    2. In the Confirm Challenge box, enter the same phrase from the last step.

    3. From the Issuing CA list, select a CA certificate.

  7. Click OK. Certificate Manager now generates a public/private key pair, and then displays the Online Certificate Request dialog box to indicate that it is waiting for a response from the CA. When the CA accepts your request, the Certificate Manager dialog box appears. Click OK again.

  8. Optional: To view your request, click the Certificate Requests tab. Select the request and click View. Click inside the certificate window to close it.

  9. Get your CA administrator to approve your request.

  10. Once your request is approved, select it under the Certificate Requests tab and click Retrieve.

  11. Click Yes when the Certificate Manager dialog box asks if you want to add this personal certificate. The request disappears, but the personal certificate now appears under the My Certificates tab.

Tip: You should select the new certificate and click Verify to validate it.


Create a certificate request file for a personal certificate

If the certificate authority (CA) you have selected does not support online (CEP) enrollment, then you need to create a certificate request file that you can submit manually to your CA (in other words, you create a text file from which you can cut and paste information as needed).

Note: This request is for a personal certificate. You will need to get a CA certificate as well. You should be able to download this from your CA's Web site directly to your hard drive. In which case, you will need to import the CA certificate into Certificate Manager separately.

  1. In Certificate Manager, click the My Certificates tab.

  2. Click Request Certificate:

    • If you do not have a CA certificate configured for online (CEP) enrollment, you will be prompted to make a file-based request. Click Yes. The File-based Certificate Request dialog box appears.

    • If you do have a CA certificate configured for CEP, the Online Certificate Request dialog box appears. Under Enrollment method, click File-based.

  3. Optional: Select the Generate exportable key check box.

    Note: You will only be able to export the private key associated with the personal certificate you are now requesting if you check this option now. For security reasons, you cannot change it later.

  4. Under Subject Information, enter all relevant personal information, pressing [image] to move through the dialog box.

    Note: If you press [image], the request will generate before you are finished.

    Remember This information binds your identity to a Public Key that others will look for in a public key directory. Entering inaccurate or misleading information defeats the purpose of using a public key.

  5. Under Request File, enter the drive, directory, and filename for the certificate request file you will send to the CA. The default is C:\Temp\CertReq.req.

  6. Click OK. Certificate Manager now generates a public/private key pair, and then displays a message that a certificate request file has been created. Click OK again.

  7. Optional: To view your request, click the Certificate Requests tab. Select the request and click View. Click inside the certificate window to close it.

  8. Submit the certificate request file to your CA. The certificate request enrollment process varies with each CA, which means that you should already have contacted your CA to find out how to send the certificate request file and how to get a certificate file back. Example

  9. Once you have the certificate file, import it into Certificate Manager.


Import a certificate file containing a personal certificate

If you created a certificate request file and submitted it to your CA through manual enrollment, you may need to import the certificate file that your CA returns to you after your request has been approved. This file contains your personal certificate.

  1. In Certificate Manager, click the My Certificates tab.

  2. Click Import Certificate. The Import Certificate (and Key) dialog box appears.

  3. Under Import Options, clear the Import Private Key check box.

  4. In the Filename dialog box, enter the drive, directory, and filename of the certificate file or click Browse to find it. The default setting is C:\Temp\Cert.cer.

  5. Click Import. If you are asked if you want to add this personal certificate, click Yes.

  6. Optional:

    • To view a personal certificate, select it and click View. Click inside the certificate window to close it.

    • To validate a personal certificate, select it and then click Verify.


Certificate request example

Once you submit a certificate request file to a certificate authority (CA), the CA will approve the request and return a digital certificate to you. Remember that the certificate request approval process varies with each CA, but here is an example of how this might work:

  1. When you created the certificate request file, you saved it to a floppy disk, but kept the default filename. In which case, you would hand-carry A:\CertReq.req to your CA.

  2. Your CA approves the certificate request, and returns an e-mail to you that might look like this:

    Dear Applicant,

    Your Administrator has approved your request for an IPSec OnSite certificate.

    If you have any questions or problems, please contact your Administrator by replying to this e-mail message.

    THE COMMON NAME OF THIS CERTIFICATE: MY NAME

    -----BEGIN CERTIFICATE-----

    MIIC/zCCAmigAwIBAgIQRFfr0rQ4W2xUCfmYzDKCqDANBgkqhkiG9w0BAQQFADCB

    zjEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xRzBFBgNVBAsTPkZvciBWZXJpU2ln

    biBhdXRob3JpemVkIHRlc3Rpbmcgb25seS4gTm8gYXNzdXJhbmNlcyAoQykgVlMx

    OTk4MUcwRQYDVQQLEz53d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvVGVzdENQ

    MA0GCSqGSIb3DQEBBAUAA4GBACBA6T+yqr8xoJfBv2T0/P1AcLxG9tjOMuUPELvV

    mg4jNB2Jj9oD+iIpEp4yf4NhKq6N3p8vcdXXz2FMxhNMHGAqY8mwKhRAPQrJKnVi

    /o9Adoh7SQ3Aoh4ds8CfRcgcrHdQeQBdgszwzRJMTNKP3zj/qvRevIZ/h72MbfWl

    gnvK

    -----END CERTIFICATE-----

  3. Copy the entire digital certificate, from "-----BEGIN CERTIFICATE-----" to "-----END CERTIFICATE-----".

  4. Save as A:\CertReq.cer.

Note: Depending on the certificate authority contacted, a personal certificate request might take up to two or three days to process.


View a certificate request

You can view the information about a pending request for a digital certificate at any time.

  1. In Certificate Manager, click the Certificate Requests tab.

  2. Select the certificate request you want to view.

  3. Click View. A certificate window displays information about the selected certificate request.

  4. Click anywhere in the certificate window to close it.


Delete a certificate request

You can delete a pending request for a digital certificate at any time before or after you submit it to a certificate authority (CA). However, if you requested a personal certificate online through automatic enrollment, your request must be here to import your digital certificate once the CA approves your request.

Remember: Certificate requests clear automatically when you retrieve or import a valid digital certificate.

  1. In Certificate Manager, click the Certificate Requests tab.

  2. Select the certificate request you want to delete.

  3. Click Delete. A confirmation prompt appears.

  4. Click Yes to delete the selected certificate request.

  5. If prompted to delete the key container, click Yes.


Verify a digital certificate

Once you import or retrieve digital certificates, you should verify that they are valid.

  1. In Certificate Manager, click the My Certificates tab to verify that a personal certificate is valid.

    or

    Click the CA Certificates tab to verify that a CA certificate is valid.

  2. Select the certificate you want to verify.

  3. Click Verify. The program checks the validity dates and attempts to check the certificate against its revocation list. An information window returns the current status of the certificate along with its content.

  4. Click OK to close the information window.


View a digital certificate

You can view the information about a personal or CA certificate at any time.

