Understanding Novell BorderManager

Novell* BorderManager includes the following components:

Proxy Cache Services—Brings high-speed performance to your Web users while reducing bandwidth usage on your intranet.

Internet Security Services—Controls and monitors user access to Internet services and provides packet filtering. Multiple levels of access control are available, including host, application, and content control. Packet filtering enables you to control the packet traffic coming into your intranet.

Novell* IP Gateway—Provides Windows** Internetwork Packet Exchange* (IPX*) and IP clients with secure, controlled access to Internet destinations or services.

Virtual Private Network (VPN)—Ensures the privacy of business communications over the public network or within a private network. VPN servers exchange information over an encrypted tunnel, which keeps the information hidden from users on the public network.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Novell BorderManager Help Contents

Overview

Understanding Novell* BorderManager

Starting Up Novell BorderManager

A Few Words about Internet Security Policy

Enabling Novell BorderManager Components---Do This First

Setting Up Proxy Cache Services

Setting Up a Proxy Server

Setting Up an HTTP Accelerator

Configuring Cache Parameters

Configuring a Hierarchical Cache

Specifying Transport Parameters

Specifying DNS Parameters

Specifying a List of Noncacheable URL Patterns

Checking Proxy Cache Activity

Enabling Proxy Authentication

Setting Up the Novell IP Gateway for Internet Access

Configuring the Novell IP Gateway Server

Configuring Gateway Clients

Controlling Access to the Internet

Creating an Access Rule

Copying Access Rules between Objects

Changing an Access Rule

Deleting an Access Rule

Viewing All Rules That Apply to an Object

Checking the Access Control Log

Setting Up Packet Filters

Configuring Packet Filters

Viewing the Packet Filter Log

Managing a Virtual Private Network

Adding a Server to a VPN

Enabling Network Protocols on Your VPN

Setting Up a Static Route for Encrypted Traffic

Adjusting the VPN Server Response Timeout

Tuning Master-Slave Server Synchronization

Synchronizing VPN Servers

Removing a Server from a VPN

Checking VPN Activity

Checking the VPN Audit Log

Topical Reference

Understanding Proxy Cache Services

Understanding the Novell IP Gateways

Understanding Access Control

Understanding VPNs

Trademarks, Copyright, and Disclaimer


A Few Words About Internet Security Policy

The Novell* BorderManager documentation is not intended to be used as the sole basis for any corporate Internet security policy. Specifically, the recommendations made regarding access control and restriction of Internet services might differ from your corporate policy. The purpose of Novell BorderManager is to enable qualified network administrators to implement and maintain the elements of the Internet security policy adopted by the corporations they represent.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Enabling Novell BorderManager Components--Do This First

After you install the Novell* BorderManager software, you must enable the components you want to use.

Note: You cannot enable the Virtual Private Network (VPN) from NetWare* Administrator. You must first configure the VPN master and slave servers from the server console using the NIASCFG utility.

To enable Novell BorderManager components

1.	In the Novell Directory Services* (NDS*) tree, locate a server on which Border Services is installed.

2.	Double-click the server.

3.	Select the Novell BorderManager Setup page.

4.	Under Enabled Services, double-click the component you want to enable.

a.	Click the Enable check box to enable the component.

The server automatically loads the component’s NetWare Loadable Module* (NLM*) files when you close the Novell BorderManager Setup page.

b.	(Optional)  If you want to observe and record events for each component, set up event logging.

5.	Specify the server’s IP addresses.

These are the addresses you assigned to the server interfaces from the NIASCFG utility.

6.	Click OK to close the Novell BorderManager Setup page.

7.	If you plan to use Proxy Cache Services or the Novell IP Gateway, go to the server console and configure the DNS resolver.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Specifying Server IP Addresses

Before you configure any Novell* BorderManager components, you must specify the server’s private and public IP addresses. Any public address can also be multihomed.

Important: If your Internet Service Provider (ISP) connection is an unnumbered point-to-point link, you must do the following:

Use the NIASCFG utility to bind the IP address assigned by your ISP---or any other valid IP address---to one of the server’s private interfaces. When assigning the ISP WAN Call Destination to this binding, set the Source IP Address Mapping on LAN parameter to the assigned IP address. Make sure this is the first BIND IP command in the server’s AUTOEXEC.NCF file.

In Step 4 of the following procedure, set the Usage Type of this address to Both (that is, public and private).

Because this private address also serves as the server’s public source node address, inbound traffic can locate the server on the unnumbered link.

To specify the server IP addresses

1.	Under Configured IP Addresses, click the [image] button.

2.	Enter an IP address, then press Enter.

The system automatically provides a subnet mask according to the class of address you entered.

3.	To accept the subnet mask, press Enter; to change the mask, make your changes, then press Enter.

4.	Under Usage Type, indicate whether the address is public (Internet Service Provider [ISP]), private (intranet), or both.

Any public address can also be a multihomed address.

5.	Click OK to return to the Novell BorderManager Setup page.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Configuring the Novell IP Gateway Server

The Novell* IP Gateway server software comprises two circuit-level gateways: the IPX/IP gateway, which provides Windows** Internetwork Packet Exchange* (IPX*) clients with secure, controlled access to the Internet; and the IP/IP gateway, which provides the same service to Windows IP clients.

Important: If you plan to use the IP/IP gateway, you must install the NetWare/IP* server software on the server and the NetWare/IP client software on each gateway client.

To configure the Novell IP Gateway server

1.	Locate the gateway server in the Novell Directory Services* (NDS*) tree.

2.	Double-click the server.

3.	Select the Novell BorderManager Setup page.

4.	Under Enabled Services, double-click the gateway you want to configure.

a.	Click the Enable check box to enable the gateway.

When you close the Novell BorderManager Setup page, the server automatically loads IPXIPGW.NLM, the gateway NetWare Loadable Module* (NLM*) file, and creates a gateway server object in the NDS tree.

b.	(Optional)  If you want to observe and record gateway events, set up event logging for the gateway.

c.	(Optional)  If you want to assign a different port number for gateway traffic, change the gateway service port.

d.	Click OK to return to the Novell BorderManager Setup page.

5.	(Optional) If you use LANalyzer* for Windows on your intranet, configure the LANalyzer to decode IPX/IP gateway packet traces.

6.	Click OK to close the Novell BorderManager Setup page.

7.	If you have not done so already, go to the server console and configure the DNS resolver.

8.	Set up access control rules for gateway clients.

Note: If you upgraded your IntranetWare* 1 IPX/IP gateway server software, you configure access control from the Outgoing Rules page instead of the gateway object (SERVER_NAME-GW).

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Configuring Gateway Clients

The Novell* IP Gateway client software must be configured on each Windows** workstation that accesses the Internet through the gateway server. This task is typically the responsibility of the network administrator or the person responsible for desktop administration and support. In some cases, users configure their own gateway client software.

Important: The NetWare/IP* client software must be installed on gateway clients using the IP/IP gateway. IP clients use NetWare/IP to locate the gateway server.

You can configure the gateway client software in two ways:

From the client workstation: By launching the IP Gateway Switcher, selecting a gateway, and optionally specifying a preferred gateway server. Windows 3.1 clients use the switcher to specify the preferred gateway server; Windows 95** clients use the Network Control Panel.

From the administrator workstation: By configuring NOVWS.INI, the gateway client initialization file, and copying it to clients’ C:\WINDOWS directories.  The Gateway Switcher automatically configures this file for you.

For more detailed information about Novell IP Gateway client configuration, refer to the IntranetWare* Client* online help.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Configuring the DNS Resolver

As part of the gateway server and proxy cache configurations, you must provide a valid DNS domain name and the IP address of at least one DNS server. The server uses DNS to resolve IP hostnames on behalf of gateway and proxy clients.

To specify the DNS domain name and name server addresses

1.	Load NIASCFG, then select the following menu path:

Configure NIAS > Protocols and Routing > Protocols > TCP/IP > DNS Resolver Configuration

2.	Enter your corporate domain name.

Your Internet Service Provider (ISP) typically supplies this name. Domain names usually take the form novell.com or acme.org.

3.	Enter the IP addresses of up to three DNS servers in the Name Server fields.

ISPs often provide access to DNS servers for name resolution services.

4.	Press Esc to exit the DNS Resolver Configuration window.

5.	Save your changes, then exit NIASCFG.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Decoding Gateway Packet Traces

If you use LANalyzer* for Windows** on your intranet, you can decode IPX/IP gateway packet traces by adding TCP/IPX and UDP/IPX packet decodes to the LZFW.INI file.

To add gateway packet decodes to LZFW.INI

1.	Open the LZFW.INI file.

2.	Add the following lines under the NetWare IP section:

tcp(IPX)=TCP/IP,ipx,NetWare,0,0x9091,0x9091,0,0,0,0

udp(IPX)=TCP/IP,ipx,NetWare,0,0x9092,0x9092,0,0,0,0

3.	Restart the LANalyzer software.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Setting Up Event Logging

Event logging enables you to record and observe various events associated with specific Novell* BorderManager components. When you enable event logging, you also specify the log format.

Important: Event logging can slow access to both Internet services and locally cached information. You should not leave logging enabled for an extended period of time.

For the IPX/IP and IP/IP gateways, you can set the log level, which controls the amount and type of information logged. The log level enables you to log every event or only specific types of events, such as attempts to access Internet services.

To set up event logging

1.	Select a log format.

2.	For the log level, enter a number between 1 and 3, then press Enter.

To enable event logging for access control rules

1.	Select the Outgoing Rules page.

2.	Double-click a rule in the access control list.

3.	Click the Enable Rule Hit Logging check box.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Log Format

The type and format of logged information associated with Virtual Private Network (VPN) server activity or with outbound access through Proxy Cache Services or the Novell IP Gateway.

None---Event logging is disabled.

HTTPD Common Format---Proxy Cache Services only) Logs the following information: remote hostname, user’s remote logname, authenticated username, date, request line from client, status, and length of data in bytes. Example

Extended Format---Proxy Cache Services only) Logs the following information: cached status (0 or 1), date, time, client IP address, URL method, and URL. Example

Indexed Format---A Novell* audit-log format. The information it presents depends on the Novell BorderManager component from which information is being collected. For example, an access control log for the proxy cache contains the following information: when access was allowed or denied, the IP address that initiated the access attempt, the destination, the HTTP command (GET, for example), and the result of the attempt (“hit” or “miss”).

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Changing the Gateway Service Port

By default, the IPX/IP and IP/IP gateways use port 8225 (decimal) to transmit gateway traffic on the server. If another service is using this port, you can assign a different port number for gateway traffic.

To change the gateway service port

1.	In the Enabled Services box, double-click one of the gateway entries in the Service column.

2.	Enter the port number in the Port field, then click OK.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Creating an Access Rule

This topic explains how to create an access rule and add it to a Novell* BorderManager access control list. Access rules apply to Windows** NetWare* clients requesting Internet access through the Novell IP Gateway or Proxy Cache Services.

The default rule for all objects denies any object access to any service or destination (Deny <Any>). This rule is shown in gray in the Effective Rules dialog box.

To create an access rule

1.	Double-click a server in the Novell Directory Services* (NDS*) tree or select an object and right-click to display Details.

2.	Select the Outgoing Rules page.

3.	Click the [image] button.

4.	To deny access to a service or destination, click Deny; otherwise, accept Allow.

5.	To apply the rule to all NDS users, DNS hostnames, IP addresses, and subnets, accept Any and skip to Step 6; otherwise, select specific users, groups, or computers.

6.	To apply the rule to any service or destination, accept Any and skip to Step 7; otherwise, select specific destinations.

Important: If you create a rule that allows access to any destination whose hostname must be resolved by a DNS server, you must create another rule that allows the border server to resolve the hostname. Example

7.	(Optional) If you want the rule always to be in effect, accept None and skip to Step 8; otherwise, specify a time restriction for the rule.

8.	(Optional) If you want the server to record all access attempts that match the rule, click Enforce Rules.

9.	Click OK to update the access rules.

Important: Any access request received from the gateway or proxy while the access rules are being updated is denied. If the server must update access rules for a large number of users, all access requests might be denied for a few seconds.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Specifying a Source for an Access Rule

Complete the following steps to apply the rule to specific users, groups, or computers.

1.	Under Source, click Specified, then click the [image] button.

2.	Specify a Novell Directory Services* (NDS*) user or group; a DNS hostname; an IP address or range of addresses; or a subnet, including its subnet mask (255.255.252, for example).

Important: Any NDS users---or groups of users---to which you apply an access rule must be running the Novell* IP Gateway client software. You must also configure the Novell IP Gateway server for these clients.

3.	Click Add.

4.	To add additional sources, repeat Steps 2 and 3.

5.	Click OK.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Specifying a Destination for an Access Rule

Follow the procedures in this topic to apply the rule to specific users, groups, computers, or Web sites (URLs).

Important: You cannot combine individual URLs with Cyber Patrol** categories in the same access rule. To control source access to selected URLs and one or more Cyber Patrol categories, you must create one rule for the URLs and another for the Cyber Patrol categories.

To control access to a specific destination hostname, IP address, or subnet

1.	To control access to a specific protocol at a destination, such as FTP or SMTP, select one of the protocol types from the Protocol drop-down list; to apply the rule to any protocol at the destination, accept Any.

2.	Under Destination, click Specified, then click the [image] button.

3.	Specify a DNS hostname; an IP address or range of addresses; or a subnet, including its subnet mask (255.255.252, for example).

4.	Click Add.

5.	To add additional destinations, repeat Steps 3 and 4.

6.	Click OK.

To control access to specific Web sites

1.	Click URL, then click the [image] button.

2.	To enter single URLs, select Specify URLs.

3.	Click the [image] button.

4.	Enter the unqualified URL (www.novell.com, for example).

The protocol prefix http:// automatically precedes the URL you enter. To specify an FTP or a Gopher URL, replace http with ftp or gopher, respectively.

Hint: If you have a text file of URLs, you can copy the contents of the file to the clipboard and paste them (Ctrl-v) directly into the URL entry field.

5.	Click OK.

To control access to categories of Web sites (Cyber Patrol)

Note: Access rules using the Cyber Patrol URL categories can be specified only for servers---not for Organizations (Os) or Organizational Units (OUs).

1.	Click URL, then click the [image] button.

2.	Click Select from Microsystems CyberYES List or Select from Microsystems CyberNO List.

3.	Click the check box next to each URL category to which you want to control access.

4.	Click OK.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Specifying a Time Restriction for an Access Rule

Complete the following steps to specify a time restriction for the rule.

