Tunnel client information Adding Tunnel Groups

115 is also copied. These files may be extracted onto a floppy disk or other writable media, and distributed to end users as needed.

7.3.4 Tools for Tunnel Management

Other than a handy configuration front end, the tunman application contains management and logging tools for those of you who dont get enough of this stuff with other network services. Figure 7-5 shows the main tunman window, with connected tunnels. From this GUI, you can keep tabs on existing connections, view a log of past and present tunnel connections, and view the status of the tunnel server, all at a glance. The interface is intuitive, and you should play with it at your leisure to find what information is useful to your network department. For the most part, the logs and such are particularly useful when troubleshooting connection problems, or when tracking attempted security breaches. Other than that, they could be used to prove to your manager that you are actually keeping logs of this stuff, or to liven up network operations meetings. Figure 7-5. Main tunman window

7.3.5 Changing Port Settings

The AltaVista Tunnel allows the system administrator to change the TCP port settings for tunnel communication. As noted earlier, the default port is 3265. If for some reason another port is required, the sysadmin must edit the Services file in the \drivers\etc directory of the servers system directory. Under Windows NT the path is: \system32\etc Use Notepad, or some text editor, to edit the Services file. Find the line below and change 3265 to the desired port: altav-tunnel 3265tcp After saving the file, restart the tunnel service.

7.3.6 Rekey Interval and Minimum Encryption Settings

The AltaVista Tunnel has a default setting of 30 minutes for the rekey interval. Thus, every 30 minutes, the encryption key used by two tunnel endpoints expires and a new one is generated and exchanged. This setting can be modified by editing the registry on Windows NT. 116 The Rekey Time registry entry is at: HKEY_LOCAL_MACHINE\SOFTWARE\DigitalEquipmentCorporation\AltaVista Tunnel\CurrentVersion This entry has a range of 30 to 1,440 minutes 24 hours. The minimum encryption applied to tunnel communication is dynamic, based on the highest level supported by both ends of the tunnel. The tunnel server may be able to support 128-bit encryption while the client may be limited to 40-bit. In this case, the tunnel would have 40-bit encryption applied to it. However, a base minimum can be set on the server via the Windows NT registry. Edit the Minimum Encryption DWORD value to the desired setting located at: HKEY_LOCAL_MACHINE\SOFTWARE\DigitalEquipmentCorporation\AltaVista Tunnel\CurrentVersion Note that connecting PCs may not be able to support whatever minimum setting you apply, thus disabling the tunnel for those PCs.

7.3.7 Configuring Unix-to-Windows NT Tunnel Connections

Tunnel connections between Unix and Windows NT are possible, but only with V.1.0 of the Unix Extranet server software. The Windows NT tunnel server must be the outbound side of the tunnel, meaning that the Windows NT server initiates the connection to the Unix server. Configuration on both ends is the same as on homogenous networks, with only a few exceptions. On the Digital Unix side, be sure to enable IP forwarding in startup files with this set of commands: iprsetup -s rcmgr set ROUTER yes On the Windows NT side, be sure that the tunnel is set as an outbound tunnel.

7.4 Configuring the AltaVista Telecommuter Client

Configuration of the Tunnel client is straightforward for all four platforms Windows 9598NT and MacOS, but make sure you have the following information from the administrator: Username This is the name of the tunnel group on the Tunnel server to which you have access privileges. This name is case-sensitive and must exactly match what the tunnel administrator has set up on the tunnel server. Server key ID The group name for the encryption key.