Enterasys Networks CSX7000 Manuel d'utilisateur télécharger pdf (Page 177)

100

101

Central Site Remote Access Switch 177

ONFIGURING

YSTEM

PTIONS

AND

NFORMATION

System Options

The above process applies to the system’s authentication of the remote device. It is also possible that

the remote device may wish to authenticate the system itself, a desire that is also negotiated during

the LCP initialization of the link. Enabling CHAP via configuration also permits the system to agree

to be authenticated via CHAP during LCP negotiation. In the same manner that each remote device

has a name and secret, the system itself is configured with a system-wide name and secret that are

used to respond to CHAP challenges.

Note: When both CHAP and PAP are enabled, the system will request the CHAP protocol first.

If the remote device agrees to CHAP, then the secret that is configured for the device must

match the one that the remote device uses. If the remote device agrees to PAP then the

passwords must match. If only one of either PAP or CHAP is enabled, the system will insist

on that protocol only. If the remote device does not support the enabled protocol, the

device will not be allowed

RIDGE MAC ADDRESS SECURITY

If bridging is enabled, you have the option of enabling Bridge Ethernet Address Security. Bridge

MAC Address Security may also be enabled if IP routing through a Virtual WAN interface is

enabled. This security option allows you to configure specific Bridge Ethernet Addresses and an

optional password on a per device basis. When Bridge Ethernet Address security is enabled, the

System will look up the received Ethernet address in the Device List. If the address is not found,

the call is disconnected. If the address is found and the corresponding device entry is configured

with a password, the System will validate the password. If the password is not valid, the call will

be disconnected.

IP H

OST ID SECURITY

To enable IP Host Id Security, you must first enable IP routing. IP Host Id Security provides added

security through device validation. At connection establishment time, the Device sends an

unencrypted IP Host identifier over the WAN to the System. The System looks up the Device based

on the received IP Host identifier. If the identifier is found in the Device List, the call is accepted.

Otherwise the call is disconnected.

SYSTEM OPTIONS BACKGROUND INFORMATION

When a remote device connects, the CyberSWITCH negotiates the required authentication. In

order for the remote device to be properly authenticated, the CyberSWITCH must have the

appropriate authentication enabled. If the CyberSWITCH does not have the authentication

required by the remote device enabled, the remote device will not be authenticated and the call will

be disconnected.

The possible security options that can be enabled include:

• Calling Line Id

•IP Host Id

• Bridge Ethernet Address

•PAP

•CHAP

1 2 ... 172 173 174 175 176 177 178 179 180 181 182 ... 728 729

Commentaires sur ces manuels

Pas de commentaire

Enterasys Networks CSX7000 Manuel d'utilisateur Page 177

Commentaires sur ces manuels