Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 39 / 374

Configuring an Identity Server 39
n
ov
do
cx (e
n)
16
Ap
ril 20
10
# Environment-specific variables.
IPT_BIN=/usr/sbin/iptables
INTF=eth0
ADDR=10.10.0.1
6 To ensure that the iptables rule is active after rebooting, start YaST, click System , > System
Services (Runlevel) , select Expert Mode , select the file you created, enable runlevels boot, 3
and 5 for the file, then start the service.
7 To verify that your script is running, enter the following command:
ls /etc/init.d/rc3.d | grep -i AM_IDP_Redirect
8 Reboot the Identity Server machine.
9 After rebooting, verify that port 443 is being routed to the Identity Server by entering the
following command:
iptables -t nat -nvL
You should see an entry similar to the following:
pkts bytes target prot opt in out source
destination
17 748 DNAT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/
0 tcp dpt:443 to:10.10.0.1:8443
This entry states that eth0 is routing TCP port 443 to IP address 10.10.0.1.
10
(Conditional) If your Identity Server cluster configuration contains more than one Identity
Server, repeat these steps on each server in the cluster.
Configuring iptables for Multiple Components
If you need to use iptables for multiple components (the host machine, the Identity Server, or the
SSL VPN server), you need to centralize the commands into one manageable location. The
following sections explain how to use the SuSEFirewall2 option in YaST to centralize the
commands.
The Identity Server and the SSL VPN server use different routing methods, so their commands are
different. The Identity Server requires pre-routing commands, and the SSL VPN server uses post-
routing commands.

“Adding the Identity Server Commands” on page 39
 “Adding the SSL VPN Commands” on page 40
Adding the Identity Server Commands
1 In the Administration Console, click Devices > Identity Server > Edit , and configure the base
URL with HTTPS as the protocol, and the TCP port as 443.
2 Click OK , then update the Identity Server.
3 On the Identity Server, edit the
/etc/sysconfig/SuSEfirewall2
file.
3a Change the FW_CUSTOMRULES="" line to the following:
FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"
3b Save the changes and exit.
4 Open the
/etc/sysconfig/scripts/SuSEfirewall2-custom
file in an editor.
This is the custom rules file you specified in Step 3 .