  1. In Certificate Manager, click the My Certificates tab to view a personal certificate.

    or

    Click the CA Certificates tab to view a CA certificate.

  2. Select the digital certificate you want to view.

  3. Click View. A certificate window displays information about the selected digital certificate.

  4. Click anywhere in the certificate window to close it.


Delete a digital certificate

For security or maintenance reasons, you might want to delete a personal or CA certificate.

  1. In Certificate Manager, click the My Certificates tab to delete a personal certificate.

or

Click the CA Certificates tab to delete a CA certificate.

  2. Select the digital certificate you want to delete.

  3. Click Delete. A confirmation window appears.

  4. Click OK to close the confirmation window.


Export a CA certificate

Exporting a CA certificate means copying it to an electronic file. You might export a CA certificate for these reasons:

    • To transfer the CA certificate to another computer

    • To create a backup copy

    • To include in a custom installation

  1. In Certificate Manager, click the CA Certificates tab.

  2. Select a CA certificate.

  3. Click Export. The Export CA Certificate dialog box appears.

  4. Navigate to the drive and directory, and then enter the filename for the certificate you are exporting. The default setting is C:\Temp\CaCert.cer.

Note: If you are creating a custom installation, keep the default filename.

  5. Click Save.


Export a personal certificate

Exporting a personal certificate means copying it to an electronic file. You might export a personal certificate for these reasons:

  • To transfer the personal certificate to another computer

  • To create a backup copy

Note: You must export the private key with the personal certificate. It is available for export only if the Generate exportable key option was checked when the certificate request was made.

  1. In Certificate Manager, click the My Certificates tab.

  2. Select a personal certificate.

  3. Click Export. The Export Certificate and Private Key dialog box appears.

  4. In the Filename box, enter the drive, directory, and filename for the personal certificate file. The default setting is C:\Temp\Cert.p12.

  5. In the Password box, type any password you choose.

  6. In the Confirm Password box, retype the password.

Tip: Write this password down NOW. You will need it to import this file.

  7. Click Export.

Note: Exporting a personal certificate with a private key and a CA certificate will be supported in a future release.


Import a CA certificate

You should already have the CA certificate in a file that was either exported from Certificate Manager or downloaded from the CA's Web site.

  1. In Certificate Manager, click the CA Certificates tab.

  2. Click Import Certificate. The Import CA Certificate dialog box appears.

  3. Navigate to find the file and click Open.

  4. Click Import.

  5. Click Yes when prompted to add this root CA.

    Optional:

    • To view the CA certificate, select it and click View. Click inside the certificate window to close it.

    • To validate the CA certificate, select it and then click Verify.

See also

Configure a CA certificate


Import a personal certificate

To import a personal certificate, you will need the personal certificate file that was exported from Certificate Manager. You will also need the password protecting the private key.

  1. In Certificate Manager, click the My Certificates tab.

  2. Click Import Certificate. The Import Certificate and Private Key dialog box appears.

  3. In the Filename box, enter the drive, directory, and filename for the personal certificate you are importing or click Browse to find it.

  4. In the Password box, type the password that was entered when the file was exported.

  5. Click Import.

  6. Click Yes when prompted to add this personal certificate.

  7. Optional:

    • To view the personal certificate, select it and click View. Click inside the certificate window to close it.

    • To validate the personal certificate, select it and then click Verify.

  8. If you have not already, import the issuing CA certificate.

See also PKCS

Note: Importing a personal certificate with a private key and a CA certificate will be supported in a future release.


Certificate revocation list (CRL)

CRL

A certificate revocation list (CRL) is a list of digital certificates that have been revoked before their expiration dates by the issuing certificate authority (CA). Each CA posts its own CRL to a central directory service daily. Subscribers can access this information directly through the Internet and use it to validate digital certificates from unknown parties.

CRLs are important because the NetScreen-Remote has to obtain the other party's public key from a CA, and if the other party is unknown, you have to rely on his or her digital certificate to verify that they are who they say they are.


Configure a CRL distribution point

Whenever you retrieve or import a digital certificate from a certificate authority (CA), it usually contains a certificate revocation list (CRL) that imports directly into Certificate Manager under the CRLs tab. In most cases, you do not have to configure or request anything. NetScreen-Remote has an IPSec monitoring service runs in the background, which automatically does the following:

  • Every four hours, this service updates the CRLs you have on file based on their distribution points.

  • Every 24 hours, this service checks the certificate requests you have on file, and retrieves the digital certificates from the issuing CA.

CAs usually provide two kinds of distribution points. One kind includes the complete address (URL) of the directory server; in which case, you do not have to configure anything. The other kind includes a location in the directory, which is known as the distinguished name; in which case, you have to provide NetScreen-Remote directions to the directory or LDAP server.

  1. In Security Policy Editor on the Options menu, click Certificate Settings. The Certificate Settings dialog box appears.

  2. Click the Enable automatic CRL retrieval check box and enter the following:

    • In the CRL retrieval interval (hours) box, enter a number from 1 through 24 (The default is 4 hours).

    • In the Default LDAP Server for CRLs box, enter the complete address (URL) of the LDAP server for the selected CA. Contact your CA for this information.

  3. Click OK.


Import a CRL file

You can manually import a CRL into Certificate Manager if your CA did not include it in your digital certificate file.

  1. In Certificate Manager, click the CRLs tab.

  2. Click Import CRL. The Open dialog box appears.

  3. Select the CRL file.

  4. Click Open.

  5. Click OK to confirm that the CRL has been imported.


View a CRL

You can view the information about a CRL at any time.

  1. In Certificate Manager, click the CRLs tab.

  2. Select the CRL you want to view.

  3. Click View. An information window displays information about the selected CRL.

  4. Click OK to close the information window.


Update all CRLs

You can manually update the CRLs you have on file instead of waiting for NetScreen-Remote to update them automatically.

  1. In Certificate Manager, click the CRLs tab.

  2. Click Update All CRLs.

See also

Configure a CRL distribution point


Delete a CRL

If you no longer need the CRL for a particular CA, you can delete it from Certificate Manager.

  1. In Certificate Manager, click the CRLs tab.

  2. Select the CRL you want to delete.

  3. Click Delete. A confirmation window appears.

  4. Click OK to close the confirmation window.


Open security policy editor

Security Policy Editor is the software module within NetScreen-Remote, where users establish connections and their associated proposals and list them in a hierarchical order that defines an Internet protocol (IP) data communications security policy.

  1. Right-click the NetScreen icon [image], located in the lower right-hand corner of your screen.

  2. Click Security Policy Editor on the menu. The Security Policy Editor window appears as shown below.

Note: The actual view depends on the option selected—All Connections, None, or Specified Connections—on the Secure submenu.