1.	Under Time Constraint, click Specified.

2.	In the Time Constraint grid, click and drag through the days and times you want the access rule to apply.

A highlighted (grayed-out) area means the access rule applies to the source only during that time.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Copying Access Rules Between Objects

After you create an access rule, you can apply the same rule to one or more access control lists without recreating it for each new object.

To copy an access rule from one object to another

1.	Double-click the object that contains the rule you want to copy.

2.	Select the Outgoing Rules page.

3.	Click the rule in the access control list.

4.	Click the [image] button.

5.	Close the Outgoing Rules page.

6.	Locate the object to which you want to apply the rule.

7.	Select the Outgoing Rules page.

8.	Click in the access control list, then click the [image] button.

Hint: Use the [image] and [image] buttons to move the rule in the access control list.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Changing an Access Rule

You can change any element of an access rule associated with a Novell Directory Services* (NDS*) object.

To change an access rule

1.	Double-click the object that contains the rule.

2.	Select the Outgoing Rules page.

3.	Double-click the rule in the access control list.

4.	Make the necessary changes.

5.	When you are done, click OK to update the access rules.

Important: Any access request received from the gateway or proxy while the access rules are being updated will be denied. If the server must update access rules for a large number of users, all access requests might be denied for a few seconds.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Deleting an Access Rule

You can delete any access rule associated with a Novell Directory Services* (NDS*) object.

To delete an access rule

1.	Double-click the object that contains the rule.

2.	Select the Outgoing Rules page.

3.	Click the rule in the access control list.

4.	Click the [image] button.

5.	When you are done, click OK to update the access rules.

Important: Any access request received from the gateway or proxy while the access rules are being updated will be denied. If the server must update access rules for a large number of users, all access requests might be denied for a few seconds.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Viewing All Rules That Apply to an Object

Because access rules can be applied to different object classes in a Novell Directory Services* (NDS*) tree, more than one rule can affect a single object. The effective rules of an object are all access rules, in order of execution, from the object to the root of the NDS tree.

To view an object’s effective rules

1.	Double-click the object in the NDS tree.

2.	Select the Outgoing Rules page.

3.	Click Effective Rules.

A new window displays all access rules in the order in which they are applied to the object.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Configuring Packet Filters

You configure packet filters from the server console using the following utilities:

NIASCFG---the routing and remote access configuration utility, to enable filtering for the specific network protocol, such as IPX or IP

FILTCFG---the filter configuration utility, to enable filter logging and configure specific packet filters

For instructions, refer to Novell BorderManager Installation and Setup.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Adding a Server to a VPN

Before you can add a server to a Virtual Private Network (VPN), you must use the NIASCFG utility to

Configure the master server

Configure the slave server

Generate encryption information files for the master and slave servers

If you are setting up a VPN for the first time, refer to Novell BorderManager Installation and Setup before you try to add a server to the VPN.

To add a slave server to a VPN

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	Click the [image] button.

4.	Locate the encryption information file (SINFO.VPN, for example) for the server you want to add, then click Open.

NetWare* Administrator reads the file and displays a 16-byte message digest.

5.	Contact the administrator of the slave VPN server and compare the value of your message digest with the one generated at the slave server console.

6.	If the digests are equal, click Yes; otherwise, click No.

Unequal digest values indicate that the data has been tampered with or corrupted.

7.	(Optional) Set up one or more static routes in addition to or instead of RIP routes.

8.	Click Status.

9.	Click Synchronize All, then click OK.

10.	Click  OK to close the VPN page.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Enabling Network Protocols on Your VPN

With Novell* BorderManager, you can selectively enable the network protocols---Internetwork Packet Exchange* (IPX*) and IP---that are encrypted and sent over the Virtual Private Network (VPN) tunnel. This capability offers the following advantages:

You can temporarily suspend IPX or IP traffic without bringing down the VPN.

You can choose to run only one protocol over the VPN, even if your intranet uses both. This capability also conserves server resources and network bandwidth on intranets that use only one network protocol.

Both protocols are tunneled by default.

To enable or disable protocol tunneling on your VPN

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	Click Control Options.

4.	Click the check box next to the network protocol.

A checked box indicates that the protocol will be encrypted and sent over the VPN tunnel.

5.	Click OK, then close the Virtual Private Network page.

Closing the Virtual Private Network page triggers a VPN synchronization.  If you plan to do additional work on the Virtual Private Network page, you can trigger a synchronization manually by clicking Status, then Synchronize All.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Setting Up a Static Route for Encrypted Traffic

For each server on a Virtual Private Network (VPN), you can specify one or more local IP network or host addresses as static routes. When you synchronize the VPN, this static route is added to the routing tables of the other VPN servers, which use the route to forward encrypted data to the server.

Using static routes between VPN servers is useful for the following reasons:

When you want your VPN servers to exchange encrypted data but no routing information. Because static routes reduce network traffic, they are typically used with on-demand connections between remote sites.

When you want to use your VPN for both site-to-site and site-to-Internet connections. In this case, using a static route prevents unencrypted traffic from reaching the Internet while the VPN is being established between remote sites.

You configure static routes for each VPN member by using the NetWare Administrator utility from the VPN master server.

Important: You must set up all static routes for VPN servers from NWADMN95, not the NIASCFG utility. Any static routes you set up from NIASCFG will be removed from the VPN server routing tables.

To specify a local private network or host address as a static route

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	Double-click a server in the VPN Members box.

4.	Click the [image] button.

5.	Enter the IP address and subnet mask of the network or host.

6.	Click OK until you return to the Virtual Private Network page.

7.	Click OK to close the Virtual Private Network page.

Closing the Virtual Private Network page triggers a VPN synchronization.  If you plan to do additional work on the Virtual Private Network page, you can trigger a synchronization manually by clicking Status, then Synchronize All.

During the synchronization, the static routes you specified are added to the routing tables of the other VPN members.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Adjusting the VPN Server Response Timeout

The response timeout determines how long one Virtual Private Network (VPN) server waits for a response from another before terminating the connection.

The response timeout can help you prevent a “denial of service” attack.

To adjust the response timeout for a VPN server

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	Double-click one of the servers in the VPN Members box.

4.	Enter the response timeout.

5.	Click OK, then close the Virtual Private Network page.

Closing the Virtual Private Network page triggers a VPN synchronization.  If you plan to do additional work on the Virtual Private Network page, you can trigger a synchronization manually by clicking Status, then Synchronize All.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Tuning Master-Slave Server Synchronization

On a Virtual Private Network (VPN), the master server communicates periodically with the slave servers to ensure that they maintain the same “view” of the VPN and use the newest public encryption keys. For this purpose, you can customize the Update Interval, Connect Timeout, and Response Timeout parameters.

Tuning these parameters represents a balance between quick convergence of the VPN and traffic/CPU overhead.

To tune master-slave server synchronization

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	Click Control Options.

4.	Enter the update interval and timeout values.

5.	Click OK, then close the Virtual Private Network page.

Closing the Virtual Private Network page triggers a VPN synchronization.  If you plan to do additional work on the Virtual Private Network page, you can trigger a synchronization manually by clicking Status, then Synchronize All.

 Related Topics

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Synchronizing VPN Servers

When you synchronize servers on a Virtual Private Network (VPN), the master VPN server updates all VPN slave servers with the current VPN topology and encryption keys. A server’s synchronization status can assume one of the following states:

Up-to-Date

The server has the newest topology and encryption information.

Being Configured

The server still needs to receive the newest topology and encryption information from the master server.

Being Removed

The server is being removed from the VPN.

Note: Any server state that remains at Being Configured or Being Removed for an extended period of time indicates a problem with the VPN.

To synchronize server members of a VPN

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	Click Status.

The Synchronization Status window displays each member of the VPN, its public IP address, and its update status.

4.	To synchronize all servers on the VPN, click Synchronize All.

5.	To synchronize only one server, highlight it and click Synchronize Selected.

6.	Click OK, then close the Virtual Private Network page.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Removing a Server from a VPN

When you remove a slave server from a Virtual Private Network (VPN), the master server distributes an updated VPN members list to the remaining slave servers. The master server also sends a request to the removed server to detach itself from the VPN.

Note: You cannot remove the master server.

To remove a slave server from a VPN

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	In the VPN Members list, click the slave server you want to remove.

4.	Click the [image] button.

5.	Click Status.

6.	Click Synchronize All, then click OK.

7.	Click OK to close the Virtual Private Network page.

Closing the Virtual Private Network page triggers a VPN synchronization.  If you plan to do additional work on the Virtual Private Network page, you can trigger a synchronization manually by clicking Status, then Synchronize All.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Understanding the Novell Circuit-Level Gateways

The Novell* IP Gateway server software contains two circuit-level gateways:

The IPX/IP gateway, which provides Windows** Internetwork Packet Exchange* (IPX*) clients using IntranetWare Client for IPX with secure, controlled access to Internet destinations or services.

The IP/IP gateway, which provides the same service to Windows IP clients using IntranetWare Client and NetWare* IP*.

You can enable each gateway independently. Which gateway you use depends on whether your corporate intranet supports IPX clients, IP clients, or both. How you use the gateways depends on the specific requirements of your corporate Internet security policy.

You can also change the gateway service port, monitor gateway usage, examine the gateway server log, and gather statistics related to gateway usage over a specific period of time.

Specifying DNS Servers

As part of the gateway server configuration, you must provide a valid Domain Name System (DNS) domain name and IP address of at least one DNS server. The gateway server uses DNS to resolve IP hostnames on behalf of gateway clients on your corporate intranet.

Configuring the IPX/IP and IP/IP Gateways

The IPX/IP gateway and IP/IP gateway allow IPX and IP clients on your local network to access the Internet (or other TCP/IP services) without requiring you to assign globally unique IP addresses to all of your local systems. The gateways also allow you to hide the IP addresses of your local network from the Internet and implement access control for your local clients.

Preferred Gateway Server

If you have multiple gateways installed on your network, you can configure a preferred gateway server.  The gateway task (which maintains the control connection between the client and gateway server) will attempts to attach to the preferred gateway server if one is configured.  If the specified gateway server is not available, the gateway client searches for other gateway servers using the following logic:

1.	Starting with the current Novell Directory Services* (NDS*) context, search downwards in the tree for an IPX/IP gateway server object.

2.	Search the bindery of the attached file server.

3.	Query the nearest gateway server for Service Advertising Protocol (SAP).

The name of a preferred gateway server is the NetWare* server name plus the suffix -GW. For example, if a NetWare server is named NW-SVR-6, the gateway server is named NW-SVR-6-GW. You use the Windows Switcher utility to configure the name of the preferred gateway server and switch the client between TCP/IP and TCP/IPX. You start the Switcher utility like any other NetWare Tools utility. From the Switcher’s preferred gateway server configuration dialog box, you can enable each Novell gateway, allow IPX clients to access the Internet (IPX-to-IP), or allow IP clients to access the Internet (IP-to-IP). You can use the same preferred server for both gateways. In both cases, enter the full, distinguished name of the preferred gateway server (for example, .nw-svr-6-gw.novell or .CN=xxx.OU=xxx.O=xxx).

Access Control

When you use the Novell gateways, all TCP traffic is funneled through one or more gateway servers. Novell gateway servers have complete control over user access to the Internet resources. Access information is stored in NDS and can be configured only by the network administrator (or equivalent) using the Novell NetWare Administrator utility at the client workstation. You can restrict access by TCP port (Web, FTP, Telnet, and so on) or by IP host address. You can also limit access to certain ports and IP addresses to a specific time of day. Note that access control restricts access to TCP/IP networks, not to the Novell gateway server.

You can specify the access control information stored in NDS for different objects: Servers, Organizations, Organizational Units, Groups, and Users.  You can exploit the existing NDS tree hierarchy by allowing users to inherit access rights from parent container objects and from existing groups. Access control specified for a container affects all users in its subtree; access control specified for a group affects all objects within that group.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Understanding Access Control

Access control is the process by which user access to Internet services is regulated and monitored. Specifically, the Novell* BorderManager access control software allows or denies access requests made through the Novell IP Gateway or Proxy Cache Services.

The primary elements of access control are the access rule and the control list. Access to Internet services or destinations is controlled through the application of one or more access rules. One or more access rules defined for a particular object form the control list. Each time a gateway or proxy user initiates a request to access a particular Internet service or destination, the server checks the control list to determine whether it can allow the request.

For a server, the control list is the linking together of access rules from the server object, from the container holding the server object up to the root of the Novell Directory Services* (NDS*) tree. Rules defined at the server object are at the beginning of the list; rules defined at the root are at the end. For a user, the control list is the collection of access rules from the user object, from all group objects to which the user belongs, from the container holding the user object, up to the root. This ordered collection of access rules represents the object's effective rights.

At first, the access control lists for all objects are empty. However, an implicit access rule denies access from any user to any destination. This means that no traffic flows through the border server until you create rules to explicitly allow it.

Access Rules

You can create access rules for any of the following NDS objects:

Servers

Organizational Units (OU)

Organizations (O)

If your intranet has TCP/IP clients, you can create access rules for DNS hostnames, IP addresses, and IP subnets. You can also restrict access to certain times of day and log access requests for a service or destination.

Access Rule Elements

An access rule comprises the following elements:

Source

Destination

Access Type

Time Constraint

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Understanding VPNs

A Virtual Private Network (VPN) is used to transfer sensitive company information across the Internet in a secure fashion by encapsulating and encrypting the data.  A VPN uses the public Internet to transport sensitive data between two or more sites within a company or between two or more companies that have connectivity through the Internet.  A VPN can also be deployed in intranets where data security is required between departments that are using the company’s intranet.

You can deploy a VPN in one of three ways:

At the intranet/Internet border

Behind a high-end router at the border

Somewhere in the private cloud (in the Finance department, for example).

Routing on a VPN

By default, Novell* BorderManager has RIP enabled for routing IP packets (dynamic routing).  With RIP, local private networks of VPN members are automatically known to other VPN members through the encrypted tunnel.

With static routing, instead of using RIP for learning the private networks through the encrypted tunnel, you can define static routes using the NetWare Administrator utility. You can specify one or more local IP network or host addresses as static routes.  The routes are used by VPN servers to forward encrypted data to the destination VPN server.  This reduces network traffic.

Use static routes when you do not want VPN servers to exchange routing information.  Also use static routes when you are using VPN for site-to-site and site-to-Internet connections to prevent unencrypted information from reaching the Internet.

