Nortel Contivity VPN Client, Руководство пользователя

Страница: 73 / 90

Chapter 3 Using certificates 73
Configuring the Contivity VPN Client
Entrust certificate enrollment procedure
There are three possible situations in which remote users can access an Entrust
PKI server to obtain a certificate for tunnel authentication:
• An external PKI server accessible from the Internet (directly accessible).
• A PKI server located behind the firewall, but in front of the Contivity
gateway. The firewall must be set to allow ports 389 and 709 to access the
PKI (directly accessible).
• A PKI server located behind the firewall and the Contivity gateway ( not
directly accessible).
The first two situations are similar because the PKI server is located in front of the
Contivity gateway and it is directly accessible from the Internet. When you
provide access to the PKI through the firewall from ports 389 and 709, the second
situation is the same as the first. The third situation requires remote users to also
have an LDAP user name and password so that a temporary tunnel can be
established to get access to the PKI.
Figure 26 shows the Entrust PKI server placed in each of these three places.
Figure 26 An Entrust PKI server can be located in three places
Note:
The Entrust tool kit settings determine the protocol and port
number used for certificate enrollment. See your Entrust documentation
for information about the ports that need to be open on your firewall.