Using Pre-Shared keys

Pre- S hared Keys Defined

Certificate Authority Not Required

Entering a Pre- S hared Key

Conveying Pre- S hared Keys to End Users

Restriction

Pre-Shared Keys Defined

A Pre-Shared Key is an alphanumeric string—from eight to 54 characters—that can replace a digital certificate as the means of identifying a communicating party during a Phase 1 IKE negotiation. This key is called "Pre-Shared" because you have to share it with another party before you can communicate with them over a secure connection. Once you both have this key, you would both have to enter it into your respective IPSec-compliant devices (e.g., NetScreen Security Appliance or software client).

Certificate Authority Not Required

If you are using Pre-Shared Keys, you do not need to contact a CA for digital certificates. You should be aware that Pre-Shared Keys do not provide the same level of security as digital certificates. Pre-Shared Keys are recommended for testing, troubleshooting, or one-to-one communications that do not require a corporate security policy.

Note: You must decide whether to use digital certificates or Pre-Shared Keys before you begin configuring the security policy.

Entering a Pre-Shared Key

In the NetScreen-Remote, You enter Pre-Shared Keys in Security Policy Editor when you configure My Identity for a selected connection, as shown below. It does not matter if you are securing All Connections or Specified Connections. Just remember that you have to enter Pre-Shared Keys one connection at a time.

Procedure: Enter a Pre-Shared Key

  1. In Security Policy Editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Under the selected connection, click My Identity.

  3. In the right pane on the Select Certificate list, select None.

  4. Click Pre-Shared Key. The Pre-shared Key dialog box appears.

  5. Click Enter Key.

  6. Enter the key.

  7. Click OK.

  8. Click Save Changes on the File menu.

Conveying Pre-Shared Keys to End Users

If you are the network administrator, you do not have to compromise security by telling your end users the Pre-Shared Key over the phone or by writing it down. Pre-Shared Keys are included with the security policy when you export it.

Restriction

To use Pre-Shared Key for user's with dynamic IP addresses, you must choose the Aggressive Mode option for the Phase 1 negotiation mode.

See Configuring Security Policy for more details.


Outline for configuring the security policy

To configure a security policy, you should follow these steps in this order:

 | Select this... | To do this...
Step 1 | Secure All Connections or | create one connection that secures all IP communications with the option to direct all connections to a specific gateway
 | Secure Specified Connections | create multiple connections and specify which ones to secure
Step 2 | Configure Global Policy Settings | select options that will affect all connections in the security policy
Step 3 | Configure My Identity | select the digital certificate or enter the pre-shared key that identifies you
Step 4 | Configure Security Policy | select the mode Authentication (Phase 1) will use: Main Mode (high security), Aggressive Mode, (low security), Manual Keys (troubleshooting)
Step 5 | Configure Authentication (Phase 1) | add proposals and then select the encryption algorithm, hash algorithm, SA life, or key group
Step 6 | Configure Key Exchange (Phase 2) | add proposals and select ESP or AH
Step 7 | Add redundant gateways | identify backup gateways on the network


Secure all connections

You can create one connection for your security policy that secures IP communications between you and all other parties. The default name for this connection is "All Connections."

  1. In Security Policy Editor on the Options menu, point to Secure, and then click All Connections. Secure is the only option available under Connection Security. You cannot select Non-secure or Block.

  2. Optional: If you want all secure IP communications for this connection to route through a specific secure IPSec-compliant gateway, such as a firewall or router, select the Connect using Secure Gateway Tunnel check box and then select an identifier for that gateway from the ID Type list.

  3. Click Save Changes on the File menu.

  4. Configure My Identity.

See also

Outline for configuring the security policy


Secure specified connections

You can create multiple connections for your security policy and specify which ones will secure IP communications. This involves two main steps:

Step One: Configure "Other Connections"

Other Connections is the catchall rule for all IP communications that do not conform to the proposals you have defined for individual connections.

  1. In Security Policy Editor on the Options menu, point to Secure and then click Specified Connections.

  2. Under Network Security Policy, click Other Connections.

  3. In the right pane under Connection Security, select one of the following options:

    • Secure. This option secures IP communications for this connection.

    • Non-secure. This option allows IP communications for this connection to pass through unsecured.

    • Block. This option does not allow any IP communications for this connection to pass through.

  4. If you selected Secure, and the remote user or network is protected by a secure IPSec-compliant gateway, such as a firewall or router, select the Connect using Secure Gateway Tunnel check box and then select an identifier for that gateway from the ID Type list. Otherwise, go to the next step.

    or

    If you selected Non-secure or Block, you have the option to change the settings under Internet Interface:

    • From the Name list, select the interface your computer will use to connect to a network. An IP address will appear underneath in the IP Addr box for any devices that have an IP address associated with them; you cannot edit the IP address here. Any is the default setting, which allows your computer to choose whichever interface is available.

    • From the Port list, select the protocol port that you will be connecting to the other party with. The number appearing next to your selection is the standard designation, which you cannot change here. All is the default setting, which secures all protocol ports. Remember that selecting the exact protocol port tightens your security policy.

  5. Click Save Changes on the File menu.

  6. If you selected Non-secure or Block, you can now add and configure new connections.

    or

    If you selected Secure, you should configure My Identity for this connection before you add new connections.

Step Two: Add and configure new connections

Note: You should configure "Other Connections" first.

You can create any number of new connections and name them. The system tests for a match between an incoming transmission and the proposed policies listed in Security Policy Editor. You can reorder the sequence by moving the policies up or down in the Network Security Policy list. Remember that "Other Connections" is always the last rule in the list.

To set up a new connection, you will need to contact the other party for information, such as their IP address, network IP address, domain name, e-mail address, IP subnet, IP address range, or subject information (name, department, company, state, and country) for the distinguished name. Plus, if the remote user or network is protected by a secure IPSec-compliant gateway, you must also know the gateway's IP address.

  1. In Security Policy Editor, select a connection name.

  2. On the Edit menu, point to Add and then click Connection.

  3. Enter a connection name, and then press [image].

  4. Under Connection Security, select one of the following options:

    • Secure. This option secures IP communications for this connection.

    • Non-secure. This option allows IP communications for this connection to pass through unsecured.

    • Block. This option does not allow any IP communications for this connection to pass through.

  5. Under Remote Party Identity and Addressing, select an identifier for the other party from the ID Type list and enter the required information.

  6. Optional: From the Protocol list, select a protocol that the other party will be using to connect with you. If you choose UDP or TCP, you can select a protocol port on the Port list. The number appearing next to your selection is the standard designation, which you cannot change here. All is the default setting for both options, which secures all protocol ports. Remember that selecting the exact protocol port tightens your security policy.

  7. If you selected Secure and the remote user or network is protected by a secure IPSec-compliant gateway, such as a firewall or router, select the Connect using Secure Gateway Tunnel check box and then select an identifier for that gateway from the ID Type list. Otherwise, go to the next step.

    or

    If you selected Non-secure or Block, you have the option to change the settings under Internet Interface:

    • From the Name list, select the interface your computer will use to connect to a network. An IP address will appear underneath in the IP Addr box for any devices that have an IP address associated with them; you cannot edit the IP address here. Any is the default setting, which allows your computer to choose whichever interface is available.