For IPX, routing is handled by the server’s default routing mechanism:  either NLSP or RIP/SAP, as specified in NIASCFG.

VPN Topology

You can configure the VPN to support full mesh, star, and ring connectivity between VPN members.  The topology you select determines how calls are made, how connections are established, and the flow of routing traffic.  Connections in any of these topologies can be one-sided (always initiated from one server) or both-sided (initiated from either server).

Mesh---This is the default topology.  All servers are interconnected to form a web or mesh, with only one hop to any VPN member.  There is communication between every member in the VPN, whether required or not.  This topology is the most fault-tolerant.

Star---The master server is the hub of this topology, with all communications radiating outward to other servers and returning to the master server.  This is the least traffic-intensive topology, but the master is the single point of failure.

Ring---In this topology, each member communicates with its immediate neighbors. The ring loops from the master server to subsequent slave servers and back to the master server.

Encryption and Key Management

Novell BorderManager VPN uses encryption to keep data hidden and secure.  You can specify how many packets pass through an encrypted tunnel before the encryption key changes.

Server Synchronization and Control

You can set control parameters for your VPN.  You can specify whether IP, IPX, or both are encrypted; VPN network topology; and whether a connection between two VPN servers is initiated by one or either server.

When you synchronize a VPN, the master server updates all slave servers with the most recent topology and encryption keys.  You can specify the interval between updates to ensure that any changes are propagated as quickly as possible.

VPN Packet Filters

When you set up VPN servers, the NIASCFG utility automatically configures packet (RIP) filters that prevent the propagation of VPN server addresses.  Two VPN packet filters are automatically configured:

Outgoing RIP filter that denies the VPN IP address destined to all interfaces.

Because the VPN IP is probably an unregistered address, it should not be propagated on the Internet. The VPN IP address should also not be propagated on the Internet even if it is registered. Only the VPN members can know about this IP address, not the Internet community. This IP address should be secure to only the VPN members. It is important to note that when you define this filter you specify an entry for the IP address and its natural mask (network mask). If you specify a subnet mask, you enter two filters:  one for the natural mask of the specified IP address and one for the specified subnet mask.

Outgoing RIP filter that denies the public IP address destined to VP Tunnel interfaces.

This filter prevents the public IP address from being propagated through the VP Tunnel interface. Without this filter, a routing loop would occur and the system would experience connectivity issues.  When you define this filter, you specify an entry for the IP address and its natural mask (network mask). If you specify a subnet mask, you enter two filters:  one for the natural mask of the specified IP address and one for the specified subnet mask.

These filters are configured when you enter the public IP address and the VPN tunnel address. If you delete these filters from FILTCFG, you can automatically recreate them using the Update VPN Filter option in NIASCFG.

 Related Topics

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Novell BorderManager Setup

Use this page to enable the Novell* BorderManager components you want to use on your intranet.

Note: You cannot enable the Virtual Private Network (VPN) from NetWare* Administrator. You must do this from the server console using the NIASCFG utility.

From this page, you can:

Enable selected Novell BorderManager components

Set up event logging

Enable and configure the Novell* IP Gateway

You can also enable or disable all access control rules on the server by toggling the Enforce Rules check box. Access rules are enabled by default.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Configure IP Address

Use this dialog box to configure the border server’s public and private IP addresses.

Parameter Descriptions

IP Address

A four-byte number that uniquely identifies the server on an IP network. An example of an IP address is 10.90.120.107.

Subnet Mask

An example of a subnet mask is 255.255.255.0.

Usage Type

How the server uses the IP address. The address can be public (ISP), private (LAN), or both.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Outgoing Rules

Use this page to view or create access rules for a particular object in your Novell Directory Services* (NDS*) tree. As a network administrator, you create access rules that implement and enforce the specific elements of your corporate Internet security policy. One or more access rules defined for a particular object form the object’s access control list.

The starting default for a new rule is to deny any user access to any service. Access that is not explicitly allowed is denied.

Parameters and Buttons

Action

Whether to allow or deny the service.

Source

The user---or collection of users---on your private network. The source can be one or more NDS users or groups, DNS hostnames, IP addresses (or a range of addresses), or IP subnets. If you apply a rule to a subnet, the rule applies to all hosts on that subnet. The source can also be <Any>, which applies the rule to all users.

Access to Target

The destination or service within your private network or on the Internet. You can selectively control access to protocols, such as FTP or NNTP; URLs, such as http://www.novell.com/; DNS hostnames; IP addresses (or a range of addresses); or IP subnets.

Time

Whether a time restriction is in effect for a rule.

Log

Whether access logging is active for a rule.

Rule Number

A unique numeric ID that is automatically assigned to an access rule. When an access attempt by a gateway or proxy user matches a rule in the access control list, the number corresponding to that rule is recorded in the access control log. When you check the access control log, you use this number to identify the rule.

Effective Rules

Enables you to view all rules that apply to an object by clicking Effective Rules. The effective rules are all access rules, in order of execution, from the object to the root of the NDS tree.

Update Server

Prompts the server to update its access control list with changes that were made at the Organization (O) or Organizational Unit (OU) object to which the server belongs.

 Related Topics

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Rule Definition

Use this page to create a new access rule or to change the elements of an existing rule.

Parameter Descriptions

Action

The action of the rule, which is to allow or deny access.

Source

The user---or collection of users---on your private network. The source can be one or more Novell Directory Service* (NDS*) users or groups, DNS hostnames, IP addresses (or a range of addresses), or IP subnets. If you apply a rule to a subnet, the rule applies to all hosts on that subnet. The source can also be <Any>, which applies the rule to all users.

Access Specification

The destination or service that is allowed or denied. You can control access to any destination, protocol, or URL within your private network or on the Internet.

Important: If you create a rule that allows access to any destination whose hostname must be resolved by a DNS server, you must create another rule that allows the border server to resolve the hostname. Example

Destination---DNS hostnames, IP addresses, or subnet addresses.

When you specify a destination, you must also specify the protocol at that destination.

Protocol---The Internet protocol accessed at the destination. For example, you can control access to FTP (file transfers), Telnet (remote logins), SMTP (Internet e-mail), Finger (user account names and other sensitive information), HTTP (Web sites), POP3 (dial-up e-mail---a widely used alternative to SMTP), NNTP (Network News), or Printer (lpr)---that is, network printer access. You can also select <Any>, which allows---or denies---all TCP/IP access to a destination.

URL---A destination Web site or category of Web sites. You can add specific URLs to the control list or select URLs by Cyber Patrol** category. For example, if you allow access to a single URL, such as www.novell.com, you allow access to the entire Web site.

Time Constraint

A grid that enables you to control time-of-access to particular destinations. Click and drag through the grid; an access rule with a time constraint applies to a source only during the time that it is highlighted (gray).

Enable Rule Hit Logging

A check box that you click to log access attempts associated with the rule. When you check the access control log, you can identify which users are trying to access the destinations and services specified in the access control list.

 Related Topics

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Effective Rules

Use this page to view the effective rules that apply to a Novell Directory Services* (NDS*) object. The effective rules are all access rules, in order of execution, from the object to the root of the NDS tree. Rules are listed in the order in which they are applied to the object.

The default Deny <Any> <Any> rule is shown in gray at the end of the list.

Parameter Descriptions

Action

Whether the service is allowed or denied.

Source

The object to which the rule applies. This column appears only for server objects.

Access to Target

The Internet service that is allowed or denied.

Rule Location

Where the rule is defined. The location is provided as a typeless NDS name (for example, SF-SERVER.ACME_INC).

Time

Whether a time restriction is in effect for the rule.

Log

Whether access logging is active for the rule.

Rule Number

A unique numeric ID that is automatically assigned to an access rule. When an access attempt by a gateway or proxy user matches a rule in the access control list, the number corresponding to that rule is recorded in the access control log. When you check the access control log, you use this number to identify the rule.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Source Specification

Use this page to specify the Novell Directory Services* (NDS*) users or groups, DNS hostnames, IP addresses, or subnet addresses to which you want to apply an access rule. Select a source type, enter the source in the designated field, then click Add.

You can also delete sources from this page. Click the entry in the Source List box, then click Delete.

The access rules you create or change take effect after you close the Outgoing Rules page.

Groupbox Descriptions

Source Type

The type of source to which the rule applies:

NDS User or Group---The name of a user or group in the NDS tree.

Click [image] to add NDS users or groups to the source list. The Select Object dialog box displays the users and groups in the current NDS context. Select one or more users or groups from any context in the NDS tree.

Important: Any NDS users---or groups of users---to which you apply an access rule must be running the Novell* IP Gateway client software. You must also configure the Novell IP Gateway server for these clients.

DNS Hostname---The name of a computer in the TCP/IP (Internet) environment. The hostname corresponds to an IP address. An example of a hostname is myhost.novell.com.

Enter one or more DNS hostnames. Click Add to add each hostname to the source list.

Host IP Addresses---A four-byte number that uniquely identifies a computer on an IP network. An example of an IP address is 10.90.120.107.

Enter one or more IP addresses in the Starting Address field. Click Add to add each address to the source list. You can also specify a range of addresses by entering the starting address and ending address.

Subnet Addresses---The number that identifies a network that is part of a larger network. An example of a subnet address is 10.90.120.0.

Enter one or more subnet addresses and their subnet masks (255.255.255.0, for example). Click Add to add each address/subnet pair to the source list.

Source Details

The fields in which you enter the NDS users or groups, DNS hostnames, IP addresses, or subnet addresses and masks.

Source List

The list of destinations to which the access rule applies.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Destination Specification

Use this page to specify the DNS hostnames, IP addresses, or subnet addresses to which you want to apply an access rule. Select a destination type, enter the destination in the designated field, then click Add. If you have a text file of DNS hostnames, you can copy the contents of the file to the clipboard and paste them (Ctrl-v) directly into the Destination Details entry field.

Important: When you specify a destination, you must also designate the protocol by which the destination is accessed. You do this from the Rule Definition page.

You can also delete destinations from this page. Click the entry in the Destination List box, then click Delete.

The access rules you create or change take effect after you close the Outgoing Rules page.

Groupbox Descriptions

Destination Type

The type of destination to which the rule applies:

DNS Hostname---The name of a computer in the TCP/IP (Internet) environment. The hostname corresponds to an IP address. An example of a hostname is myhost.novell.com.

Enter one or more DNS hostnames. Click Add to add each hostname to the destination list.

Host IP Addresses---A four-byte number that uniquely identifies a computer on an IP network. An example of an IP address is 10.90.120.107.

Enter one or more IP addresses in the Starting Address field. Click Add to add each address to the destination list. You can also specify a range of addresses by entering the starting address and ending address.

Subnet Addresses---The number that identifies a network that is part of a larger network. An example of a subnet address is 10.90.120.0.

Enter one or more subnet addresses and their subnet masks (255.255.255.0, for example). Click Add to add each address/subnet pair to the destination list.

Destination Details

The fields in which you enter the DNS hostnames, IP addresses, or subnet addresses and masks.

Destination List

The list of destinations to which the access rule applies.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


URL Specification

Use this page to specify destination URLs to which you want to control access. You can either add specific URLs to the control list or select URLs by Cyber Patrol** category. The Cyber Patrol categories are divided into two lists:

CyberYES, which includes URL categories such as Games & Toys, and Vacation & Travel

CyberNO, which includes URL categories such as Violence/Profanity, and Racist/Ethnic Impropriety

These lists only appear in the URL specification list if the Cyber Patrol files are installed on the server.

Important: You cannot combine individual URLs with Cyber Patrol categories in the same access rule. To control source access to selected URLs and one or more Cyber Patrol category, you must create one rule for the URLs and another for the Cyber Patrol categories.

To enter your own URLs

1.	Select Specify URLs.

2.	Click the [image] button, then enter the unqualified URL (www.novell.com, for example).

The protocol prefix http:// automatically precedes the URL you enter. To specify an FTP or a Gopher URL, replace http with ftp or gopher, respectively.

Hint: If you have a text file of URLs, you can copy the contents of the file to the clipboard and paste them (Ctrl-v) directly into the URL entry field.

3.	To delete a URL, click on the URL in the Specify URLs list, then click the [image] button.

4.	Click OK.

To specify URLs by Cyber Patrol category

1.	Click Select from Microsystems** CyberYES List or Select from Microsystems CyberNO List.

2.	Click the check box next to each category to which you want to allow or deny access.

3.	Click OK.

The access rule takes effect after you close the Outgoing Rules page.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Virtual Private Network Attributes

Use this dialog box to enable logging for the Virtual Private Network (VPN).

Parameter Descriptions

Enable

When checked, indicates that the VPN is enabled.

Note: Because you cannot enable the VPN from NetWare* Administrator, this parameter is always grayed out. To enable the VPN, you must first configure the master and slave servers from the server console using the NIASCFG utility.

Access Log

When checked, enables VPN logging. The information logged provides a “real-time” record of activity between VPN servers.

To see the VPN audit log, complete the following steps:

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	Click Status.

4.	Click on a VPN server, then click Audit Log.

Note:  You can also use the Novell* BorderManager Monitor to view the VPN audit log.

Log Level

For the VPN, only audit-log messages are logged; therefore, this parameter is grayed out.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


VPN Main Window: Master Server

Use this page to manage the servers on your corporate Virtual Private Network (VPN). From this page you can add or remove servers, check or update the synchronization status of your VPN servers, tune the master-server synchronization parameters, and define a static route for each server.

The VPN Members box displays the name and public IP address of each VPN server.

 Related Topics


VPN Main Window: Slave Server

The server you selected is a slave member of a Virtual Private Network (VPN).

To view or update the network topology for this slave server, you must do so from the master VPN server. The master server ensures that all members maintain the same view of the VPN topology and use the most up-to-date encryption information.

 Related Topics


Synchronization Status

Use this dialog box to synchronize the VPN or to check the synchronization status of your Virtual Private Network (VPN) servers.

When you synchronize a VPN, the master VPN server updates all VPN slave servers with the current VPN topology and encryption keys. A server’s synchronization status can assume one of the following states:

Up-to-Date

The last server update with the newest topology and encryption information completed successfully.  The information may not have been synchronized yet.

Being Configured

The server still needs to receive the newest topology and encryption information from the master server.

Being Removed

The server is being removed from the VPN.

