Nortel 325 series User manual

Nortel Secure Network Access Switch

Using the Command Line

Interface

Release: 2.0

Document Revision: 03.01

www.nortel.com

NN47230-100 320818-D

Nortel Secure Network Access Switch

Release: 2.0

Publication: NN47230-100

Document status: Standard

Document release date: 28 July 2008

Sourced in Canada, the United States of America, and India

LEGAL NOTICE

While the information in this document is believed to be accurate and reliable, except as otherwise expressly

agreed to in writing NORTEL PROVIDES THIS DOCUMENT "AS IS "WITHOUT WARRANTY OR CONDITION OF

ANY KIND, EITHER EXPRESS OR IMPLIED. The information and/or products described in this document are

subject to change without notice.

Nortel, the Nortel logo, and the Globemark are trademarks of Nortel Networks.

All other trademarks are the property of their respective owners.

Contents

Software license 11

New in this release 15

Features 15

Other changes 16

Introduction 17

Before you begin 18

Text conventions 18

Related information 20

Publications 20

Online 21

How to get help 21

Overview 23

The Nortel SNAS 24

Elements of the Nortel SNAS 25

Supported users 25

Supporting additional users with the software license file 26

Role of the Nortel SNAS 27

Nortel SNAS clusters 35

Interface configuration 35

Nortel SNAS configuration and management tools 36

Nortel SNAS configuration roadmap 37

Initial setup 41

Before you begin 41

About the IP addresses 42

Initial setup 43

Setting up a single Nortel SNAS device or the first in a cluster 43

Adding a Nortel SNAS device to a cluster 50

Next steps 54

Applying and saving the configuration 55

Managing the network access devices 57

Before you begin 57

Nortel Secure Network Access Switch

Using the Command Line Interface

NN47230-100 03.01 Standard

28 July 2008

Managing network access devices 58

Roadmap of domain switch commands 58

Adding a network access devices 60

Deleting a network access devices 64

Configuring the network access devices 64

Mapping the VLANs 66

Managing SSH keys 68

Monitoring switch health 73

Controlling communication with the network access devices 74

Configuring SSCPLite 74

Configuring SNMP Profiles 75

Configuring SNMP Versions 76

Configuring SSCPLite Community 77

Configuring SNMP Templates 77

Configuring the domain 79

Roadmap of domain commands 81

Creating a domain 83

Deleting a domain 89

Configuring domain parameters 89

Configuring the Nortel Health Agent check 92

Configuring the SSL server 97

Configuring HTTP redirect 107

Browser-Based Management Configuration 108

Browser-Based Management Configuration with SSL 108

Configuring advanced settings 109

Configuring RADIUS accounting 110

Configuring local DHCP services 115

Creation of the location 123

Configuring Lumension PatchLink integration 124

Configuration of the RADIUS server 127

Overview of RADIUS server 127

802.1x functionality 127

Roadmap of RADIUS server configuration commands 128

Configuration of the RADIUS server 129

Configuration of the client 130

Configuration of the realms 131

Configuration of the dictionary 133

Configuration of the RADIUS accounting 134

Configuration of the RADIUS authentication methods 134

Configuration of the EAP authentication methods 136

Select the server certificate 137

Select the CA certificate 138

Nortel Secure Network Access Switch

Using the Command Line Interface

NN47230-100 03.01 Standard

28 July 2008

Configuration of Microsoft NAP Interoperability 139

Roadmap of NAP configuration commands 139

Configuration of NAP Interoperability 140

Probation Settings 141

Remote Network Policy Servers 142

System Health Validators 143

Configuration of Windows System Health Validator 144

Configuring groups and profiles 149

Overview 149

Groups 150

Linksets 151

SRS rule 151

Extended profiles 151

Before you begin 152

Configuring groups and extended profiles 153

Roadmap of group and profile commands 153

Configuring groups 156

Configuring client filters 162

Configuring extended profiles 164

Creating RADIUS attributes to a group 166

Mapping linksets to a group or profile 167

Creating a default group 169

Configuring authentication 171

Overview 171

Before you begin 172

Configuring authentication 174

Roadmap of authentication commands 174

Configuring authentication methods 177