    • From the Port list, select the protocol port that you will be connecting to the other party with. The number appearing next to your selection is the standard designation, which you cannot change here. All is the default setting, which secures all protocol ports. Remember that selecting the exact protocol port tightens your security policy.

  8. Click Save Changes on the File menu.

  9. Configure My Identity for this connection.

  10. Repeat steps 1 through 8 to add more new connections.

See also

Outline for configuring the security policy


Configure global policy settings

Global policy settings are program preferences that affect all secure IP communications. You can change these at any time.

  1. In Security Policy Editor on the Options menu click, Global Policy Settings. The Global Policy Settings dialog box appears.

  2. Change these settings according to your security policy.

  3. Click OK when done.

  4. Click Save Changes on the File menu.

See also

Outline for configuring the security policy


Configure my identity

The information you enter when configuring My Identity is used by the party you want to communicate with to verify your identity. For every secure connection, you will need to choose a digital certificate or a pre-shared key:

  • If you choose to use a digital certificate, you should already have a personal certificate in Certificate Manager.

  • If you choose to enter a pre-shared key, you must exchange it with the other party in advance.

  1. In Security Policy Editor under Network Security Policy, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Click My Identity.

  3. In the right pane, enter a pre-shared key or select a digital certificate from the Select Certificate list and then select your identifier from the ID Type list.

  4. You have the option to enter or change these parameters:

  • From the Port list, select the protocol port that specifies how another party will communicate with you. The number appearing next to your selection is the standard designation, which you cannot change here. All is the default setting, which secures all protocol ports. Remember that selecting the exact protocol port tightens your security policy.

  • In the Internal Network IP Address box, enter an IP address. This option appears only if you checked Allow to Specify Internal Network Address in the Global Policy Settings dialog box.

  • From the Name list under Internet Interface, select the interface your computer will use to connect to a network. An IP address will appear underneath in the IP Addr box for any devices that have an IP address associated with them; you cannot edit the IP address here. The default setting is Any, which allows your computer to choose whichever interface is available.

  5. Click Save Changes on the File menu.

  6. Configure Security Policy.

See also

Outline for configuring the security policy


Configure a security policy

Before you configure a security policy, you must already have defined a secure connection and configured the preliminary settings through All Connections or Specified Connections. In addition, you should have already configured My Identity.

The purpose of configuring a security policy is to create a VPN security association (SA) for each connection. SAs are created in one of two ways: through automatic negotiation (using the IKE protocol) or manually. There are two phases to every AutoKey (IKE) negotiation, which you must also configure:

Phase 1 - Authentication. During Phase 1, individuals reveal their identities and negotiate how they will secure Phase 2 communications. Phase 1 can be one of two types:

  • Main Mode (MM). This mode protects identities, which are not revealed until secure communications have been established.

  • Aggressive Mode. This mode speeds the negotiation; identities are revealed before secure communications have been established, reducing the number of Phase 1 steps.

Phase 2 - Key Exchange. During Phase 2, also known as Quick Mode (QM), individuals negotiate the encryption and message authentication algorithms and develop the necessary shared keys to be used for secure communications. Phase 2 communications are secured as negotiated during Phase 1.

  1. In Security Policy Editor under Network Security Policy, double-click a secure connection to expand it. Secure connections are identified by a closed lock [image].

  2. Click Security Policy, which is located beneath My Identity for the connection you have selected.

  3. In the right pane under Select Phase 1 Negotiation Mode, click one of these options:

  • Main Mode. This mode ensures the highest level of security when the communicating parties are negotiating authentication (Phase 1).

  • Aggressive Mode. This mode is quicker than Main Mode because it eliminates several steps when the communicating parties are negotiating authentication (Phase 1).

Note: If you are receiving a dynamically assigned IP address for your computer, then you must use a dial-up VPN connection (as defined on the gateway) to tunnel to a NetScreen security appliance. Dial-up VPN connections with AutoKey IKE must select the Aggressive Mode option here.

  • Use Manual Keys. This mode requires no negotiations; it is available for troubleshooting only.

Note: If you are receiving a dynamically assigned IP address for your computer, then you must use a dial-up VPN connection (as defined on the gateway) to tunnel to a NetScreen security appliance. Dial-up VPN connections using manual key must select the Manual Key option here.

  4. Optional:

  • Select Enable Perfect Forward Secrecy (PFS), and select a Diffie-Hellman group from the PFS Key Group list.

  • Select Enable Replay Detection.

  5. Click Save Changes on the File menu.

Note: If you selected Use Manual Keys, skip the next step, Configure authentication (Phase 1), and configure key exchange (Phase 2).


Configure authentication (Phase 1)

Once you have configured Security Policy for a secure connection, you must then configure the authentication and key exchange proposals for that policy, one connection at a time.

Note: If you are using manual keys, skip this procedure and go to Configure Key Exchange (Phase 2).

  1. In Security Policy Editor under Network Security Policy, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Expand Security Policy under the selected connection. Authentication (Phase 1) and Key Exchange (Phase 2) appear beneath the selected security policy.

  3. Expand Authentication (Phase 1). Proposal 1 appears.

Note: If the options here are unavailable, disable manual keys.

  4. If you are configuring the first proposal, click Proposal 1 and go to the next step.

    or

    If you are creating the next proposal, click Create New Proposal, or select a proposal and click the copy button on the toolbar.

  5. In the right pane, select the following options for this proposal:

    • Authentication Method. If you entered a pre-shared key under My Identity, then you will see "Pre-Shared Key" here. If you selected a digital certificate under My Identity, then you will see "RSA Signatures" here. Select the option that includes "Extended Authentication" only if your gateway is configured for this feature.

      Note: NetScreen devices do not support Extended Authentication with Pre-Shared Key.

    • Encryption Algorithm. Select DES for minimal security or Triple-DES for highest security.

    • Hash Algorithm. Select MD5 for minimal security or SHA-1 for highest security.

    • SA Life. Select Unspecified or Seconds and enter a value.

    • Key Group. Select Diffie-Hellman Group 1, 2 or 5.

  6. Click Save Changes on the File menu.

  7. For additional proposals, repeat steps 4 through 6.

  8. Configure Key Exchange (Phase 2).

See also

Outline for configuring the security policy

Security policy options


Configure key exchange (Phase 2)

Once you have configured Security Policy for a secure connection, you must then add and configure the authentication and key exchange proposals for that policy one connection at a time. If you have not already done so, go to Configure Authentication (Phase 1).

  1. In Security Policy Editor under Network Security Policy, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Expand Security Policy under the selected connection. Authentication (Phase 1) and Key Exchange (Phase 2) appear beneath the selected security policy.

  3. Expand Key Exchange (Phase 2). Proposal 1 appears.

  4. If you are configuring the first proposal, click Proposal 1 and go to the next step.

    or

    If you are creating the next proposal, click Create New Proposal, or select a proposal and click the copy button on the toolbar.