Note: Any server state that remains at Being Configured or Being Removed for an extended period of time indicates a problem with the VPN.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Audit Log Information

Use this dialog box to view audit log messages generated by a Virtual Private Network (VPN) server. You can also view a detailed explanation of any message.

Groupbox and Parameter Descriptions

Selection Type

Allow you to choose which audit log message types to display.

Audit Log Enable

Allows you to enable or disable the VPN audit log feature of the selected VPN member.

If the check box is not selected, the VPN member stops saving all VPN error and informational messages to the audit log database. This control feature takes effect only when you click Acquire.

Audit Log Start /Audit Log End

Specify a range of audit log messages to view based on date and time. The Audit Log End control specifies the most recent VPN messages saved.  The Audit Log Start control specifies the earliest VPN messages saved in the audit log database. Use the Valid Audit Log Range group box to set the current range of the VPN audit log messages for the selected VPN member. Use the Up-arrow and Down-arrow to change the date and time for both controls.

Audit Log Progress

Indicates the current progress of the audit log retrieval according to the defined settings.

Audit Log Messages

Displays the audit log messages for each VPN member.

Each message includes a time stamp indicating when the message was generated and the message type. There are two types of audit log messages: VPN Control and VPN Tunnel. VPN Control messages correspond to the VPN autoconfiguration process. VPN Tunnel messages correspond to the encryption tunnels established between each VPN member. Each audit log type is also categorized as either an error message or an informational message. The following icons identify the type of message being displayed:

Indicates an informational message for VPN Tunnel.

Indicates an informational message for VPN Control.

Indicates an error message for VPN Tunnel.

Indicates an error message for VPN Control.

To view the audit log for the selected VPN member

Click Acquire.

This displays the latest audit log messages in the database. Only 10 messages are displayed at a time in the list box, with the most current (latest time stamp) message displayed first. Use the scroll bar or PageDown key to view earlier messages. By default, the latest 100 messages in audit log database are acquired at a time.

To acquire the next set of audit log messages for the selected VPN member

Click More.

This displays the next 100 messages in the database. Only 10 messages are displayed at a time in the list box.  Use the scroll bar or PageDown key to view additional messages. The More button is grayed out if there are no more audit log messages in the database. The More button does not reflect the current screen settings; click Acquire to update and display any changes made to the audit log controls.

To change the number of message entries to acquire at any one time

Click the Up-arrow or Down-arrow in the Phase Entries control box.

The new Phase Entries value is the number of audit log messages acquired the next time you click Acquire.

To view additional information on a particular message

1.	Click either the message icon or date of the message.

2.	Click Details.

Note: You can also double-click the message icon or date to display this information.

An explanation of the message is displayed and any action necessary to resolve the problem.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


VPN Activity

Use this dialog box to view “real-time” Virtual Private Network (VPN) activity.

Groupbox and Parameter Descriptions

VPN Tunnel Monitor

The VPN monitor displays the "real-time" activity of the currently selected VPN member and all associated VPN tunnel connections for either protocol (IPX or IP). The activity arrows are defined as follows:

The encryption tunnel is currently active between the selected VPN member and the associated connection. This arrow indicates that packets have been sent or received within the last 30 to 60 seconds.

The encryption tunnel is currently pending between the selected VPN member and the associated connection. This arrow indicates that packets have been sent and received at one time, but not in the last 30 to 60 seconds.

The encryption tunnel is currently down between the selected VPN member and the associated connection. This arrow indicates that packets have not been received across this encryption tunnel. Check the Audit Log for both VPN members to determine why this encryption tunnel is down.

To view the activity between the selected VPN member and a particular associated connection

Click on the associated VPN member name from the VPN Tunnel Monitor list.

The IPX Associated Connection Details and the IP Associated Connection Details windows are updated to reflect the VPN tunnel activity information with this VPN member.

VPN Tunnel Global Details

This window shows the global VPN connection information for the selected VPN member.

Tunnel Status

Displays if the VPN tunnel is currently loaded or unloaded.

Tunnel Version

Displays the current version of the VPN tunnel.

Time Active

Displays how long the VPN tunnel has been active.

Packets Per Key Change

Displays the number of packets sent or received that will change the data encryption key.

IPX Packets Received

Displays the total number of encrypted IPX packets received from all VPN members.

IPX Packets Sent

Displays the total number of encrypted IPX packets sent to all VPN members.

IP Packets Received

Displays the total number of encrypted IP packets received from all VPN members.

IP Packets Sent

Displays the total number of encrypted IP packets sent to all VPN members.

Total Packets Received

Displays the total number of IPX and IP packets received from all VPN members.

Total Packets Sent

Displays the total number of IPX and IP packets sent to all VPN members.

Total Packets Discarded

Displays the total number of discarded IPX and IP packets.

Total Key Changes

Displays the total number of times the data encryption key was changed.

IPX Associated Connection Details

Provides the connection information between the selected VPN member and associated VPN member in respect to the IPX tunnel connection.

Associated Connection

Displays the associated VPN member’s server name.

Associated Address

Displays the associated VPN member’s IP address. This is the configured public IP address.

Connection State

Displays the current connection state with this associated VPN member. The connection states are defined as follows:

Established---The connection has been established and packets have been sent and received.

Pending---A call has been made, but no packets have been received from that member.

Unattached---The connection has not been made and no packets have been sent or received.

Connection ID

Displays the connection ID for the associated VPN member. This is an integer value generated at connection time that identifies this VPN tunnel connection.

Call Direction

Displays the call direction for the associated VPN member. The call directions are defined as follows:

Outgoing---For this connection, the selected VPN member initiated the call.

Incoming---For this connection, the associated VPN member initiated the call.

Time Active

Displays the total amount of time this VPN tunnel connection has been active.

Encryption Type

Displays the data encryption algorithm used.

Key Size

Displays the data encryption key length in bits: 128-bit key for U.S. only and 40-bit key for export.

Key Changes

Displays the number of times the data encryption key was changed.

Packets Received

Displays the number of encrypted IPX packets received from this associated VPN member.

Packets Sent

Displays the number of encrypted IPX packets sent to this associated VPN member.

IP Associated Connection Details

This window provides the connection information between the selected VPN member and associated VPN member regarding the IP tunnel connection.

Associated Connection

Displays the server name for the associated VPN member.

Associated Address

Displays the IP address of the associated VPN member. This is the configured public IP address.

Connection State

Displays the current connection state for this associated VPN member. The connection states are defined as follows:

Established---The connection has been established and packets have been sent and received.

Pending---A call has been made, but no packets have been received from that member.

Unattached---The connection has not been made and no packets have been sent or received.

Connection ID

Displays the connection ID for this associated VPN member. This is an integer value generated at connection time that identifies this VPN tunnel connection.

Call Direction

Displays the call direction for this associated VPN member. The call directions are defined as follows:

Outgoing---For this connection, the selected VPN member initiated the call.

Incoming---For this connection, the associated VPN member initiated the call.

Time Active

Displays the total amount of time this VPN tunnel connection has been active.

Encryption Type

Displays the data encryption algorithm used.

Key Size

Displays the data encryption key length in bits.

Key Changes

Displays the number of times the data encryption key was changed.

Packets Received

Displays the number of encrypted IP packets received from this associated VPN member.

Packets Sent

Displays the number of encrypted IP packets sent to this associated VPN member.

To view the latest activity information

Click Update.

The VPN tunnel monitor windows are refreshed with the latest activity information. The monitor automatically refreshes every 10 seconds.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Control Options

Use this dialog box to configure the following controls for your Virtual Private Network (VPN):

Select Protocols for Encryption

A control parameter that specifies which network protocols are encrypted and sent over the VPN tunnel. Select IP, IPX*, or both.

Connection Initiation

A control parameter that specifies whether a connection between two VPN servers can be initiated by only one server or either server.

One Side indicates that a connection made between two servers is always initiated from one server. This setting typically results in faster calls. Both Sides allows either server to initiate the connection. However, if two servers initiate a connection to each other simultaneously, the connection takes longer to establish. In this case, the longer connection time is caused by the servers’ negotiation over which one initiated the connection first.

VPN Network Topology

A control parameter that specifies the VPN topology or connectivity between VPN members:  mesh, star, or ring.

Mesh---This is the default topology.  All servers are interconnected to form a web or mesh, with only one hop to any VPN member.  There is communication between every member in the VPN, whether required or not.  This topology is the most fault-tolerant.

Star---The master server is the hub of this topology, with all communications radiating outward to other servers and returning to the master server.  This is the least traffic-intensive topology, but the master is the single point of failure.

Ring---In this topology, each member communicates with its immediate neighbors. The ring loops from the master server to subsequent slave servers and back to the master server.

Update Interval

A synchronization parameter that specifies how long the master server waits between attempts to update a slave server with the newest topology and encryption information. If the first attempt fails, the master server retries at 15-minute intervals (the default) until it updates the slave server.

Connect Timeout

A synchronization parameter that specifies how long the master server tries to connect to a slave server during a synchronization update. The default connect timeout is two minutes.

Response Timeout

A synchronization parameter that specifies how long the master server waits for a response from a slave server before terminating the connection during a synchronization update. The default response timeout is two minutes.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Local IP Networks

Use this dialog box to view, change, or configure the following Virtual Private Network (VPN) server parameters:

Local IP Networks and Hosts

A static network address, which can be a private local IP network or host address.

Enable IP RIP

When selected (the default), enables outgoing RIP for the selected server’s VP Tunnel interface.  Turn RIP off to cut down traffic and increase security.  If you turn RIP off, you must configure static routes.

Key Change Interval

Specifies how many packets pass through the encrypted tunnel before the encryption key is changed. The number of packets that pass through the tunnel before the key changes is a random value between 75 and 100 percent of the entered value.

For example, if you enter 1000, the encryption key will change after every 750 to 1000 packets. The first key change might occur after 925 packets, the second after 806, and so on.

Response Timeout

Determines how long one VPN server waits for a response from another before terminating the connection.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Static Routes

Use this dialog box to specify one or more local IP network or host addresses as static routes. When you synchronize the VPN, the static routes you associate with a VPN server are added to the routing tables of the other VPN servers, which use the route to forward encrypted data to the destination VPN server.

Static routes are useful for the following reasons:

When you do not want VPN servers to exchange routing information. Because static routes reduce network traffic, they are typically used with on-demand connections between remote sites.

When you want to use your VPN for both site-to-site and site-to-Internet connections. In this case, having a static route prevents unencrypted traffic from reaching the Internet while the VPN is being established between sites.

You configure static routes for each VPN member from the VPN master server.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


IPX/IP Gateway Attributes

Use this dialog box to enable the Novell* IP Gateway software on the server, set up logging for the IPX/IP gateway, and change the gateway service port.

Important: Logging can slow access to Internet services. Do not leave logging enabled for an extended period of time.

Parameter Descriptions

Enable

When checked, causes the server to load the gateway NetWare Loadable Module* (NLM*) file (IPXIPGW.NLM) when you close the Novell BorderManager Setup page.

Access Log

Specifies the type and format of logged information associated with outbound access through the gateway server.

None---Event logging is disabled.

Indexed Format---A Novell* audit-log format. The information it presents depends on the Novell BorderManager component from which information is being collected.

Log Level

A number between 0 and 3 that indicates the type of information logged by the server.

0---No information.

1---Internet access information. The server records the user’s fully distinguished NDS name, the access protocol (HTTP, for example), and the destination (www.novell.com, for example).

2---Error codes (NDS errors, for example). Level 2 information can help you determine why a user cannot access a particular service.

3---Debugging information (internal server communications, such as socket calls). Level 3 information is typically of interest only to software developers.

Each log level is additive; for example, level 1 information is also logged at level 2.

Port

The number of the port used by the IPX/IP and IP/IP gateways to transmit gateway traffic on the server. By default, both gateways use port 8225 (decimal). If another service is using this port, you can assign a different port number for gateway traffic.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


IP/IP Gateway Attributes

Use this dialog box to enable the Novell* IP Gateway software on the server, set up logging for the IP/IP gateway, and change the gateway service port.

Important: Logging can slow access to Internet services. Do not leave logging enabled for an extended period of time.

Parameter Descriptions

Enable

When checked, causes the server to load the gateway NetWare Loadable Module* (NLM*) file (IPXIPGW.NLM) when you close the Novell BorderManager Setup page.

Access Log

Specifies the type and format of logged information associated with outbound access through the gateway server.

None---Event logging is disabled.

Indexed Format---A Novell* audit-log format. The information it presents depends on the Novell BorderManager component from which information is being collected.

Log Level

A number between 0 and 3 that indicates the type of information logged by the server.

0---No information.

1---Internet access information. The server records the user’s fully distinguished Novell Directory Services* (NDS*) name, the access protocol (HTTP, for example), and the destination (www.novell.com, for example).

2---Error codes (NDS errors, for example). Level 2 information can help you determine why a user cannot access a particular service.

3---Debugging information (internal server communications, such as socket calls). Level 3 information is typically of interest only to software developers.

Each log level is additive; for example, level 1 information is also logged at level 2.

Port

The number of the port used by the IPX/IP and IP/IP gateways to transmit gateway traffic on the server. By default, both gateways use port 8225 (decimal). If another service is using this port, you can assign a different port number for gateway traffic.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


static route

A RIP route added to the Routing Information Table manually by a network administrator instead of by the routing protocol operating over a network link.


Update Interval

How long the master server waits between attempts to update a slave server with the newest topology and encryption information. If the first attempt fails, the master server retries at 15-minute intervals (the default) until it updates the slave server.


Connect Timeout

During a synchronization update, how long the master server spends trying to connect to a slave server. The default connect timeout is two minutes.


Response Timeout

During a synchronization update, how long the master server waits for a response from a slave server before terminating the connection. The default response timeout is two minutes.


Related Topics

Understanding VPNs

Adding a Server to a VPN

Tuning Master-Slave Server Synchronization


Related Topics

Adding a Server to a VPN

Setting Up a Static Route for Encrypted Traffic

Adjusting the VPN Server Response Timeout

Tuning Master-Slave Server Synchronization

Synchronizing VPN Servers

Removing a Server from a VPN


Related Topics

Understanding VPNs

Synchronizing VPN Servers


Related Topics

Creating an Access Rule

Changing an Access Rule

Deleting an Access Rule

Viewing All Rules That Apply to an Object


Setting Up a Proxy Server

Proxy Cache Services resolves URL requests on behalf of Web clients on your network. These requests, if cacheable, are cached on the proxy server to increase the speed of delivering the same content the next time the user requests the same information.

