User manual ZYXEL ADMINGUIDEREVA

[. . . ] VPN Administration Guide Revision A SafeNet/Soft-PK Version 5. 1. 3 Build 4 Sidewinder Version 5. 1. 0. 02 Copyright Notice This document and the software described in it are copyrighted. Under the copyright laws, neither this document nor this software may be copied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior written authorization of Secure Computing Corporation. Copyright © 2001, Secure Computing Corporation. Made in the U. S. A. Trademarks Secure Computing, Sidewinder, Type Enforcement, and Strikeback are either registered trademarks or trademarks of Secure Computing Corporation. [. . . ] Export the firewall certificate (for later transfer to each client system) 6. 7. Optional fields to identify information (in addition to DN). Select Self Signed. Select RSA. Click Add to add the certificate to the Certificates list. Click Close to return to the Firewall Certificate window. Click Export and save the firewall certificate (containing the public key) to a file. Add a . pem extension (for example, "firewallcert. pem"). Click OK when done. Once you have finished creating the firewall certificate, you will typically copy it to an MS-formatted diskette for distribution to each remote Soft-PK client. You can do this using the mcopy command. For example: % mcopy -t filename a:filename Configuring Sidewinder for Soft-PK Clients 3-5 Managing Sidewinder self-signed certs Creating & exporting remote certificate(s) Use the following procedure on Sidewinder to create a self-signed certificate file (with its embedded public key) and a private key file for each of your Soft-PK clients. Once a pair of certificate/private key files are created for a unique client, you must use Sidewinder's pkcs12_util command to combine each file pair into a PKCS12formatted object. Each PKCS12-formatted object must be distributed to the respective Soft-PK client. From the Sidewinder Cobra interface: Note: Do this from the local Sidewinder console (not a remote Cobra interface). 1. Sidewinder Certificate Management: Create New Remote (Client) certificate window Select Services Configuration -> Certificate Management. Click New. 3-6 Configuring Sidewinder for Soft-PK Clients Managing Sidewinder self-signed certs 3. Specify the following Remote Certificate settings. Field Certificate Name Distinguished Name Setting Specify a name for the remote certificate. Specify a set of data that identifies the client. Use the following format: cn=, ou=, o=, l=, st=, c= where: cn = common name ou = organizational unit o = organization l = locality st = state c = country IMPORTANT: The syntax for this field is very important. The above entries must be separated by commas, and contain no spaces. In addition, the order of the specified distinguished name fields must match the desired order to be listed in the certificate. E-Mail Address, Domain Name, IP Address Submit to CA Signature Type Generated Private Key File Optional fields to identify information (in addition to DN). Select Self Signed. Click Browse and specify where you want to save the private key associated with this certificate. You must use a . pk1 extension (for example, "clientprivate. pk1"). IMPORTANT: The private key files must be created as . pk1 objects. The conversion utility used starting in Step 6 will not work with . pk8 objects. Generated Certificate File Click Browse and specify where you want to save this certificate. Use a . pem extension (for example, "clientcert. pem"). 4. Click Add to add the certificate to the Certificates list. Configuring Sidewinder for Soft-PK Clients 3-7 Managing Sidewinder self-signed certs 5. [. . . ] Sample text for specifying certificate instructions (if applicable) Deploying Soft-PK to Your End Users 5-5 Customizing the user worksheet Specifying security policy instructions Figure 5-5 shows the text in the initial UserWorksheet. doc file that pertains to the Soft-PK security policy. The default text covers a basic instructions for importing a security policy from a disk you provide. Change this text according to how you want users to set up the security policy. Figure 5-5. Sample text for importing the security policy Specifying basic connection information Figure 5-6 shows the text in the initial UserWorksheet. doc file that pertains to starting the VPN. [. . . ]