  5. Under IPSec Protocols, select these options:

  • SA Life. Select the SA Life and enter the required information under Seconds or KBytes.

  • Compression. Leave the setting at None, because the devices at both ends of the VPN tunnel must support this feature.

Note: Other NetScreen devices do not currently support compression.

  • Select Encapsulation Protocol (ESP) or Authentication Protocol (AH) for this proposal.

    Remember: Encapsulation protocol encrypts and authenticates the data; authentication protocol assures that the data has not been altered.

  6. If you selected Encapsulation Protocol (ESP) select these options:

  • Encryption Algorithm. Select DES for minimal security, Triple-DES for highest security, or Null for none.

  • Hash Algorithm. Select MD5 for minimal security, SHA-1 for highest security, or DES-MAC.

  • Encapsulation. Select Tunnel or Transport. Tunnel is the only option available if the the Connect using Secure Gateway Tunnel check box is selected.

or

If you selected Authentication Protocol (AH) select these options:

  • Hash Algorithm. Select MD5 for minimal security or SHA-1 for highest security.

  • Encapsulation. Select Tunnel or Transport. Tunnel is the only option available if the Connect using Secure Gateway Tunnel check box is selected.

  7. If you selected Use Manual Keys under Select Phase 1 Negotiation Mode, you will see these buttons: Inbound Keys and Outbound Keys. You can now enter manual keys to troubleshoot this connection.

  8. Click Save Changes on the File menu.

  9. For additional proposals, repeat steps 4 through 9.

Tip: You should export your security policy to create a backup copy.

See also

Outline for configuring the security policy

Security policy options


Add a redundant gateway

A redundant gateway is an alternate gateway to access your network that will establish a connection with the client if the primary gateway is busy, offline, or down. You can add up to 10 alternates per secure connection, but only if the Connect using Secure Gateway Tunnel check box is selected and configured. This will always serve as the primary.

Notes:

  • All redundant gateways must be configured with the same security policy information, except for the distinguished name, IP address, or pre-shared key; this information must be unique to each device.

  • Alternates are selected in the order they are listed in the security policy. The client will rollover to an alternate only if the primary does not respond. If the client receives a response from the primary, it will keep trying to establish a connection.

  • When the security association (SA) times out, the client will attempt to connect with the primary. If the primary is busy, it will go back to the last active alternate.

  1. In Security Policy Editor, select a secure connection name. A closed lock [image] identifies secure connections.

  2. In the right pane, make sure the Connect using Secure Gateway Tunnel check box is selected. If not, follow these steps:

    1. Select the check box.

    2. Select an ID type from the list.

    3. Enter the requisite information.

  3. On the Edit menu, point to Add and then click Redundant Gateway.

  4. In the New Name for RGW X dialog box, enter a name. (The "X" equals the sequence number, 1 through 10.)

  5. Click OK. The new gateway [image] appears under Security Policy for this connection.

  6. In the right pane, select an identifier for the new gateway from the ID Type list and enter the requisite information.

  7. If you have a digital certificate selected in My Identity for this connection, you are finished adding a redundant gateway.

    or

    If you have a pre-shared key entered in My Identity for this connection, follow these steps to enter the pre-shared key for the selected gateway:

Important Note: The pre-shared key entered here must match the pre-shared key entered in My Identity.

    1. Click Pre-Shared Key. The Pre-shared Key dialog box appears.

    2. Click Enter Key.

    3. Enter the key.

    4. Click OK.

  1. Click Save Changes on the File menu.

Troubleshooting Tip: If the client selects an alternate when you know that the primary is available, then you may need to increase the Retransmit Interval under Global Policy Settings.

See also


Replay detection

Replay Detection is essentially a counter within the NetScreen-Remote that determines if a packet is unique. If it is not, it could be a hacker’s attempt to capture a packet and replay it to you with false information. The default is to use Replay Detection; the option is selected.


Perfect forward secrecy

Perfect Forward Secrecy (PFS) is an extra step during the Internet Key Exchange (IKE) negotiation that requires the exchange of independent keying material every time Quick Mode keys are to be generated. It takes place after Main Mode, which establishes authentication, and before Quick Mode, which establishes keys. Each set of Quick Mode keys is independent from and cannot be linked back to Main Mode keying material. Hence the name perfect forward–there is no way back. Because this takes longer, the default is not to use PFS; the option is not selected.


Security association

The security association (SA) comprises the encryption algorithm, message authentication algorithm, and associated data encryption keys and message authentication keys that are needed to secure communications.


Edit the security policy

Once you create connections for a security policy, you can change any option at any time.

  1. In Security Policy Editor under Network Security Policy, select a connection; expand secure connections for further options. A closed lock [image] identifies secure connections.

  2. Change any settings in the right pane.

  3. Click Save Changes on the File menu.

Note: If you attempt to save changes while a secure connection is active, you will be prompted to reset your active connection. If you click Yes, the active connection will be dropped and your new security policy will take effect. If you click No, you can keep your changes and then wait until the connection is no longer active to save; in which case, you can reload the security policy later.


Disable redundant gateways

You can disable all redundant gateways for a selected secure connection without deleting them.

  1. In Security Policy Editor, select a secure connection. A closed lock [image] identifies secure connections.

  2. In the right pane, clear the Connect using Secure Gateway Tunnel check box.

  3. Click Save Changes on the File menu.


Reload the security policy

Whenever you try to modify your existing security policy and save it while a secure connection is active, you will be prompted to reset your active connection. If you click No, you can keep your changes and then wait until the connection is no longer active to save.

Warning! This action overwrites your existing security policy and resets (drops) any active connections.

  1. Right-click the NetScreen icon [image] .

  2. Click Reload Security Policy on the menu.


Add a connection

  1. In Security Policy Editor on the Options menu, point to Secure and then click Specified Connections.

  2. On the toolbar, click [image]. A new connection appears in the Network Security Policy list.

  3. Enter a name in the box.

  4. Press [image].

  5. Click Save Changes on the File menu.

See also

Secure Specified Connections


Add a proposal

  1. In Security Policy Editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Select Authentication (Phase 1) or Key Exchange (Phase 2).

  3. In the right pane, click Create New Proposal.

  4. Click Save Changes on the File menu.

See also

Configure Authentication (Phase 1)

Configure Key Exchange (Phase 2)


Copy a connection

  1. In Security policy editor, select a connection.

  2. On the toolbar, click [image]. A copy of the connection appears under the selected connection.

  3. Enter a name in the box.

  4. Press [image].

  5. Click Save Changes on the File menu.


Copy a proposal

Note: You can only copy proposals for Authentication (Phase 1) or Key Exchange (Phase 2) in the selected connection. You cannot copy proposals to another phase or connection.

  1. In Security policy editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Under Authentication (Phase 1) or Key Exchange (Phase 2), select a proposal.