The proxy server can also be configured as an HTTP accelerator to accelerate Web requests from Internet users for your Web servers on your intranet. You can configure the server to be a proxy server, an HTTP accelerator server, or both.

To set up a proxy server

1.	Double-click the server you want to configure as a proxy server.

2.	Select the Web Proxy Cache page.

3.	Select the Enable HTTP Proxy check box.

4.	Enter the number of the HTTP listening port on which the server should expect incoming URL requests from clients. The default is 8080.

5.	Enter an anonymous FTP e-mail address or keep the default.

6.	To configure the server as an HTTP accelerator as well, see Setting Up an HTTP Accelerator.

7.	Click Advanced if you want to further customize your Web cache, or click OK if you are finished.

8.	If you have not done so already, go to the server console and configure the DNS resolver.

Hint: Use RCONSOLE from your administrator workstation to access the server console.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Setting Up an HTTP Accelerator

The HTTP accelerator is also known as the reverse proxy. In this case, the server acts as a front end to your Web servers on the intranet.

Note: You need at least one private and one public address to use the proxy server. However, you can use a single address as both a public address and a private address.

1.	Double-click the server you want to configure as a proxy server.

2.	Select the Web Proxy Cache page.

3.	Select the Enable HTTP Accelerator check box.

4.	Click [image] to add a new accelerator, then supply the following information:

Enter the hostname of the Web server.

Enter the Web server listening port number. The default is 80.

Select the public proxy IP addresses from the list. These are the addresses you want the accelerator to listen on for incoming connections from the Internet. Click on the gray box next to an address to select or deselect it. A check mark indicates that an address is selected.

5.	Click Advanced if you want to further customize your cache, or click OK if you are finished.

6.	If you have not done so already, go to the server console and configure the DNS resolver.

Note: You can associate one or several public IP addresses with a particular domain name, but the combination of the IP address and the port must be unique.

For example, you have a Web server www1.myco.com, several IP addresses (1.2.3.4 and 1.2.3.5), and the Web server is listening on port 80. You can configure an accelerator entry for www1.myco.com, port=80, and two IP addresses (1.2.3.4 and 1.2.3.5).

As another example, you have multiple Web servers and several IP addresses. You can configure two entries: one for www1.myco.com with port 80 and IP address 1.2.3.4, and another for www2.myco.com with port 80 and IP address 1.2.3.5.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Configuring Cache Parameters

You can create a cache storage directory and specify HTTP cache aging values.

To configure cache parameters

1.	Double-click the proxy server.

2.	Select the Web Proxy Cache page.

3.	Click Advanced.

4.	Click the Cache tab.

5.	Specify a server pathname as a cache storage directory.

For example, specify sys:/etc/proxy/cache. The volume name is optional. If you do not specify a volume name, the default SYS: is used.

6.	Enter the maximum size of the file, in MB, that is cached for each URL protocol request type.

7.	Specify the HTTP cache aging values.

8.	Specify whether to ignore refresh requests from the browser.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Configuring a Hierarchical Web Cache
Configuring a Hierarchical Cache

If several proxy servers are serving the network, you can set up a hierarchy of proxy caches. If the proxy server does not find the requested page in its cache, it queries its peers and parents for the information. The queried peers and parents can then, in turn, query additional peers and parents for the requested information. The origin server is queried as the last resort. Note that Novell’s proxy server is compatible with other SQUID-based proxy servers that exist on the Internet. You can set up these proxy servers as neighbors, parents, or both.

To configure a hierarchical cache

1.	Double-click the proxy server.

2.	Select the Web Proxy Cache page.

3.	Click Advanced.

4.	Click the Hierarchy tab.

5.	Select the Enable ICP Server check box and enter the ICP listening port number.

6.	Select the Enable ICP Client check box and enter the ICP neighbor timeout (in seconds or minutes).

7.	Click [image] and add one or more neighbors for the Neighbors List. Specify the following information:

Enter the neighbor hostname.

Enter the neighbor (HTTP) proxy port number.

Enter the neighbor ICP port number.

Enter the neighbor type (peer, parent, or CERN).

Enter the priority number assigned to each neighbor. You can prioritize a set of parents or neighbors.

Note: Click [image] to delete entries.

8.	Click Hierarchical Cache Routing and specify the following information:

Select the Treat a URL’s home site as a peer cache check box.

Click Insert and enter the local domain name, then click OK.

Click Insert and enter a stop pattern, then click OK.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Specifying Transport Parameters

You can configure various transport-related parameters that are used by the proxy server. Do not change the defaults unless you are certain of the outcomes. You might need to fine-tune the parameters based on your network load.

To specify transport parameters

1.	Double-click the proxy server.

2.	Select the Web Proxy Cache page.

3.	Click Advanced.

4.	Click the Transport tab.

5.	Enter values for the timeouts you want to set.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Specifying DNS Parameters

You can configure the type of Domain Name System (DNS) transport and other DNS parameters used by the proxy server.

To specify DNS parameters

1.	Double-click the proxy server.

2.	Select the Web Proxy Cache page.

3.	Click Advanced.

4.	Click the DNS tab.

5.	Specify TCP or UDP as the transport protocol used by the DNS Resolver in the proxy server. The default is UDP.

Note: If you select UDP and notice an increase in Bad Gateway error pages while the origin Web server is running, you may want to increase the DNS Resolver Timeout value.

6.	Enter values for the DNS Time-To-Live (TTL) parameters.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Specifying a List of Non-Cacheable URL Patterns

You can specify that certain URL patterns be accessed directly without caching by the proxy server (be non-cacheable). For example, you may not want to cache a URL with the pattern /cgi-bin/.

To specify non-cacheable URL patterns

1.	Double-click the proxy server.

2.	Select the Web Proxy Cache page.

3.	Click Advanced.

4.	Click the Cache Bypass tab.

5.	Click [image] to add non-cacheable URL patterns to the list. Specify the pattern and the associated protocol access type.

Note: Click [image] to delete selected patterns from the list.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Enabling Proxy Authentication

You can enable proxy authentication and require all users to authenticate with their browsers before they access the proxy server and the Internet.  Proxy authentication consists of a username and a password.  The password must be different than the NetWare* client password.  Any type of browser client can be authenticated: Windows** 3.1, 95, or NT; UNIX**, OS/2**, or Macintosh**.

When proxy authentication is enabled, the network administrator can specify whether users can change their own proxy passwords, and how often.  If you do not specify this, you can change the proxy passwords yourself using Novell* BorderManager.

To enable proxy authentication

1.	Double-click the proxy server.

2.	Select the Web Proxy Cache page.

3.	Click Advanced.

4.	Click the Authentication tab.

5.	Click Enable Proxy Authentication.

6.	Enter the user’s default NDS* context.

7.	Enter a value for the Authentication Cache Age parameter.

To change a proxy password

1.	Select the user object, then select the Proxy Authentication page.

2.	Do one or both of the following:

To allow users to change their own proxy passwords, click Allow User to Change Password.

To require users to periodically change their passwords, click Force Password Change Every xx Days, then enter the time interval.

3.	To change a user’s password, do the following:

Click Change Password.

Enter the old password, then enter the new password. Retype the new password.

4.	Click OK.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Cache Services Benefits

Novell* BorderManager Proxy Cache Services combines an Internet proxy, a Web caching facility, and Novell Directory Services* (NDS*) to provide World Wide Web access from within a firewall. Proxy Cache Services has the following benefits:

Provides local LAN access of cached information to reduce WAN traffic to the Internet and on the primary Web server, reduces the load on Web Internet servers, and increases Internet and intranet performance.

Uses a single protocol on the LAN with no need for separate clients. Clients can use only HTTP to talk to a proxy server—the proxy server uses FTP, Gopher, and HTTPS as HTTP requests to access documents from the network.

Improves intranet security by hiding the local network from the Internet; intranet security includes access control and content filtering.

Distributes LAN client requests across many proxy servers; for example, FTP requests on one server, and HTTP requests on another server.

Reduces the disk space requirements on client workstations.

Enables document access even when the Internet Web server is down or inaccessible if the document is already cached by the proxy and Time-To-Live is available in the cache.

These benefits apply to both Internet and intranet Web sites.  Because Proxy Cache Services supports open Internet standards, it can be used with Novell’s intranet and Internet products, as well as with other vendors’ browsers and Web servers.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Cache Basic Configurations

The proxy cache supports three basic cache configurations:

Web client accelerator (standard proxy caching services). For more information, see Standard Proxy Caching.

Web server accelerator (HTTP acceleration/reverse proxy caching). For more information, see HTTP Acceleration.

Network acceleration (ICP hierarchical caching). For more information see Hierarchical Caching.

To use Proxy Cache Services, users simply point their browsers to the proxy server.  The browser then automatically directs all requests through the proxy server.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Understanding Proxy Cache Services

The overwhelming increase in network traffic is partly due to the repeated fetching of objects from remote Web servers on the Internet.  Web browsers communicate with origin Web servers directly, over high-latency Internet connections, and receive data in small blocks of 4 to 8 KB.  The browser opens and closes its receive window as it requests each block, and paints the data in the browser window.  This time-consuming process results in widespread delays on the World Wide Web.  Novell* BorderManager Proxy Cache Services provides a caching ability to increase response and performance for the user. Caching stores copies of the most recently used or requested Internet data on a proxy server that is close to the requesting client. This allows the data to be accessed and processed more quickly and results in shorter delays when users request a URL.

With Novell Proxy Cache Services, a browser makes requests to a proxy server at local intranet speeds instead of going directly to the origin Web server. A proxy server is an HTTP server that usually runs on a firewall server. The proxy server handles requests from within the firewall, forwarding them to the Internet outside the firewall, then returning the replies to the client.

The proxy first checks for the requested object in its cache. If the object is in the cache, the proxy returns it to the requesting browser at LAN speed. If the requested object is not cached, the proxy fetches it from the origin Web server, stores a copy in its cache, and then returns the object to the requesting browser. Cached objects can be shared among many browsers.  This ability to access locally cached information reduces traffic to the origin Web server and delivers information at faster LAN speeds.

Proxy Cache Services opens a 64 KB receive window between the proxy server and the origin Web server and keeps it open for the entire transmission.  When the browser receive window opens for the next block of data, the information is already cached in the local proxy.

The proxy cache uses cache aging information that Web servers provide to browsers specifying how long pages should be cached.  The HTML text is only a small fraction of the transmitted data, even for sites that generate and update HTML pages. Most of the data is images that are static and can be cached.  The proxy cache also enables you to fine-tune cache aging policies.

While browsing, a user may select a new link before the browser has completed fetching the current page.  If this happens, the proxy cache completes fetching the entire page and caches it and then fetches the new page.  If the user returns to the aborted page, the proxy can immediately access the entire page from its cache.

The Novell BorderManager proxy cache supports the following protocols: HTTP (0.9, 1.0, and 1.1), FTP, Domain Name System (DNS), and Gopher. The passive mode (PASV) is supported for FTP to allow the firewall administrator to deny incoming connections above port 1023, if necessary. Otherwise, normal (PORT) FTP mode is used.

Proxy Cache Services is based on both the first generation CERN proxy technology and the newer, second generation Harvest/Squid hierarchical proxy cache technology. The Harvest/Squid technology enhances standard CERN proxy cache services with negative URL caching, negative Domain Name System (DNS) caching, and introduces hierarchical caching through the Internet Cache Protocol (ICP).

The Harvest project, an Internet Resource Discovery Project contract performed by the University of Colorado, introduced ICP hierarchical caching to improve Internet Web performance and scalability. The project was transferred to the National Laboratory for Applied Network Research (NLANR) in early 1996 as the basis for the Squid project. The goal of the Squid project is to facilitate the evolution of an efficient national architecture for handling highly popular information.

See also How Caching Works, How Proxy Cache Services Works

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


How the Proxy Cache Services Works
How Proxy Cache Services Works

Proxy Cache Services acts as an intermediary between clients on a protected network and the Internet. When a user requests an Internet service, such as HTTP, the client submits the request to the proxy that then acts on the client's behalf. The proxy checks its local cache for the data and, if available, sends the data to the client immediately. If the data is not available, the proxy requests the data from the Internet Cache Protocol (ICP) cache servers or the origin server on the Internet, and then returns the data to the client.

The proxy server, then, works both as a client and a server. As a server, it receives requests from intranet clients. As a client, it forwards the requests to the origin Internet server.

When a client makes a regular HTTP request (without using a proxy), the HTTP server gets only the path and keyword portion of the requested URL. For example, the user enters the following command:

http://host.com/marketing/doc.html

The browser sends the following command to host.com:

GET /marketing/doc.htm

In this example, the protocol specifier "http" and the hostname are apparent to the remote HTTP server.

When a client sends a request to a proxy server through a browser, the proxy uses HTTP and the GET method. The client/browser always uses HTTP when communicating with the proxy, even when accessing an object on a remote server that uses a different protocol, such as Gopher or FTP. If a different protocol is being used, the proxy will identify the protocol and will use that protocol and the full URL to make the request. For example, for an FTP protocol request, the proxy will use the following command:

GET ftp://host.com/marketing/doc.html

All the information is used when requesting information from the origin server. The results are returned to the proxy server as an FTP reply, and the server then sends the information to the user as an HTTP document.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


HTTP Acceleration

HTTP acceleration, also known as reverse proxy cache acceleration or Web server acceleration, creates a front end processor to a Web server. An HTTP accelerator server lies between one or more Web servers and the Internet and represents the Web servers to any clients accessing them.

When the Internet user queries Domain Name System (DNS) for a Web server's address, the DNS returns the address of the HTTP accelerator. The HTTP accelerator listens on port 80 (or other configured port) and processes all incoming Web requests. Requests to objects that can be cached--static information that does not change often such as HTML pages and GIF images--are processed by the proxy. Requests for objects that cannot be cached--dynamic information that changes frequently--are routed to and processed by the origin Web server on port 80. In general, approximately 90 percent of a typical Web page content is static, and ten percent is dynamic.

You can set up an HTTP accelerator server to push information or references to cacheable objects from a Web server to a border server.  This will reduce loading on your Web servers. The HTTP accelerator server forwards only requests or references that are not in the cache to the Web server.

If your site requests a high percentage of objects that can be cached, the HTTP accelerator reduces the Web load. For even greater performance, you can cache objects of a more volatile nature, such as stock quotes, and specify an accuracy delay time to users.

