Rekey Interval and Minimum Encryption Settings

116 The Rekey Time registry entry is at: HKEY_LOCAL_MACHINE\SOFTWARE\DigitalEquipmentCorporation\AltaVista Tunnel\CurrentVersion This entry has a range of 30 to 1,440 minutes 24 hours. The minimum encryption applied to tunnel communication is dynamic, based on the highest level supported by both ends of the tunnel. The tunnel server may be able to support 128-bit encryption while the client may be limited to 40-bit. In this case, the tunnel would have 40-bit encryption applied to it. However, a base minimum can be set on the server via the Windows NT registry. Edit the Minimum Encryption DWORD value to the desired setting located at: HKEY_LOCAL_MACHINE\SOFTWARE\DigitalEquipmentCorporation\AltaVista Tunnel\CurrentVersion Note that connecting PCs may not be able to support whatever minimum setting you apply, thus disabling the tunnel for those PCs.

7.3.7 Configuring Unix-to-Windows NT Tunnel Connections

Tunnel connections between Unix and Windows NT are possible, but only with V.1.0 of the Unix Extranet server software. The Windows NT tunnel server must be the outbound side of the tunnel, meaning that the Windows NT server initiates the connection to the Unix server. Configuration on both ends is the same as on homogenous networks, with only a few exceptions. On the Digital Unix side, be sure to enable IP forwarding in startup files with this set of commands: iprsetup -s rcmgr set ROUTER yes On the Windows NT side, be sure that the tunnel is set as an outbound tunnel.

7.4 Configuring the AltaVista Telecommuter Client

Configuration of the Tunnel client is straightforward for all four platforms Windows 9598NT and MacOS, but make sure you have the following information from the administrator: Username This is the name of the tunnel group on the Tunnel server to which you have access privileges. This name is case-sensitive and must exactly match what the tunnel administrator has set up on the tunnel server. Server key ID The group name for the encryption key. 117 Tunnel server The IP address and tunnel port number. First Firewall Should there be an intervening firewall from your connection point to the Internet, the IP address and tunnel port number are required. Intervening firewalls that keep traffic from leaving the network are rare, but check with your Internet service provider or network administrator to be sure. Second Firewall The IP address and tunnel port number are needed to allow your tunnel traffic to pass through to the remote private network. The network administrator of the remote private network generally supplies this information. Key file The .eta encryption key file is generated and distributed by the network administrator on the remote private network. This file will allow access to the private network to anyone who obtains it and should be treated as extremely confidential information. Loss or theft of this file should be reported to the tunnel network administrator immediately. This information should be obtained for every tunnel network to which you have access. Once the information is available, you can configure and test your tunnel network client.

7.5 Troubleshooting Problems

Problems with network services, especially those related to the Internet, are sometimes difficult to pinpoint. The AltaVista Tunnel is no exception. In addition to the common Internet problems, such as throughput issues, Internet or transit provider network problems, and end user education, you must add encryption and verification issues, virtual address resolution, and a host of other specifics which must be exactly right for the tunnel to function. Of course, common sense troubleshooting is still the name of the game. When you encounter a problem connecting the tunnel, do not forget to check the client and server machines configuration and the Internet connection on both ends. Sometimes, as anyone whos solved a computer problem knows, its the simplest problems that are overlooked. Confirm that both ends have an Internet connection and that the tunnel client and server are running on the respective machines. Once youve determined that both ends have Internet connectivity, there are four main areas where a problem may reside: the tunnel server configuration, the tunnel client configuration, the local network, or the Internet gateway configuration on the tunnel servers network.

7.5.1 Tunnel Server and Client Configuration Checks

The tunnel server usually will experience the most problems, especially if this server is running other network services such as a mail server or web server. Should a client or group