  3. On the toolbar, click [image]. Another proposal appears in sequential order; you cannot change the name.

  4. Click Save Changes on the File menu.


Copy a redundant gateway

A quick way to add redundant gateways to a connection is to copy them. However, they cannot be copied from one connection to another.

  1. In Security Policy Editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Right-click a redundant gateway [image].

  3. On the shortcut menu, click Copy. The New Name for RGW X dialog box appears. (The "X" equals the sequence number, 1 through 10.)

  4. Enter a new name.

  5. Click OK.

  6. Click Save Changes on the File menu.


Move a connection

  1. In Security Policy Editor under Network Security Policy, select a connection.

  2. On the toolbar, click the up arrow [image] to move the connection up or the down arrow [image] to move the connection down.

  3. Click Save Changes on the File menu.


Move a proposal

  1. In Security Policy Editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Under the selected connection, expand Security Policy to reveal Authentication (Phase 1) and Key Exchange (Phase 2).

  3. Expand Authentication (Phase 1) or Key Exchange (Phase 2) to reveal the proposals listed underneath.

  4. Select a proposal.

  5. On the toolbar, click the up arrow [image] to move the proposal up or the down arrow [image] to move the proposal down.

  6. Click Save Changes on the File menu.

Notes:

  • Proposals cannot be renamed.

  • Proposals are always numbered sequentially beginning with number one, no matter which proposal you move up or down to replace other proposals. For example, if you move number three up to the number two position, the parameters for number three appear in the order you selected, but Security Policy Editor renumbers three to two.


Move a redundant gateway

Redundant gateways can be reordered in the security policy only in a connection. They cannot be moved from one connection to another.

  1. In Security Policy Editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Select a redundant gateway [image].

  3. On the toolbar, click the up arrow [image] to move the gateway up or the down arrow [image] to move the gateway down.

  4. Click Save Changes on the File menu.


Rename a connection

  1. In Security Policy Editor, right-click a connection.

  2. On the shortcut menu, click Rename.

  3. Enter a new name in the box.

  4. Press [image].

  5. Click Save Changes on the File menu.


Rename a redundant gateway

  1. In Security Policy Editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Right-click a redundant gateway [image].

  3. On the shortcut menu, click Rename. The New Name for RGW X dialog box appears. (The "X" equals the sequence number, 1 through 10.)

  4. Enter the new name.

  5. Click OK.

  6. Click Save Changes on the File menu.


Delete a connection

  1. In Security policy editor, select a connection.

  2. On the toolbar, click [image]. A confirmation prompt appears.

  3. Click Yes.

  4. Click Save Changes on the File menu.


Delete a proposal

Note: You must always have at least one proposal listed under both Authentication (Phase 1) and Key Exchange (Phase 2).

  1. In Security Policy Editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Under Authentication (Phase 1) or Key Exchange (Phase 2), select a proposal.

  3. On the toolbar, click [image]. A confirmation prompt appears.

  4. Click Yes.

  5. Click Save Changes on the File menu.


Delete a redundant gateway

  1. In Security policy editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Select a redundant gateway [image].

  3. On the toolbar, click [image]. A confirmation prompt appears.

  4. Click Yes.

  5. Click Save Changes on the File menu.

See also

Add a redundant gateway


Deactivate the security policy

You may, at any time, override (deactivate) your current security policy and allow all communications to transmit unsecured. You can do this from the shortcut menu or from Security Policy Editor.

Notes:

  • Neither method described here stops this application. It will continue to run in the background, but without securing communications.

  • You will not be able to communicate with other parties on secure connections unless they have disabled their security policy as well.

From Security Policy Editor:

  1. On the Options menu, point to Secure, and then click None.

  2. Click Save Changes on the File menu.

From the taskbar:

  1. Right-click the NetScreen-Remote icon.

  2. On the menu, click Deactivate Security Policy. This shortcut acts as a toggle. It should now read Activate Security Policy.

See also

Reactivate the security policy


Reactivate the security policy

You will need to reactivate the security policy if you deactivated it from the shortcut menu or Security Policy Editor.

From Security Policy Editor:

  1. On the Options menu, point to Secure, and then click either Secure All Connections or Secure Specified Connections.

  2. Click Save Changes on the File menu.

From the taskbar:

  1. Right-click the NetScreen icon [image] .

  2. On the menu, click Activate Security Policy. This shortcut acts as a toggle. It should now read Deactivate Security Policy.


Export the security policy

Exporting a security policy means copying the proposals and parameters for each connection to an electronic file. You might export a security policy to:

  • create a backup copy.

  • include in a custom installation.

  • distribute to end users in one file via e-mail, network directory, or floppy disk.

  1. In Security Policy Editor on the File menu, click Export Security Policy. A dialog box appears asking if you would like to protect (lock) the security policy:

    • If you click No, the security policy can be edited after it is imported into Security Policy Editor.

    • If you click Yes, the security policy cannot be edited after it is imported into Security Policy Editor. This feature locks the security policy settings so that end users cannot change them.

  2. In the Save As dialog box, navigate to the directory where you want to save this file and enter the filename. The default is C:\policy.spd.

    Note: If you are creating a custom installation, rename this file exactly as it appears here:

    IPSecPolicy.spd

  3. Click Save.

See also

Import a Security Policy


Import the security policy

Make sure you have the electronic security policy file that was exported from Security Policy Editor. The default name for this file is policy.spd.

Caution! Importing a security policy overwrites any existing policy.

  1. In Security Policy Editor on the File menu, click Import Security Policy.

  2. In the Open dialog box, navigate to the drive and directory where the file is stored and select it.

  3. Click Open. A confirmation prompt appears.

  4. Click Yes.


IPSec

Internet Protocol Security (IPSec) is a set of encryption and authentication standards defined by the Internet Engineering Task Force (IETF). These standards allow virtual networking products to share public keys and encryption algorithms.


Triple-DES

This is a more powerful version of DES in which the original DES algorithm is applied in three rounds, using a 168-bit key.


Security policy options

This form lists the phase 1 and phase 2 options that are essential to establishing a secure connection with another device. Print the form to use as a reference when configuring the security policy. Click Reset to restore the defaults.

Main Mode

Aggressive Mode

Perfect Forward Secrecy: Key group

Phase 1

Phase 2

Authentication method

SA life

Encryption algorithm

Compression

Hash algorithm

Encapsulation Protocol (ESP)

SA life

Encryption algorithm

Key group

Hash algorithm

Encapsulation

Authentication Protocol (AH)

Hash algorithm

Encapsulation

Notes:

  • Main Mode and Aggressive Mode requires both phase 1 and phase 2 configuration; Use Manual Keys requires phase 2 only.

  • Tunnel is the only encapsulation option available if the Connect using Secure Gateway Tunnel check box is selected.