The NetWare* reverse proxy cache can handle more TCP connections than an origin Web server that is typically UNIX or NetWare.

HTTPD acceleration has the following benefits:

Protects IP networks

Conserves IP addresses

Provides caching for Web servers

Reduces the load on the Web servers and speeds them up

To set up an HTTP accelerator, see Setting Up an HTTP Accelerator

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


How Caching Works

Caching accelerates Internet access by caching the contents of each Web site that a user visits. When the contents are cached, future requests for the same information can be delivered more quickly. When users browse the Internet, Proxy Cache Services uses the content files locally based on the sites that users have already accessed. Because the information is delivered from a local server at LAN speed instead of from a remote server at WAN speed, caching increases the speed of delivering data to the user while reducing traffic over the WAN and reducing the load on the origin Web server.

Object Types and Caching

Not all objects can or should be cached. Some types of objects are of no value when cached because they change too frequently or are continuously updated on the Web. Other types of objects require authentication before they can be accessed.

HTTP supports the HEAD method to retrieve only the header to determine how recent an object is. If an object has not been modified since the time specified in a header request, the object is not returned.

Usually, a proxy server does not cache the following types of objects:

Objects that are password-protected

Objects with /cgi-bin/ in their URLs

Objects that are larger than a preconfigured size

Objects associated with protocols other than HTTP, FTP, or Gopher

Any HTTP header that contains "Pragma:no-cache", "Cache-Control: Private", "Set Cookie", "WWW-Authenticate", or "Cache-Control:no-cache"

To specify noncacheable object types, see Specifying a List of Noncacheable URL Patterns.

The Novell proxy uses the cache aging information that Web servers usually provide to browsers. This information specifies how long pages should be cached. The HTML text is typically only a small part of the transmitted data, even for sites that dynamically generate HTML pages. The majority of the data consists of images that are static and cacheable. To improve performance, you can fine-tune cache aging policies.  See Configuring Cache Parameters.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Types of Caching

Proxy Cache Services supports the following types of caching:

Standard or passive caching

Active caching

Negative caching

Hierarchical caching

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Standard Proxy Caching

Also called passive or on-demand caching, passive caching is the basic caching method. In passive caching, when the proxy resolves a URL request for a client browser, the proxy caches a copy of the content for a preset period of time or until the cache is full. The proxy builds its cache based on the Web sites that the users visit.

Before the proxy server forwards requests from the client to the Web, it checks its cache to determine if it can satisfy the request. If the data is found and is not expired, it is immediately returned to the client. If the object has expired or is not available in the cache, the proxy downloads the latest copy from the Web and returns a copy to the client. If the cache disk space is low, the older objects are removed from the cache.

When an object is retrieved from the Web and put in a cache, a Time-To-Live (TTL) value is associated with the object. While the TTL is running, all requests are fulfilled from the cache for that object. When the TTL expires, the Web server must be contacted for a newer version, an update stored in the cache, and a new TTL calculated.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Active Caching

Active caching is an add-on to passive caching that improves performance. With active caching, the proxy automatically sends a request to the origin server to fetch an object. The server updates objects that are more frequently accessed or requested, have longer TTLs, and are doing caching during periods of low server load.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Negative Caching

Negative caching occurs when a proxy attempts to resolve a request for a URL that does not exist or cannot be located or accessed. In this case, the proxy caches the negative result so that future requests for that URL are resolved quickly. The proxy continues to check in the background and refreshes the cache when the pages become available.  Negative caching occurs for HTTP error conditions such as 403 (forbidden request) and 404 (URL not found).

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Hierarchical Caching

Proxy servers maintain knowledge about each other using intelligent cache topologies.  Hierarchical proxy caching increases performance by fetching first-time access and negative cache data from the optimal nearby proxy server without going all the way to the origin Web server.

You can configure hierarchical cache routing to improve the performance of local cache misses. Two cache routing systems are provided: first generation CERN cascading and second generation ICP hierarchical caching.

The CERN cascading system provides standard HTTP forwarding through proxy chains. The ICP hierarchical cache system provides advanced cache routing through a designed cache topology. ICP provides maximum performance, scalability, and fault tolerance for both intranet and Internet Web caching.

ICP hierarchies are built on neighborhoods of proxy cache services. These neighborhoods are comprised of parents and, optionally, peers. There are normally five neighbors for the local proxy cache service. You can define multiple parents to improve performance and fault tolerance. The ICP protocol dynamically determines optimal cache fulfillment in the neighborhood. It also automatically detects down neighbors and recovers them.

The difference between peers and parents is in the fulfillment of URL objects that are not cached in the neighborhood. Only parents can be requested to obtain a URL for the neighborhood. The basic ICP fulfillment strategy is to obtain a neighborhood cached object from the most optimal neighbor (the one that responds first with a cache hit), and to obtain missed URL objects for the neighborhood and its local cache from the most optimal parent (the parent that responds first with the most preferred cache route).

The following are some basic guidelines to ICP neighborhood topology:

Limit the number of neighbors to five. More than five neighbors will flood the network with ICP requests without improving the quality of service.

Choose parents that are en route to the intranet or Internet (for example, organizational, connected to the firewall/ISP, and so on).

Choose two or more parents for fault tolerance. Establish a routing preference with parents based on the quality of service (bandwidth, load balancing, and so on).

Choose peers that have close proximity relationships (high bandwidth and low latency).

For more information on ICP and hierarchical caching, see http://www.nlanr.net/Cache.

To configure hierarchical caching, see Configuring a Hierarchical Cache.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Integration with Internet Gateway Clients

The Proxy Cache Services also supports the HTTP protocol over IPX. Novell* IPX/IP and IP/IP gateway clients, as well as other clients, can directly access the proxy server.

For more information about Novell Gateways, see Understanding the Novell Circuit-Level Gateways .

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Servers and Security

The primary benefit of establishing proxy servers on your intranet is to increase security through access control and the logging of URL requests. Proxy cache provides two types of security:

Outbound security---The proxy server can restrict access by URL site to Internet protocols, such as HTTP, FTP, and Gopher. For example, you can restrict access to Web sites that do not fit your company policy or are not essential to completing company work.

Inbound security---The proxy server keeps internal network addresses secure by hiding client IP addresses from the Internet and substituting these addresses when requesting information from Web servers.

The proxy server provides tighter security than using only address filtering.  The proxy server determines the address of a packet and the entire context of the session in which the packet is being sent, making it easier to identify suspicious packets.  The proxy server can be used as a part of a firewall solution or together with firewall solutions from other vendors.  It can be used in front of, within, or behind existing firewalls.

For additional security, access is controlled using access control list rules.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Service Transaction Logs

You can monitor URL request activity by viewing the proxy cache transaction logs. Management statistics are also provided in a Management Information Base (MIB)-based database. This database contains the following proxy cache information:

Number of most popular sites cached

File size (in KB) that the server transfers between clients and Web servers

Number of cache misses

KB successfully cached

Number of direct connections that were saved between the client and the Web server by using the proxy cache

The proxy cache also supports the common log format in text and logs hits and misses in an RDBMS database. You can use the console to view the database and perform queries. For more information, see Checking Proxy Cache Activity.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Cache Services and Access Control

You can set up Proxy Cache Services access control to do the following:

Restrict user access to certain unproductive Web sites

Restrict use of unauthorized or inessential applications

For example, you may want to deny access to Web sites that do not fit your company policy or are not essential to completing company work.

With access control lists, the proxy server restricts access based on the source and destination IP address, URLs, domains, and the NetWare* username. The proxy server also works with other third-party site-blocking software such as Cyber Patrol** by category.

The access control list rules are stored in the Novell* Directory Services* (NDS*) utility. The access control list is a set of rules that either allow or deny. The access control list module checks the HTTP request and whether any of the access rules apply. If the rule applies, the specified action is performed. Otherwise, the default rule is applied. You can configure rules on a per-server or container basis. See Creating an Access Rule for more information.

With NDS, access control lists are associated by container, group, user, or server. Access control lists can apply to all proxies in an organization, thereby giving management a global view.

Novell IP Gateway clients also provide NetWare usernames with HTTP requests. URL restrictions can also be based on usernames. HTTP/IPX and HTTP/IP clients can also directly access proxy servers.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Cache Services Attributes

Use this dialog box to enable the Proxy Cache Services software on the server and to set up proxy cache logging.

Important: Logging can slow access to both Internet services and locally cached information. Do not leave logging enabled for an extended period of time.

Parameter Descriptions

Enable

When checked, causes the server to load the Proxy Cache Services NetWare Loadable Module* (NLM*) files when you close the Novell* BorderManager Setup page.

Access Log

Specifies the type and format of logged information associated with outbound access through the proxy server.

None---Event logging is disabled.

HTTPD Common Format---Logs the following information: remote hostname, user’s remote logname, authenticated username, date, request line from client, status, and length of data in bytes. Example

Extended Format---Logs the following information: cached status (0 or 1), date, time, client IP address, URL method, and URL. Example

Indexed Format---A Novell audit-log format. The information it presents depends on the Novell BorderManager component from which information is being collected. For example, an access control log for the proxy cache contains the following information: when access was allowed or denied, the IP address that initiated the access attempt, the destination, the HTTP command (GET, for example), and the result of the attempt (“hit” or “miss”).

Log Level

A number between 0 and 3 that indicates the type of information logged by the server.

0---No information.

1---Internet access information. The server records the user’s fully distinguished Novell Directory Service* (NDS*) name, the access protocol (HTTP, for example), and the destination (www.novell.com, for example).

2---Error codes (NDS errors, for example). Level 2 information can help you determine why a user cannot access a particular service.

3---Debugging information (internal server communications, such as socket calls). Level 3 information is typically of interest only to software developers.

Each log level is additive; for example, level 1 information is also logged at level 2.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache Main Window

Use this page to configure basic Proxy Cache Services and caching information.

Parameter Descriptions

Enable HTTP Proxy

Enables HTTP Proxy Cache Services and allows file caching.

HTTP Listening Port

Port on which the proxy server listens for incoming URL requests from browser clients on your network. The default is 8080.

Enable HTTP Accelerator

Enables a proxy server to be an accelerator for a Web server. This is disabled by default.

HTTP Accelerator List

Adds one or more HTTP accelerator servers, consisting of a Web server hostname, the port number the Web server is listening on for incoming connections, and the IP address of the proxy server. The IP addresses are configured from the Novell* BorderManager Setup page.

Anonymous FTP Email Address

E-mail address used for the anonymous FTP login by the FTP client of the proxy server.

Advanced

Enables you to specify advanced Proxy Cache Services configuration information, including cache related information, cache bypass, DNS Resolver information, hierarchy, and TCP transport timeouts.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: HTTP Accelerator

Use this dialog box to configure the HTTP accelerator list information.

Parameter Descriptions

Web Server Hostname

The name of the Web server host.

Web Server Port

The port number the Web server is listening on for incoming connections.

Proxy IP Address

The IP address of the proxy server.

The proxy server can accelerate one or more Web servers with at least one IP address and a port number for each Web server. You cannot use the same IP address and port number combination for another Web server. If you need to accelerate multiple Web servers on your intranet, and all of them are listening on the same port number, you must configure multiple IP addresses on your proxy server. The IP addresses are configured from the Novell* BorderManager Setup page.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: Cache Tab

Use this tab to specify proxy cache configuration: cache directory and maximum size per file in the cache. You can also use this tab to configure Time-To-Live (TTL) information for cached URLs.

Parameter Descriptions

Cache Directory

The directory in which the cached files are stored. The default directory is SYS:/ETC/PROXY/CACHE. Do not delete or modify the cache directory after PROXY.NLM is loaded on the server. If you change the directory name, make sure that you unload and reload PROXY.NLM to reflect the new cache storage directory.

Maximum Cached File Size (MB)

The maximum number of MB, per HTTP, FTP, or Gopher files, that can be cached by the proxy server. Any file larger than the specified size is not cached. The default is 30 MB.

HTTP Maximum Revalidation Time

The maximum number of hours or days HTTP data is cached before it is revalidated with the origin Web server. This overrides the Time to Expire specified by the origin Web server if the Web server’s value is greater than this value.

HTTP Default Revalidation Time

The number of hours or minutes HTTP data is cached before it is revalidated with the origin Web server. The data is revalidated if the origin Web server does not specify the Time to Expire.

HTTP Minimum Revalidation Time

The minimum number of hours or minutes HTTP data is cached by the server. This overrides the time to expire specified by the origin Web server if the time specified is less than this value. This parameter does not override the No Cache or Must Revalidate directives from the origin Web server.

FTP Revalidation Time

The number of hours or days FTP data is cached before it is revalidated with the origin Web server.

Gopher Revalidation Time

The number of hours or days Gopher data is cached before it is revalidated with the origin Web server.

HTTP Failed Request Cache Time

The number of seconds or minutes HTTP will return a failure for the requested pages that the proxy server could not retrieve from the origin Web server.

Ignore Refresh Requests From Browser

The cache does not access the Web server to refetch a URL when a user specifies to reload or refresh from the browser.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: Hierarchy Tab

Use this tab to configure caching hierarchy information, including a pattern stop list, and peer and parent caches.

Parameter Descriptions

Enable ICP Server

Enables the Internet Cache Protocol (ICP) server and lets you configure the ICP listening port.

ICP Listening Port

The UDP port on which the cache listens for queries from other caches.

Enable ICP Client

Enables the Internet Cache Protocol (ICP) client and lets you configure the ICP neighbor timeout.

ICP Neighbor Timeout

The number of seconds or minutes the proxy server waits for a response to an ICP request from another proxy server.

Neighbor’s List

Lists the neighbors to the proxy server by neighbor hostname, proxy port, ICP port, type, and priority.

Hierarchical Cache Routing

Click to specify origin Web servers that are in close proximity and URL patterns for which the cache queries the origin Web server directly.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: Advanced ICP Cache Routing

Use this dialog box to specify local domains and a pattern stop list.

Treat a URL’s home site as a peer cache

The home server site is used as a peer cache (not recommended).

Domain Name

A list of the IP addresses of origin Web servers that are logically in close proximity (low latency and high bandwidth). The proxy server prefers to query for a URL that it cannot resolve from these servers instead of from the ICP cache hierarchy.

Pattern

A list of URL patterns for which the cache should query the origin Web server directly. Specify patterns for which the delays caused by hierarchical caching are unacceptable (for example, for static pages that change frequently).

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: Neighbors List

Use this dialog box to specify the neighbors to the proxy server.

