Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 231 / 1016

Setting Up NSM to Work With Infranet Controller and Infranet Enforcer
A ScreenOS firewall that is managed by NSM can also be configured as an Infranet
Enforcer in a UAC solution.
The Infranet Controller specifies an authorization server $infranet for each Infranet
Enforcer in its list. This name is required for correct operation between the Infranet
Controller and the Infranet Enforcer. Conversely, if NSM has multiple Infranet Enforcers
in its global domain, it will distinguish among them by renaming additional Infranet
Enforcers $infranet_1, $infranet_2, and so on. To resolve this naming conflict, you must
move each Infranet Controller to a separate NSM domain.
In addition, because the Infranet Controller regularly changes its NACN password with
the Infranet Enforcer, you should always import the Infranet Enforcer into NSM before
performing a device update to it.
The following procedures prevent these conflicts between NSM and the Infranet
Controller:
•
Avoiding Naming Conflicts of the Authorization Server Object on page 181
• Avoiding NACN Password Conflicts on page 183
Avoiding Naming Conflicts of the Authorization Server Object
To avoid naming conflicts with the authorization server objects, follow these steps:
1.
On the Infranet Controller, create the Infranet Enforcer instances:
a.
On the Infranet Controller, select UAC -> Infranet Enforcer -> Connection .
b.
Click New Enforcer .
c.
Fill out the information requested in the display.
Enter an NACN password. Remember it because you will need to use it again
while setting up the Infranet Enforcer. If you are setting up a cluster instead of
a single device, enter all the serial numbers in the cluster, one per line.
d.
Click Save Changes .
e.
Repeat Steps b through d until all of your Infranet Enforcers have been entered.
2.
If you do not have one already, create a CA certificate for each Infranet Enforcer.
a.
Create a certificate signing request (CSR) for an Infranet Controller server
certificate, and use the CA certificate to sign the server certificate.
b.
Import the server certificate into the Infranet Controller.
c.
Import the CA certificate into the Infranet Enforcer.
181 Copyright © 2010, Juniper Networks, Inc.
Chapter 4: Adding Devices