See also

Getting Started


Global policy settings

Retransmit Interval (seconds)

The retransmit interval is the length of time this application waits before it retransmits an IKE protocol packet that has not been responded to. The default interval is 15 seconds, which you can increase or decrease according to the security level you require.

Number of retries

The number of retries is the number of times your computer retransmits an IKE protocol packet before abandoning the exchange. The default is 3 tries, which you can increase or decrease according to the security level you require.

Send status notifications to peer hosts

Status notifications are messages that inform communicating parties whether their security proposals have been accepted or rejected, and what the timeout periods are.

Allow to Specify Internal Network Address

An Internal Network IP Address is a virtual IP address assigned to the NetScreen-Remote user. If you select this option, you must enter a private Internal Network IP Address under My Identity. This feature allows road warriors to appear as internal users on a private network to, for example, access a WINS server or browse the network.


LDAP

Lightweight Directory Access Protocol (LDAP) is a directory service protocol that uses a subset of the X.500 directory standard to provide a common way to identify user and group information. It can be extended to provide information on other network resources.


PKCS

Public key cryptography standards (PKCS)

  • PKCS-10 describes syntax for certification requests. It is used for exporting and importing personal certificates. PKCS-10 requires more overhead but is more secure than PKCS-12.

  • PKCS-12 specifies a portable format for storing or transporting a user's private keys and certificates. PKCS-12 is easier to use than PKCS-10 but not as secure, since the generated private key is sent and could be intercepted.

NetScreen-Remote does not currently support PKCS-12 but it works well for distributing these for client distribution.


URL

A Uniform Resource Locator (URL) is an Internet address that locates a specific resource on the World Wide Web or elsewhere on the Internet. It consists of the Internet protocol name; a host name; and optionally other elements such as a port, directory, and filename.

The following are examples of URLs that include the protocol name:

  • http://www.mycompany.com/

  • http://www.yourcompany.com/helpdesk/faqs/

The following are examples of URLs that do not include the protocol name:

  • www.mycompany.com

  • www.yourcompany.com/helpdesk/faqs/

You would use the latter form with browsers that automatically assume the connection is through HTTP.


ID types

These are the identification (ID) types in Security Policy Editor.

My Identity

The options available for ID types under My Identity are taken from the subject information section of a personal certificate, which you enter when you submit a certificate request to a CA. This information distinguishes you from the other party during the key exchange process.

Tip: If you need to make a selection, but you are not sure which boxes were filled in on the request, click View. This option displays the information that is in the selected digital certificate.

Redundant Gateway Identity and Addressing

If you are adding a backup gateway to your security policy, it must have the same security settings as the primary except for the distinguished name, IP address, or pre-shared key. This information identifies this device on your network and must therefore be unique.

Remote Party Identity and Addressing

and

Secure Gateway Tunnel

These two ID types work together. They determine the remote computer or network you will be communicating with and, optionally, a secure gateway tunnel that is protecting the network.

If you are communicating with a computer or network that is NOT protected by a secure gateway, verify that the Connect using Secure Gateway Tunnel check box is unchecked, and then select and enter one of the following ID types:

Remote Party Identity and Addressing ID Type—No Secure Gateway

Distinguished name and IP address

Domain name and IP address

E-mail address and IP address

IP address

IP address range

IP subnet

If you are connecting to a computer or network that IS protected by a secure gateway, select the Connect using Secure Gateway Tunnel check box then select and enter one each of the following two ID types:

Remote Party Identity and Addressing | Secure Gateway Tunnel
IP IP address range IP subnet | Distinguished name and IP address Domain name and IP address IP address

Important Notes:

Note: For compatibility with other NetScreen devices, distinguished name as My Identity is not supported.

  • Whichever ID type the other party has selected to identify itself with, for example under My Identity, you must enter as the Remote Party Identity and Addressing ID Type.

  • Enter the ID type exactly as it appears in the other party's security policy, matching spelling, type case, punctuation, and spacing.

  • For compatibility with other NetScreen devices, do not use IP address range as the Remote party IP and addressing.

  • For compatibility with other NetScreen devices, use IP address as Secure Gateway Tunnel ID Type in pre-shared key IKE situation.

  • For compatibility with other NetScreen devices, use domain name as Secure Gateway Tunnel ID Type and then enter the correct IP address (this is mandatory, not optional) in certificate IKE situations.


Policy management

The options under Policy Management apply to NetScreen-Remote only if it is managed by the SafeNet/VPN Policy Manager, which contains detailed instructions on configuring these options. Contact your authorized distributor for more information about this VPN management product.


Key

A key is a number, or variable, used by an algorithm to encrypt or decrypt data. It should be an alphanumeric string—of eight characters or more containing both letters and numbers.


Dynamic IP address

  1. Use dynamically assigned IP addresses in these cases:

  • cable or DSL with PPPoE address assignment

  • traveling user using a different POP in every city

Note: When using a dynamic IP address, you must choose the Aggressive Mode option for the Phase 1 negotiation mode.


Internet key exchange (IKE)

Internet Key Exchange using ISAKMP/Oakley (IKE) is a networking protocol that secures communications between two encryptors. It defines how individuals communicating through public key technology establish shared keys for their data encryption and message authentication. These IKE negotiations, which are transparent to users, appear as descriptive messages in an encryptor's communications log.


VPN

A virtual private network (VPN) is a secure communications network that operates through a public communications network, such as the Internet. Only authorized users can access the VPN they belong to.


Tunnel mode

Tunnel Mode allows an IP communications packet to transmit over a virtual private network (VPN), which encapsulates the packet header during transmission.


Use Manual Key to troubleshoot problem connections

Manual Key Defined

Enabling_Manual_Keys

Entering Manual Keys

Attempting Secure Communications

Manual Keys Defined

Manual keys are IPSec encryption and authentication keys that you enter manually instead of allowing NetScreen-Remote to generate them automatically. They eliminate the need for a digital certificate or pre-shared key and all IKE negotiations during Authentication (Phase 1) and Key Exchange (Phase 2). They are designed to help you determine if secure communications are possible.

Caution! Manual keys are intended for troubleshooting problem connections. They should not be part of an ongoing security policy, as the process of distributing these keys may not be secure.

Enabling Manual Keys

To enable the manual keys option, your personal certificate under My Identity must be disabled. If a pre-shared key is entered, it is ignored.

Procedure: Enable manual keys

  1. In Security Policy Editor, expand a secure connection. A closed lock [image] identifies secure connections.

  2. Under the selected connection, click My Identity.

  3. In the right pane in the Select Certificate list, select None.

  4. Under My Identity, click Security Policy.

  5. In the right pane under Select Phase 1 Negotiation Mode, select Use Manual Keys.

    Note: Two options are now disabled: Enable Perfect Forward Secrecy (PFS) and Enable Replay Detection.