Hostname

The name of the nearest host server neighbor.

HTTP Proxy Port

The port number of the neighbor HTTP proxy.

ICP Port

The port number of the neighbor ICP.

Type

The type of neighbor: peer, parent, or CERN.

ICP Routing Priority

The priority for each neighbor. You can prioritize a set of parents or neighbors. An ICP cache chooses the fastest responding ICP cache with the highest priority to service a request. 1 is lowest priority, 10 is highest.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: Transport Tab

Use this tab to fine-tune transport parameters.

Parameter Descriptions

Establish Connection Timeout

The number of seconds or minutes the proxy server attempts to establish a connection before timing out because the other side has not responded. You may want to increase this value if you notice that the remote server is reachable (the ping succeeds) but the load is heavy.

Connection Keepalive Interval

The number of minutes or hours a connection is idle before the proxy server queries to check if the other server is still alive.

Data Read Timeout

The number of seconds or minutes the proxy server waits for expected data to begin arriving before it times out. You may want to increase this value if you notice that the browser receives incomplete data, or the connection is disconnected in the middle of data transfer.

Idle Server Persistent Connection Timeout

The number of minutes or hours the proxy server keeps an Idle Server Persistent connection active, even if there is no data flow. Server connections are TCP connections between browsers and the proxy server.

Idle Client Persistent Connection Timeout

The number of seconds or minutes the proxy server keeps an Idle Client Persistent connection active, even if there is no data flow. Client connections are between the proxy server and the origin Web (or FTP or Gopher) server or another proxy server.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: Cache Bypass Tab

You can choose to not cache some URLs with certain predefined patterns, for example, /cgi-bin/. The proxy server simply forwards the request from the server to the requesting client.

Parameter Descriptions

Non-Cacheable URL Patterns

A list of URL patterns, classified by protocol access type and pattern, that are accessed directly instead of being cached (are non-cacheable). If you specify a long list of patterns, the proxy server performance will be affected. Click [image] to specify the access type (HTTP, FTP, or Gopher) and pattern.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: Non-Cacheable URL Pattern
Web Proxy Cache: Noncacheable URL Pattern

Use this dialog box to specify noncacheable URL patterns.

Access Type

The protocol access type for the pattern: HTTP, FTP, or Gopher.

Pattern

The noncacheable pattern string.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: DNS Tab

Use this tab to fine-tune some of the parameters used by the Domain Name System (DNS) Resolver client module, part of the proxy server.

Parameter Descriptions

DNS Transport Protocol

Specify TCP or UDP as the transport protocol used by the DNS Resolver to query the DNS server. The default is UDP.

DNS Resolver Timeout

For UDP, specify the number of seconds or minutes the proxy server waits before timing out after it sends a request to a DNS server to resolve a domain name.

Negative DNS Lookup

The number of seconds or minutes a failed DNS lookup name remains in the proxy server cache. If the proxy server cannot resolve a domain name, it stores that information in its cache for the specified amount of time. If the proxy server receives any subsequent requests for that domain within this period, it will respond with a “Bad Gateway” error to the browser instead of trying to resolve the domain name again.

Maximum DNS Entry TTL

The maximum number of hours or days DNS entries are cached before they expire. This is the maximum value, regardless of the value returned by the DNS Name Server.

Minimum DNS Entry TTL

The minimum number of seconds or minutes DNS entries are cached before they expire. This is the minimum value, regardless of the value returned by the DNS Name Server.

Maximum DNS Entry Threshold

The maximum number of DNS cache entries. When this number is reached, the proxy server will start to delete older entries to make room for newer entries. The default is 20,000.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Authentication

Use this dialog box to change the proxy password for a user or specify whether users can change the passwords themselves.

Parameter Descriptions

Allow User to Change Password

Specify whether users can modify their own proxy passwords.

Force Password Change Every xx Days

Specify the number of days that elapse before users are prompted to change their proxy passwords.

Change Password

Click this button to change the proxy password for a user.  Type the user’s old proxy password, followed by the new proxy password. Then retype the new proxy password.  The password is not case-sensitive, and it can contain from 5 to 64 characters.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Web Proxy Cache: Authentication Tab

Use this tab to enable or disable proxy authentication.

Parameter Descriptions

Enable Proxy Authentication

Specify whether proxy authentication is enabled on the server.

User’s Default NDS Context

The complete context NDS* container name.  For example, type “.sales.my_org.”  This entry is optional, and makes logging in easier for users.  Users in the specified container can log in by typing only their login names, without the complete context string.  If you do not enter the NDS default context, users must log in using their complete context.  The NDS container name can contain up to 256 characters.

Authentication Cache Age

The length of time, in minutes or hours, that the proxy password remains cached.  Cache age can range between 10 minutes and 24 hours.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Novell BorderManager Errors

This topic provides a numerical list of error messages associated with the Novell* BorderManager modules that are part of the NetWare* Administrator utility. Click the number associated with a message to read an explanation of the error and recommended actions.

For a explanation of server console messages associated with Novell BorderManager NetWare Loadable Module* (NLM*) files, refer to Novell Internet Access Server 4.1 System Messages.

Important: If you need to contact Technical Support for assistance, determine the version of each Novell BorderManager module on your system before you call.

Determining Module Versions

Novell BorderManager Setup

  Internal error: string (error_code)

  Unable to allocate memory.

  Unable to read configuration from NDS (error - error_code)

Proxy Cache Services

  Internal error: string (error_code).

  Invalid proxy configuration: string.

  Novell Proxy encountered a fatal error: string.

  Novell Proxy unable to initialize string.

  Novell Proxy unable to initialize DNS resolver: string.

  Unable to allocate memory for user_supplied_string.

  Unable to read configuration from NDS (error - error_code) .

Outgoing Rules (Access Control)

  NDS error string: error_code.

  Read error_code rules.

  filename The control file for managing information with one of the external filter products is damaged. Please make the necessary changes and try again.

  The list information list number contained in this rule is incompatible with the vendor lists on the server.  This rule cannot be viewed or modified until the lists on the server are updated.

  The URLs associated with this rule are being removed because you have specified at least one selected from a third-party list.  One rule cannot contain user-specified URLs and third-party list items.

  The version information version number contained in this rule is incompatible with the version on the server.  This rule cannot be viewed or modified until the versions match.

  Unable to allocate memory.

  Unable to attach to server name.

  Unable to build rules from string NDS object: Error = error_code.

  Unable to deregister from BRDSRV.NLM.

  Unable to register with BRDSRV.NLM.

  Unable to validate one of the vendors identified in this rule vendor number.  The contents of this rule cannot be updated or viewed until the control information is corrected on the server.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Determining Novell BorderManager Module Versions

Before you call for technical assistance, record the version number of each Novell* BorderManager module running on the server. Having this information can help a technical support representative identify and solve a problem more quickly.

To determine the version of each Novell BorderManager module

1.	Locate the border server in the Novell Directory Services* (NDS*) tree.

2.	Double-click the server.

3.	Select the Novell BorderManager Setup page.

4.	Click About.

5.	Use the drop-down menu to display the name of each module loaded on the server.

6.	Record the version number associated with each module.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


0001: Unable to allocate Memory for <user_supplied_string>
0001: Unable to allocate Memory for user_supplied_string.

Explanation

The proxy server is running low on memory. Memory allocation for the event denoted by user_supplied_string failed.

Action

Add more memory to the server or increase the available server memory using one of the methods described in Resolving Memory Problems.


Unable to build rules from NDS string object
Unable to build rules from NDS string object.: Error=error code.

Explanation

ACLCHECK cannot build the access control rules from the NDS object described by the string. Refer to the error code for the reason for the failure.

Action

Contact Novell technical support.


Read error code rules
Read error code rules.

Explanation

ACLCHECK successfully read the rules from the NDS database.

Action

No action is necessary. This message is informational.


Unable to deregister from BRDSRV.NLM
Unable to deregister from BRDSRV.NLM.

Explanation

ACLCHECK failed to deregister from BRDSRV.

Action

Contact Novell technical support.


Unable to register with BDRSRV.NLM
Unable to register with BDRSRV.NLM.

Explanation

ACLCHECK failed to register with BRDSRV.

Action

Contact Novell technical support.


Unable to allocate memory
Unable to allocate memory.

Explanation

ACLCHECK or BRDSRV cannot allocate the requested memory.

Action

Add memory to the server or increase the available server


NDS error string: error_code
NDS error string: error_code.

Explanation

ACLCHECK failed in an attempt to call an NDS API. The name of the NDS API is described by the string. Refer to the error code for the reason for the failure.

Action

Contact Novell technical support.


Internal error: string (error_code)
Internal error: string (error_code).

Explanation

Refer to the string and the error code for the reason for the failure.

Action

Contact Novell technical support.


Novell Proxy unable to initialize string
Novell Proxy unable to initialize string.

Explanation

Refer to the string for an explanation of the proxy initialization failure.

Action

Contact technical support.


Novell Proxy unable to initialize DNS resolver
Novell Proxy unable to initialize DNS resolver: string.

Explanation

Refer to the string for the reason for the DNS initialization failure.

Action

Contact technical support.


Novell Proxy encountered a fatal error
Novell Proxy encountered a fatal error: string.

Explanation

Refer to the string for the cause of the fatal error.

Action

Contact technical support.


Unable to read configuration from NDS
Unable to read configuration from NDS (error - error code).

Explanation

Refer to the error code for the reason for the internal error.

Action

Contact technical support.


Invalid proxy configuration: string
Invalid proxy configuration: string.

Explanation

Refer to the string for the reason for the internal error.

Action

Contact technical support.


filename The control file for managing information with one of the external filter products is damaged.

Explanation

The ACL file filename on the server cannot be found or opened.

Action

Reinstall the third-party filter product or recover the server disk if it is damaged.


Unable to validate one of the vendors identified in this rule vendor number.

Explanation

The vendor identified in this rule by the displayed vendor number cannot be found.  You cannot modify the rule.

Action

Add the corresponding third-party filter product vendor information to the server.


The list information list number contained in this rule is incompatible with the vendor lists on the server.

Explanation

A corresponding list for the rule cannot be found.  You may have upgraded the third-party filter product, and the required file may have changed as a result.

Action

Delete the rule or deinstall the third-party filter product upgrade.


The URLs associated with this rule are being removed because you have specified at least one selection from a third-party list.

Explanation

You specified one or more URLs and a third-party filter product on the same rule.  This is not allowed.  The software defaults to ignore the URLs and follow the third-party rule.

Action

Specify your URLs on another rule or deselect the third-party rule to allow URLs.


The version information version number contained in this rule is incompatible with the version on the server.

Explanation

The specified rule is pointing to an older version of the control file list.  You cannot edit the rule.

Action

Delete the rules and use a newer version of the third-party filter product.


Unable to attach to server name.

Explanation

The specified server cannot be identified as a Novell* BorderManager server and has not been updated.

Action

Update the server manually if necessary.


Checking the Access Control Log

The access control log records entries made by the Novell* IP Gateway and proxy server. To log access attempts for a specific rule, you must click the Enforce Rules check box in the Rule Definition dialog box.

To check a server’s access control log

1.	Click on the server in the Novell Directory Services* (NDS*) tree.

2.	Select Tools > Novell BorderManager.

3.	Right-click to select Novell BorderManager > View Access Control Log.

4.	Click Display Records.

5.	Enter a date range, then click OK.

6.	Click a log entry to see a description of the associated access rule.

7.	To see the details of a specific access rule:

a.	Record the rule ID.

b.	Select the Outgoing Rules page.

c.	Match the rule ID to the rule in the access control list.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Checking VPN Activity

The Virtual Private Network (VPN) monitor displays the "real-time" activity of a selected VPN member and its associated VPN tunnel connections for IPX or IP.

To check VPN activity

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	Click Status.

4.	Click on a VPN server, then click Activity.

To check the activity between the selected VPN member and an associated connection, click the name of the associated connection in the VPN Tunnel Monitor.

This updates the IPX Associated Connection Details and the IP Associated Connection Details windows and reflects the VPN tunnel activity information with this VPN member.

To see the latest activity information, click Update.

This updates the VPN tunnel monitor windows with the latest activity information. The monitor is automatically updated every 10 seconds.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Checking the VPN Audit Log

The Virtual Private Network (VPN) audit log enables you to view audit log messages generated by a VPN server. You can also view a detailed explanation of any message.

To check a VPN server’s audit log

1.	Double-click the master VPN server in the Novell Directory Services* (NDS*) tree.

2.	Select the Virtual Private Network page.

3.	Click Status.

4.	Click a VPN server, then click Audit Log.

To view the audit log for the selected VPN member, click Acquire.

The latest audit log messages in the database are displayed. Only 10 messages are visible at a time, with the most current (latest time stamp) message displayed first. Use the scroll bar or Page Down key to see earlier messages. By default, the latest 100 messages in the audit log database are acquired at a time.

To acquire the next set of audit log messages for the selected VPN member, click More.

The next 100 messages in the database are displayed. Because only 10 messages are visible at a time, use the scroll bar or Page Down key to see the rest. The More button is grayed out if there are no more audit log messages in the database. The More button does not emulate the screen settings.  Changes made to the audit log controls only take effect after the Acquire button is pressed. Only then does the More button use the current settings.

To change the number of message entries to acquire at any one time, click the up or down arrow in the Phase Entries control box.

The new Phase Entries value will be the number of audit log messages acquired the next time you click Acquire.

To view additional information on a particular message, double-click the message or Details.

This displays an explanation of the message. If the message is an error, it also explains what to do to solve the problem.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Checking Proxy Cache Activity

You can display information about proxy activity.

To check proxy cache activity

1.	Click the server in the Novell Directory Services* (NDS*) tree.

2.	Select Tools > Novell BorderManager.

3.	Select the proxy cache service.

4.	Right-click and select Monitor Realtime Activity.

The proxy cache activity information displays.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Checking Gateway Activity

You can display information about gateway activity.

To check proxy cache activity

1.	Click the server in the Novell Directory Services* (NDS*) tree.

2.	Select Tools > Novell BorderManager.

3.	Select the gateway.

4.	Right-click and select Monitor Realtime Activity.

The gateway activity information displays.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Viewing the Packet Filter Log

The packet filter log is a record of filtering activity.

