Nortel Contivity 1050, Configuration Manual

Page: 77 / 178

Chapter 4 Configuring user tunnels 77
Nortel VPN Router Configuration — Basic Features
For example, \Base is the base group, Research and Development and Finance are
child groups of the base group, and they are parent groups to groups below them.
Groups are collections of users with the same access attributes and rights. If all
users have identical characteristics, then only one group is necessary. You create
multiple groups when you need different attributes. A Lightweight Directory
Access Protocol (LDAP) database stores users, groups, and their attributes. You
can store this database internally (on the Nortel VPN Router's hard disk) or
externally (on a network host running LDAP server software).
The Nortel VPN Router authenticates each user that tries to connect to the Nortel
VPN Router by checking the user ID and password against a database. The Nortel
VPN Router supports both LDAP and Remote Access Dial-In User Session
(RADIUS) databases for authentication. When using LDAP for authentication, the
user is always assigned to a group since LDAP also contains the user, group, and
attribute information.
When authenticating a Point-to-Point Tunneling Protocol (PPTP) client against a
RADIUS database, the group for a user requesting a session can be returned from
the RADIUS server as a RADIUS class attribute.
When authenticating an IPsec client, the remote user is by default assigned to the
group ID. If the group ID and group password are correct, the Nortel VPN Router
passes the user ID and password (or token card) to the RADIUS server for
authentication.
You define a set of group attributes and give it a name. This group name is known
as the Relative Distinguished Name and it is added to the LDAP database name
when performing the database lookup.
Note: The group name Certificates is not allowed as a valid group name
when created under the /Base directory. If you change the name to
Certificate, the group is created properly. If you create the group
Certificates in a /Base subdirectory, it is created properly.