Configuring advanced settings 179

Configuring RADIUS authentication 180

Configuring LDAP authentication 187

Configuring local database authentication 200

Specifying authentication fallback order 209

Managing system users and groups 211

User rights and group membership 211

Managing system users and groups 212

Roadmap of system user management commands 212

Managing user accounts and passwords 213

Managing user settings 216

Managing user groups 217

CLI configuration examples 218

Nortel Secure Network Access Switch

Using the Command Line Interface

NN47230-100 03.01 Standard

28 July 2008

Customizing the portal and user logon 227

Overview 227

Captive portal and Exclude List 228

Portal display 230

Managing the end user experience 237

Customizing the portal and logon 238

Roadmap of portal and logon configuration commands 238

Configuring the captive portal 240

Configuring the Exclude List 240

Changing the portal language 241

Configuring the portal display 244

Changing the portal colors 249

Configuring custom content 250

Configuring linksets 251

Configuring links 253

Configuring system settings 257

Configuring the cluster 257

Roadmap of system commands 258

Configuring system settings 262

Configuring the Nortel SNAS host 264

Configuring host interfaces 268

Configuring static routes 270

Configuring host ports 271

Managing interface ports 272

Configuring the Access List 273

Configuring date and time settings 274

Configuring DNS servers and settings 276

Configuring RSA servers 279

Configuring syslog servers 279

Configuring administrative settings 281

Enabling TunnelGuard SRS administration 284

Configuring Nortel SNAS host SSH keys 284

Configuring RADIUS auditing 286

Configuring authentication of system users 290

Configuration of auto blacklisting 293

Configuration of harden password 295

Managing certificates 297

Overview 297

Key and certificate formats 298

Creating certificates 299

Installing certificates and keys 299

Saving or exporting certificates and keys 300

Nortel Secure Network Access Switch

Using the Command Line Interface

NN47230-100 03.01 Standard

28 July 2008

Updating certificates 300

Managing private keys and certificates 301

Roadmap of certificate management commands 301

Managing and viewing certificates and keys 302

Generating and submitting a CSR 305

Adding a certificate to the Nortel SNAS 310

Adding a private key to the Nortel SNAS 312

Importing certificates and keys into the Nortel SNAS 314

Displaying or saving a certificate and key 316

Exporting a certificate and key from the Nortel SNAS 318

Generating a test certificate 320

Configuring SNMP 323

Configuring SNMP 324

Roadmap of SNMP commands 324

Configuring SNMP settings 325

Configuring the SNMP v2 MIB 326

Configuring the SNMP community 327

Configuring SNMPv3 users 328

Configuring SNMP notification targets 331

Configuring SNMP events 332

Viewing system information and performance statistics 337

Roadmap of information and statistics commands 337

Viewing system information 339

Viewing alarm events 344

Viewing log files 345

Viewing AAA statistics 346

Viewing all statistics 348

Kicking by username or address 349

Nortel SNAS TPS Interface 349

Maintaining and managing the system 351

Managing and maintaining the system 352

Roadmap of maintenance and boot commands 352

Performing maintenance 353

Backing up or restoring the configuration 356

Configuring the Nortel SNAS scheduler 359

Managing Nortel SNAS devices 361

Managing software for a Nortel SNAS device 363

Upgrading or reinstalling the software 367

Upgrading the Nortel SNAS 367

Performing minor and major release upgrades 368

Activating the software upgrade package 369

Nortel Secure Network Access Switch

Using the Command Line Interface

NN47230-100 03.01 Standard

28 July 2008

Reinstalling the software 372

Before you begin 372

Reinstalling the software from an external file server 373

Reinstalling the software from a CD 375

The Command Line Interface 377

Connecting to the Nortel SNAS 378

Establishing a console connection 378

Establishing a Telnet connection 379

Establishing a connection using SSH 380

Accessing the Nortel SNAS cluster 381

CLI Main Menu or Setup 383

Command line history and editing 383

Idle timeout 383

Configuration example 385

Scenario 385

Steps 387