  6. Expand Security Policy.

  7. Expand Key Exchange (Phase 2) to reveal any proposals.

  8. Click a proposal.

  9. In the right pane, select Encapsulation Protocol (ESP) or Authentication Protocol (AH).

  10. If you selected Encapsulation Protocol (ESP), select the encryption algorithm, hash algorithm, and encapsulation method. Note the following:

  • Which Encrypt Alg you select. You will need to enter a value for it in the ESP Encryption Key box.

  • Which Hash Alg you select. You will need to enter a value for it in the ESP Authentication Key box.

  • Tunnel is the only Encapsulation option available if the Connect using Secure Gateway Tunnel check box is selected.

  • Make sure the party you are communicating with selects the same options.

    or

    If you selected Authentication Protocol (AH), select the hash algorithm and encapsulation method. Note the following:

  • Which Hash Alg you select. You will need to enter a value for it in the AH Authentication Key box.

  • Tunnel is the only Encapsulation option available if the Connect using Secure Gateway Tunnel check box is selected.

  • Make sure the party you are communicating with selects the same options.

Entering Manual Keys

Once you enable manual keys, you will see two buttons under the Key Exchange (Phase 2) proposal: the Inbound Keys button and the Outbound Keys button. Why two buttons? Because the secure connection between two parties transmits communications in two directions: inbound and outbound.

You and the party you are attempting to communicate with must enter the same keys, but in reverse order. This means that the key you enter as an inbound key, the other party should enter as an outbound key and vice versa as shown here:

Each direction requires a separate key; the exact length varies with the encryption algorithm or hash algorithm you have selected:

Algorithm | Character Length:
 | ASCII | Binary
DES | 8 | 16
Triple-DES | 24 | 48
MD5 | 16 | 32
SHA-1 | 20 | 40

Procedure: Enter inbound keys

  1. Click the Inbound Keys button. The Inbound Keying Material (Decryption) dialog box appears.

  2. In the Security Parameters Index box, enter a number (up to 8 digits) or keep the default value, 100.

Note: The value entered here must match the other party's.

  3. Click the Enter Key button.

  4. Select ASCII or Binary as the key format.

  5. Enter the key(s) in the available box(es).

  6. Click OK.

  7. Click Save Changes on the File menu. A yellow key now appears in the NetScreen-Remote icon.

Procedure: Enter outbound keys

  1. Click the Outbound Keys button. The Outbound Keying Material (Encryption) dialog box appears.

  2. In the Security Parameters Index box, enter a number (up to 8 digits) or keep the default value, 100.

Note: The value entered here must match the other party's.

  3. Click the Enter Key button.

  4. Select ASCII or Binary as the key format.

  5. Enter the key(s) in the available box(es).

  6. Click OK.

  7. Click Save Changes on the File menu. A yellow key now appears in the NetScreen-Remote icon.

Attempting Secure Communications

Once you have entered the manual keys, you can try to communicate securely with the other party. Try to ping the other computer from the MS-DOS prompt or map one of its drives from Explorer. You will not, however, be able to view any messages in the Log Viewer.

See also

Disable Manual Keys


Disable manual keys

When you have finished using manual keys for troubleshooting, you can return to your original settings one of two ways. The method you select depends on whether you are using digital certificates or pre-shared keys.

To return to using digital certificates:

  1. In Security Policy Editor, select the secure connection you have been troubleshooting with manual keys. A closed lock [image] identifies secure connections.

  2. Expand the connection.

  3. Click My Identity.

  4. In the right pane under My Identity, select a personal certificate. Your original settings will be restored.

To return to using pre-shared keys:

  1. In Security Policy Editor, select the secure connection you have been troubleshooting with manual keys. A closed lock [image] identifies secure connections.

  2. Expand the connection.

  3. Click Security Policy.

  4. In the right pane under Select Phase 1 Negotiation Mode, select Main Mode or Aggressive Mode. Your original settings will be restored.


View the communications log

Log Viewer displays the communications log, a diagnostic tool that lists the IKE negotiations that occur during Authentication Phase 1.

Note: NetScreen-Remote does not save this information. Unless you freeze and save or print this information, it will be cleared by ongoing negotiations.

  1. Right-click the NetScreen icon [image] .

  2. Click Log Viewer on the menu. The Log Viewer window appears as shown below.

See also


Save the communications log

Tip: You may want to freeze the log before you attempt to save it.

  1. In the Log Viewer window, click Save Log.

  2. In the Save As dialog box, navigate to the directory where you want to save the file and enter a filename.

  3. Click Save.


Print the communications log

Tip: You may want to freeze the log before you attempt to print it.

  1. In the Log Viewer window, click Print.

  2. In the Print dialog box, select a printer and then click OK.


Clear the communications log

In the Log Viewer window, click Clear.

Note: You cannot retrieve this information once you clear it.


Freeze/unfreeze the communications log

Because the communications log scrolls through IKE negotiations as they occur, you may need to freeze the log in order to save or print specific messages.

In the Log Viewer window, click Freeze. Since this button acts as a toggle, it will now read UnFreeze until you click it again to restart the log.

See also

Print the communications log

Save the communications log


View active connections

The Connection Monitor utility displays statistical and diagnostic information for each active connection in the security policy. This utility is designed to display the actual security policy settings configured in Security Policy Editor and the security association (SA) information established during Phase 1 IKE negotiations and Phase 2 IPSec negotiations.

To open Connection Monitor:

  1. Right-click the NetScreen icon [image] in the lower right-hand corner.

  2. Click Connection Monitor on the menu. The Connection Monitor window appears as shown below.

    You will see an icon to the left of the connection name:

    • An "SA" indicates that the connection has only a Phase 1 IKE SA. This occurs when connecting to a secure gateway tunnel or when a Phase 2 IPSec SA fails to establish or has not been established yet.

    • A key indicates that the connection has a Phase 2 IPSec SA, or both a Phase 1 and Phase 2 SA. When there is a single Phase 1 SA to a gateway that is protecting multiple Phase 2 SAs, there will be a single Phase 1 connection with the SA icon and individual Phase 2 connections with the key icon listed above that entry.

    • A black mark moving beneath the key icon indicates that the client is processing secure IP traffic for that connection.

Notes:

  • Global Statistics are not real-time operations; they are updated every five seconds.

  • Dropped Packets includes packets from connections that are configured as blocked.

  • Remote Modifier is either the remote party subnet mask or the end of the address range when IP Address Range is selected for the Remote Party Identity and Addressing ID Type.

To view details:

  1. Click a connection.

  2. Click Details. The Security Association Details window appears as shown below. You will see a Phase 1 tab and/or a Phase 2 tab; these tabs indicate that the selected connection has established SAs.

  3. To view Authentication (Phase 1) security associations negotiated by IKE, click the Phase 1 tab.

  4. To view Key Exchange (Phase 2) security associations negotiated by IPSec, click the Phase 2 tab.

Note: Private Addr is the Internal IP Address.


Authenticate N Go

Please refer to NetScreen-Remote Administrator Guide chapter 8 for information on this topic.


Installation

Configuration of Authenticate N Go

Type topic text here.