To view the packet filter log

1.	Click the server in the Novell Directory Services* (NDS*) tree.

2.	Select Tools > Novell BorderManager.

3.	Right-click and select Novell BorderManager > View Packet Filtering Log.

4.	Click Display Records.

5.	Enter a date range, then click OK.

6.	Click a log entry  to view filter data.

The packet filter log information displays.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


BorderManager Status
Novell BorderManager Status

Use this window to view the following general information about each Novell* BorderManager component:

Service Name

Status

Up Time

Version

Hint: Right-click a component to see its monitor, log, and statistics windows.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Services Monitor
Proxy Cache Monitor

This window provides the following information about proxy activity:

Sites Cached ---The number of proxy sites currently in the cache

Bytes Cached---The number of bytes cached on the proxy server.

Bytes Transferred---The number of bytes transferred to the proxy server.

Cache Misses---The number of times the cache was unable to serve a client request.

Cache Hits---The number of times the cache was able to serve a client request.

Hostname---The name of the Web server. The hostname includes the name of the service (HTTP, for example) and the domain name of the server (www.novell.com, for example).

Connection---The number of TCP connections required for a direct connection to the host server. Because Proxy Cache Services has cached the site, this number represents the number of connections the proxy cache has saved clients.

Bytes from Cache---The number of bytes transferred from the cache.

Bytes from Host---The number of bytes transferred from the host to the cache.

Bytes from Neighbors---The number of bytes transferred from the nearest neighbors to the cache.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Novell IP Gateway Monitor

This window provides the following information about the gateway:

Licenses Installed---The number of Novell* IP Gateway licenses currently installed.

Licenses In Use---The number of IP gateway licenses currently in use.

Bytes Received---The number of bytes received on the gateway.

Bytes Sent---The number of bytes sent on the gateway.

Username---The name of the user currently using the IP gateway.

Duration---The duration of the current IP gateway session.

Last Access---The last location to which the associated user was connected.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


VPN Monitor

This window provides the following information about the Virtual Private Network (VPN):

Active Connections---The number of currently active VPN connections.

Packets Sent---The number of encrypted IP and IPX packets sent to all VPN members.

Packets Received---The number of encrypted IP and IPX packets received from all VPN members.

Remote Site---The location and ID of the remote VPN site.

Protocol---The protocol currently being used by the VPN.

Direction---The call direction for the associated VPN member.

Duration---The total amount of time that the VPN tunnel connection has been active.

Encryption Type---The type of data encryption algorithm being used.

Key Size---The data encryption key length in bits.

Key Life Time---The duration of the current data encryption key.

Key Changes---The number of times the data encryption key was changed.

Connection ID---The connection ID for the VPN member.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Services Log: Text Format

This window displays a plain text version of the Proxy Services log, which contains the following information:

Source IP Address---The IP address of the proxy server.

Date and Time---The date and time of the proxy request.

Command---The proxy request.

Target---The target Web server.

Status---The status of the proxy server request.

The proxy server logs this information in SYS:\ETC\COMMON.LOG and SYS:\ETC\EXTENDED.LOG.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Proxy Services Log: Novell Format

This window displays a formatted version of the Proxy Services log.

From, To---The start and stop times for the log interval that you want to view.  Click Display Records to set this interval.

Entry Time---The date and time of the proxy request.

Username---The name of the user making the request.

Command---The proxy request.

Status---The status of the proxy server request.

Protocol---The type of protocol being used.

Host name---The name of the Web server.

Path---The complete pathname of the URL.

Data length---The size of the data sent (in KB).

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Access Control Log

This window provides the following access control information:

From, To---The start and stop times for the log interval that you want to view.  Click Display Records to set this interval.

Entry Time---The time of the access attempt.

Username---The source on your network (username or IP address) that is trying to access the service.

Access---The type of access: allowed or denied.

Protocol---The Internet protocol being accessed at the destination.

Hostname---The DNS name.

Service---The type of service that is allowed or denied:  IP gateway or proxy cache.

Brief Description of Rule---A description of the effective rule.

To see the access control log

1.	Click Display Records.

2.	Enter a date range, then click OK.

3.	Click a log entry to see the associated access rule.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Packet Filter Log

Filter logs provide a record of packet events. Packets that are dropped, denied, routed, and rejected are  recorded to the log file.

To log filter activity, specify the following data parameters:

From, To---The start and stop times for the log interval that you want to view.  Click Display Records to set this interval.

Number of Records---Specifies the number of records found that match the specified time range.  When the number of records limit is reached, the start date must be moved forward.

Entry Time---Indicates the time the packet was recorded to the log file.

Access---Indicates packet activity according to filter rules:  forwarded, discarded, allowed, or denied.

Data Type---Indicates whether the packet is an IP or IPX address type.

Circuit---Applies to IPX address packets only.

Data---A record of information that has been parsed from packet header fields.

Brief Description of Filter---Indicates the reason the packet was logged.

To update the packet filter log

1.	Click Display Records.

2.	Enter a date range, then click OK.

3.	Click a log entry to see the associated packet filter.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Novell IP Gateway Statistics

This window provides the following information about gateway user access:

From, To---The start and stop times for the log interval that you want to view.  Click Display Records to set this interval.

Number of Users---The number of users accessing the gateway for the specified interval.

Username---The name of the user currently using the IP gateway.

Protocol---The protocol being used.

Hostname---The name of the gateway host.

Connections---The number of hits.

Bytes Received---The total number of bytes received on the gateway for all connections.

Bytes Sent---The total number of bytes sent on the gateway for all connections.

To see who has been using the Novell IP Gateway

1. 	Click Display Records.

2. 	Enter a date range, then click OK.

3. 	Click a username to display details on all connections for that user.

* Novell trademark. ** Third-party trademark. Use Search for trademark information.


Information Log

This window provides the following information:

Time and date stamp

Logging level

Informational message about a Novell* BorderManager component status change.


Trademarks, Copyright, and Disclaimer

Copyright © 1996-1997 Novell, Inc.  All rights reserved.  No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.

U.S. Patent Nos. 5,157,663; 5,349,642; and 5,455,932.  U.S. Patent Application No. 5,572,528.  U.S. and International Patents Pending.

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.  Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.  Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes.

Export Notice

This product may not be exported outside of the U.S. or Canada without prior authorization from the U.S. Department of Commerce.

Novell Trademarks

IntranetWare is a trademark of Novell, Inc.

IntranetWare Client is a trademark of Novell, Inc.

Internetwork Packet Exchange and IPX are trademarks of Novell, Inc.

IPX/SPX is a trademark of Novell, Inc.

LANalyzer is a registered trademark of Novell, Inc. in the United States and other countries.

NetWare is a registered trademark of Novell, Inc. in the United States and other countries.

NetWare Loadable Module and NLM are trademarks of Novell, Inc.

NetWare/IP is a trademark of Novell, Inc.

Novell is a registered trademark of Novell, Inc. in the United States and other countries.

Novell Directory Services and NDS are trademarks of Novell, Inc.

Third-Party Trademarks

Cyber Patrol is a registered trademark of Microsystems Software, Inc.

Macintosh is a registered trademark of Apple Computer, Inc.

Microsystems is a registered trademark of Microsystems Software, Inc.

OS/2 is a registered trademark of International Business Machines, Inc.

UNIX is a registered trademark of X/Open Company, Ltd.

Windows is a registered trademark of Microsoft Corporation.

Windows 95 is a trademark of Microsoft Corporation.

Additional Copyright Information

Copyright (c) 1994, 1995 Internet Research Task Force Research Group on Resource Discovery. All rights reserved.

The Harvest software was developed by the Internet Research Task Force Research Group on Resource Discovery (IRTF-RD):

Mic Bowman of Transarc Corporation.

Peter Danzig of the University of Southern California.

Darren R. Hardy of the University of Colorado at Boulder.

Udi Manber of the University of Arizona.

Michael F. Schwartz of the University of Colorado at Boulder.

Duane Wessels of the University of Colorado at Boulder.

This copyright notice applies to software in the Harvest ``src/'' directory only. Users should consult the individual copyright notices in the ``components/'' subdirectories for copyright information about other software bundled with the Harvest source code distribution.

TERMS OF USE

The Harvest software may be used and redistributed without charge, provided that the software origin and research team are cited in any use of the system. Most commonly this is accomplished by including a link to the Harvest Home Page (http://harvest.cs.colorado.edu/) from the query page of any Broker you deploy, as well as in the query result pages. These links are generated automatically by the standard Broker software distribution.

The Harvest software is provided ``as is,” without express or implied warranty, and with no support nor obligation to assist in its use, correction, modification or enhancement. We assume no liability with respect to the infringement of copyrights, trade secrets, or any patents, and are not responsible for consequential damages. Proper use of the Harvest software is entirely the responsibility of the user.

DERIVATIVE WORKS

Users may make derivative works from the Harvest software, subject to the following constraints:

You must include the above copyright notice and these accompanying paragraphs in all forms of derivative works, and any documentation and other materials related to such distribution and use must acknowledge that the software was developed at the above institutions.

You must notify IRTF-RD regarding your distribution of the derivative work.

You must clearly notify users that your are distributing a modified version and not the original Harvest software.

Any derivative product is also subject to these copyright and use restrictions.

Note that the Harvest software is NOT in the public domain. We retain copyright, as specified above.

HISTORY OF FREE SOFTWARE STATUS

Originally we required sites to license the software in cases in which they were going to build commercial products/services around Harvest. In June 1995, we changed this policy. We now allow people to use the core Harvest software (the code found in the Harvest ``src/'' directory) for free. We made this change in the interest of encouraging the widest possible deployment of the technology. The Harvest software is really a reference implementation of a set of protocols and formats, some of which we intend to standardize. We encourage commercial reimplementations of code complying to this set of standards.

April 1997


Service Name

The name of the Novell* BorderManager component (Virtual Private Network, for example).


Status

Whether the component is running on the server. If the component is running, the status is Active; if the component is not running, the status is Inactive.


Up Time

How long the component has been running. This field is empty if the component is inactive.


Version

The release version of the component. This field is empty if the component is inactive.


Sites Cached

The number of Web sites the cache is tracking.


DNS

Domain Name System. A distributed name/address database used on the Internet.


access rule

A prescribed set of elements that, taken together, control the ability of gateway and proxy users on a private network to access computer resources or services on the same network (intranet) or on a public network such as the Internet.

Creating an access rule comprises the following steps:

Choosing the access mode---whether to allow or deny access to an Internet destination or service

Specifying the Novell Directory Services* (NDS*) user or group, Domain Name System (DNS) hostname, public or private IP address, or subnet to which the rule applies

Specifying the Internet destination or service to which you are controlling access

(Optional) If you are allowing access, choosing when to allow---or deny---access

(Optional) Enabling event logging to log attempts to access the destination or service

In sentence form, a typical access rule might read as follows:

Allow host 10.10.30.5 to access the Web site http://www.novell.com/ only on Fridays.


control list

An ordered list of access rules that control access to the Internet and its services. Each access rule, in list order, is applied to each access request. When an access request matches the specifications in a rule, that rule is applied immediately.


Example: HTTPD Common Format

The HTTPD common format looks like this:

10.53.19.1 - - [Wed, 05 Feb 1997 10:47:08 GMT] GET http://home.genericsite.com/ TCP_MISS 32429

10.53.19.1 - - [Wed, 05 Feb 1997 10:47:16 GMT] GET http://www. novell.com/ TCP_MISS 18355

10.53.19.1 - - [Wed, 05 Feb 1997 10:47:18 GMT] GET http://www. novell.com/Pix/logo.gif TCP_MISS 60


Example: Extended Format

The extended format looks like this:

#Version: 1.0

#Fields: cached date time c-ip cs-method cs-uri

0  1997:02:06 00:46:34  GET http://www.brouhaha.com/stuff/homepage10.gif

1  1997:02:06 00:46:37  GET http://www.novell.com/


log level

A number between 0 and 3 that indicates the type of event logged by the server.

0---No information.

1---Internet access information. The server records the user’s fully distinguished Novell Directory Services* (NDS*) name, the access protocol (HTTP, for example), and the destination (www.novell.com, for example).

2---Error codes (NDS errors, for example). Level 2 information can help you determine why a user cannot access a particular service.

3---Debugging information (internal server communications, such as socket calls). Level 3 information is typically of interest only to software developers.

Note:  Each log level is additive; for example, level 1 information is also logged at level 2.


NOVWS.INI file for gateway clients

Here is an example NOVWS.INI file for Novell* IP Gateway clients:

[stack]

gateway=n

ipxGateway=gateway_server_name

ipGateway=gateway_server_name

The gateway parameter indicates which gateway is active (1 enables the IPX/IP gateway; 3 enables the IP/IP gateway). The ipxGateway parameter designates the preferred gateway server for IPX clients. The ipGateway parameter designates the preferred gateway server for IP clients.

Specifying each preferred gateway server enables you to use the same NOVWS.INI file for any gateway client. The setting of the gateway parameter determines which gateway the client uses. Users with workstations that run IPX or IP client software on Windows 3.1 can use the IP Gateway Switcher to select a different gateway. Windows 95 clients use the network settings to specify the gateway server.


DNS hostname

The name of a computer in the TCP/IP (Internet) environment. The hostname corresponds to an IP address. An example of a hostname is myhost.novell.com.


Keep-alive packet

A type of packet sent as an Echo Request to a remote peer. Typically, an Echo Response is sent back to the peer sending the request. A keep-alive packet serves as a continuous link-confidence test at the access interface, sent at a specified time.


Access Rule: Allow a Server to Resolve DNS Hostnames

Suppose you create a rule that allows access to www.novell.com. At the O or OU object that contains the border server, create a rule with the following settings:

Action: Allow

Source: Any

Access Specification:

ProtocolNameserver (The corresponding port number, 53, will appear in the Port field. Allowing outbound access on port 53 enables the border servers to issue a Domain Name System (DNS) query.

DestinationAny, to allow any DNS server to resolve the hostname; or Specified, followed by the names of one or more DNS servers.

Time Constraint: None


unnumbered point-to-point link

An IP network link that does not use an IP address. Internet Service Providers (ISPs) often use unnumbered links to avoid using an entire IP network or subnet address for a single point-to-point connection.


denial of service

A type of network attack by which a single user can render a computer and its services (e-mail, for example) unusable. A malicious user can launch a denial-of-service attack by disabling key software components or by occupying an inordinate amount of CPU time.


multihoming

A configuration method that enables a computer to use several IP addresses on the same network interface. A typical application of multihoming is to enable a single Web server to operate as though it were several Web servers. Any public IP address you configure on the border server can be a multihomed address.