Configure the network DNS server 388

Configure the network DHCP server 388

Configure the network core router 392

Configure the Ethernet Routing Switch 8300 393

Configure the Ethernet Routing Switch 5510 395

Configure the Nortel SNAS 397

Troubleshooting 403

Troubleshooting tips 403

Cannot connect to the Nortel SNAS using Telnet or SSH 403

Cannot add the Nortel SNAS to a cluster 405

Cannot contact the MIP 406

The Nortel SNAS stops responding 407

A user password is lost 408

A user fails to connect to the Nortel SNAS domain 409

Trace tools 409

System diagnostics 410

Installed certificates 410

Network diagnostics 410

Active alarms and the events log file 412

Error log files 412

Using the CLI 413

Global commands 414

Command line history and editing 416

CLI shortcuts 417

Using slashes and spaces in commands 419

IP address and network mask formats 420

Nortel Secure Network Access Switch

Using the Command Line Interface

NN47230-100 03.01 Standard

28 July 2008

Variables 420

CLI Main Menu 421

CLI command reference 422

Information menu 422

Statistics menu 423

Configuration menu 424

Boot menu 448

Maintenance menu 449

Syslog messages by message type 451

Operating system (OS) messages 452

System Control Process messages 453

Traffic Processing Subsystem messages 457

Start-up messages 461

AAA subsystem messages 461

NSNAS subsystem messages 463

Syslog messages in alphabetical order 465

Supported MIBs 477

Supported traps 481

485

Install All Administrative Tools (Windows 2000 Server) 485

Add the Active Directory Schema Snap-in (Windows 2000 Server and Windows

Server 2003) 486

Permit write operations to the schema (Windows 2000 Server) 488

Create a new attribute(Windows 2000 Server and Windows Server 2003) 489

Create the new class 489

Configuring IP Phone auto-configuration 494

Creating the DHCP options 494

Configuring the Call Server Information and VLAN Information options 497

Setting up the IP Phone 500

Configuring the logon script 501

Creating a logon script 502

Creating the script as a batch file 502

Creating the script as a VBScript file 503

Assigning the logon script 503

Nortel Secure Network Access Switch

Using the Command Line Interface

NN47230-100 03.01 Standard

28 July 2008

Nortel Secure Network Access Switch

Using the Command Line Interface

NN47230-100 03.01 Standard

28 July 2008

This manual suits for next models

Table of contents

Other Nortel Switch manuals

Nortel

Nortel Passport 7400 Manual

Nortel

Nortel 2500 Seriess Operator's manual

Nortel

Nortel 3510-24T Instruction Manual

Nortel

Nortel BayStack 470-24T User manual

Nortel

Nortel 2300 Series User manual

Nortel

Nortel 2526T User manual

Nortel

Nortel BayStack 5520-48T-PWR Reference guide

Nortel

Nortel 8300 Series Guide

Nortel

Nortel Passport 8250 User manual

Nortel

Nortel BayStack 450-12F User manual

Nortel

Nortel Passport 15000 Instruction Manual

Nortel

Nortel Passport 15000 Operating instructions

Nortel

Nortel Versalar 15000 User manual

Nortel

Nortel 5510 User manual

Nortel

Nortel BayStack 5520-24T-PWR User manual

Nortel

Nortel Passport 4400 Series Manual

Nortel

Nortel Ethernet Routing Switch 8600 User manual

Nortel

Nortel BayStack 450-24T Guide

Nortel

Nortel BayStack 60-12T Installation and operating manual

Nortel

Nortel 2250 Dimensions

Nortel

Nortel Centillion EtherSpeed II Guide

Nortel

Nortel Passport 5430 Wiring diagram

Nortel

Nortel Application Switch 2424-SSL Reference guide

Nortel

Nortel Passport 8003 User manual

Popular Switch manuals by other brands

URC

URC Total Control MFS-8 installation manual

Azbil

Azbil HPQ-D11 user manual

Sony

Sony DFS-900M operating instructions

SICK

SICK i17S operating instructions

F&F

F&F SZR-277 quick start guide

Shure

Shure UAMS/BK user guide

Dräger

Dräger X-zone Switch Off Instructions for use

Asco

Asco Joucomatic 349 Series manual

BT Mini Hub user guide

D-Link

D-Link DES-1226G manual

Johnson Controls

Johnson Controls FS80-C installation instructions

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Configuration guide

MicroNet

MicroNet SP1200A user manual

Ruijie

Ruijie RG-PF2920 Series Hardware installation and reference guide

Altinex

Altinex DA1914SX user guide

MiLAN

MiLAN MIL-SM2401M user guide

RJM

RJM MASTERMIND PBC/6X user manual

Atlas

Atlas MMK-KVM8 owner's manual