User manual ZYXEL ZYWALL 100

[. . . ] VPN Administration Guide Revision A SafeNet/Soft-PK Version 5. 1. 3 Build 4 Sidewinder Version 5. 1. 0. 02 Copyright Notice This document and the software described in it are copyrighted. Under the copyright laws, neither this document nor this software may be copied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior written authorization of Secure Computing Corporation. Made in the U. S. A. Trademarks Secure Computing, Sidewinder, Type Enforcement, and Strikeback are either registered trademarks or trademarks of Secure Computing Corporation. All other trademarks, tradenames, service marks, service names, product names, and images mentioned and/or used herein belong to their respective owners. Secure Computing Corporation Software License Agreement CAREFULLY READ THE FOLLOWING TERMS AND CONDITIONS BEFORE LOADING THE SOFTWARE. [. . . ] 7. Optional fields to identify information (in addition to DN). Select Self Signed. Select RSA. Click Add to add the certificate to the Certificates list. Click Export and save the firewall certificate (containing the public key) to a file. Click OK when done. Once you have finished creating the firewall certificate, you will typically copy it to an MS-formatted diskette for distribution to each remote Soft-PK client. For example: % mcopy -t filename a:filename Configuring Sidewinder for Soft-PK Clients 3-5 Managing Sidewinder self-signed certs Creating & exporting remote certificate(s) Use the following procedure on Sidewinder to create a self-signed certificate file (with its embedded public key) and a private key file for each of your Soft-PK clients. Once a pair of certificate/private key files are created for a unique client, you must use Sidewinder's pkcs12_util command to combine each file pair into a PKCS12formatted object. Each PKCS12-formatted object must be distributed to the respective Soft-PK client. From the Sidewinder Cobra interface: Note: Do this from the local Sidewinder console (not a remote Cobra interface). 1. Sidewinder Certificate Management: Create New Remote (Client) certificate window Select Services Configuration -> Certificate Management. Click New. 3-6 Configuring Sidewinder for Soft-PK Clients Managing Sidewinder self-signed certs 3. Specify the following Remote Certificate settings. Field Certificate Name Distinguished Name Setting Specify a name for the remote certificate. Use the following format: cn=, ou=, o=, l=, st=, c= where: cn = common name ou = organizational unit o = organization l = locality st = state c = country IMPORTANT: The syntax for this field is very important. In addition, the order of the specified distinguished name fields must match the desired order to be listed in the certificate. E-Mail Address, Domain Name, IP Address Submit to CA Signature Type Generated Private Key File Optional fields to identify information (in addition to DN). Select Self Signed. Click Browse and specify where you want to save the private key associated with this certificate. You must use a . pk1 extension (for example, "clientprivate. pk1"). IMPORTANT: The private key files must be created as . pk1 objects. The conversion utility used starting in Step 6 will not work with . pk8 objects. Generated Certificate File Click Browse and specify where you want to save this certificate. Use a . pem extension (for example, "clientcert. pem"). 4. Click Add to add the certificate to the Certificates list. Configuring Sidewinder for Soft-PK Clients 3-7 Managing Sidewinder self-signed certs 5. Converting the certificate file/private key file pair to pkcs12 format 6. Click Close to return to the previous window. To start the PKCS12 utility on the Sidewinder, from the command line, enter the following command: pkcs12_util The utility will prompt you for the name and location of the private key file, for the name and location of the associated certificate file, and for the name and location in which to store the resulting PKCS12-formatted object. The following message appears: Please put file extensions on all file names. Enter the name of the PKCS1 object (private key) file: 7. Type the full path name of the private key file. The following message appears: Enter the name of the PEM signed public key (certificate) file: 8. Type the full path name of the associated certificate file. The following message appears: Enter the name of the output PKCS12 object (*. p12): 9. Type the full path name of the object file that will be created by the utility. [. . . ] Change this text according to how you want users to set up digital certificates (or delete if not using certificates). Figure 5-4. Sample text for specifying certificate instructions (if applicable) Deploying Soft-PK to Your End Users 5-5 Customizing the user worksheet Specifying security policy instructions Figure 5-5 shows the text in the initial UserWorksheet. doc file that pertains to the Soft-PK security policy. The default text covers a basic instructions for importing a security policy from a disk you provide. Change this text according to how you want users to set up the security policy. Figure 5-5. [. . . ]