DOCSLIB.ORG

CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.8 Americas Headquarters Cisco Systems, Inc

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.8 Americas Headquarters Cisco Systems, Inc CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.8 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version. Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R) © 2021 Cisco Systems, Inc. All rights reserved. CONTENTS PREFACE About This Guide xix Document Objectives xix Related Documentation xix Document Conventions xix Communications, Services, and Additional Information xxi PART I Site-to-Site and Client VPN 23 CHAPTER 1 IPsec and ISAKMP 1 About Tunneling, IPsec, and ISAKMP 1 IPsec Overview 2 ISAKMP and IKE Overview 2 Licensing for IPsec VPNs 3 Guidelines for IPsec VPNs 4 Configure ISAKMP 4 Configure IKEv1 and IKEv2 Policies 4 IKE Policy Keywords and Values 6 Enable IKE on the Outside Interface 9 Disable IKEv1 Aggressive Mode 10 Configure an ID Method for IKEv1 and IKEv2 ISAKMP Peers 10 INVALID_SELECTORS Notification 11 Configure IKEv2 Pre-shared Key in Hex 11 Enable or Disable Sending of IKE Notification 11 Configure IKEv2 Fragmentation Options 12 AAA Authentication With Authorization 13 Enable IPsec over NAT-T 13 CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.8 iii Contents Enable IPsec with IKEv1 over TCP 15 Configure Certificate Group Matching for IKEv1 16 Configure IPsec 18 Define Crypto Maps 18 Example of LAN-to-LAN Crypto Maps 21 Set Public Key Infrastructure (PKI) Keys 26 Apply Crypto Maps to Interfaces 27 Use Interface ACLs 27 Change IPsec SA Lifetimes 29 Change VPN Routing 30 Create Static Crypto Maps 30 Create Dynamic Crypto Maps 35 Provide Site-to-Site Redundancy 38 Managing IPsec VPNs 38 Viewing an IPsec Configuration 38 Wait for Active Sessions to Terminate Before Rebooting 39 Alert Peers Before Disconnecting 39 Clear Security Associations 39 Clear Crypto Map Configurations 40 CHAPTER 2 L2TP over IPsec 41 About L2TP over IPsec/IKEv1 VPN 41 IPsec Transport and Tunnel Modes 42 Licensing Requirements for L2TP over IPsec 43 Prerequisites for Configuring L2TP over IPsec 43 Guidelines and Limitations 43 Configuring L2TP over Eclipse with CLI 45 Creating IKE Policies to Respond to Windows 7 Proposals 48 Configuration Example for L2TP over IPsec 49 Feature History for L2TP over IPsec 50 CHAPTER 3 High Availability Options 51 High Availability Options 51 VPN Load Balancing 51 CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.8 iv Contents Failover 51 VPN Load Balancing 52 About VPN Load Balancing 52 VPN Load-Balancing Algorithm 52 VPN Load-Balancing Group Configurations 53 Frequently Asked Questions About VPN Load Balancing 53 Licensing for VPN Load Balancing 54 Prerequisites for VPN Load Balancing 55 Guidelines and Limitations for VPN Load Balancing 55 Configuring VPN Load Balancing 57 Configure the Public and Private Interfaces for VPN Load Balancing 57 Configure the VPN Load Balancing Group Attributes 58 Configuration Examples for VPN Load Balancing 60 Viewing VPN Load Balancing Information 61 CHAPTER 4 General VPN Parameters 63 Guidelines and Limitations 63 Configure IPsec to Bypass ACLs 64 Permitting Intra-Interface Traffic (Hairpinning) 64 NAT Considerations for Intra-Interface Traffic 65 Setting Maximum Active IPsec or SSL VPN Sessions 66 Use Client Update to Ensure Acceptable IPsec Client Revision Levels 66 Implement NAT-Assigned IP to Public IP Connection 68 Displaying VPN NAT Policies 69 Configure VPN Session Limits 70 Show License Resource Allocation 70 Show License Resource Usage 71 Limit VPN Sessions 71 Using an Identify Certificate When Negotiating 71 Configure the Pool of Cryptographic Cores 72 Configure Dynamic Split Tunneling 72 Viewing Active VPN Sessions 73 Viewing Active AnyConnect Sessions by IP Address Type 73 Viewing Active Clientless SSL VPN Sessions by IP Address Type 74 CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.8 v Contents Viewing Active LAN to LAN VPN Sessions by IP Address Type 75 About ISE Policy Enforcement 75 Configure RADIUS Server Groups for ISE Policy Enforcement 76 Example Configurations for ISE Policy Enforcement 79 Troubleshooting Policy Enforcement 79 Configure Advanced SSL Settings 80 Persistent IPsec Tunneled Flows 84 Configure Persistent IPsec Tunneled Flows Using CLI 85 Troubleshooting Persistent IPsec Tunneled Flows 86 Is the Persistent IPsec Tunneled Flows Feature Enabled? 86 Locating Orphaned Flows 87 CHAPTER 5 Connection Profiles, Group Policies, and Users 89 Overview of Connection Profiles, Group Policies, and Users 89 Connection Profiles 90 General Connection Profile Connection Parameters 91 IPsec Tunnel-Group Connection Parameters 92 Connection Profile Connection Parameters for SSL VPN Sessions 93 Configure Connection Profiles 94 Maximum Connection Profiles 95 Default IPsec Remote Access Connection Profile Configuration 95 IPsec Tunnel-Group General Attributes 96 Configure Remote-Access Connection Profiles 96 Specify a Name and Type for the Remote Access Connection Profile 97 Configure Remote-Access Connection Profile General Attributes 97 Configure Double Authentication 101 Configure Remote-Access Connection Profile IPsec IKEv1 Attributes 103 Configure IPsec Remote-Access Connection Profile PPP Attributes 105 Configure LAN-to-LAN Connection Profiles 107 Default LAN-to-LAN Connection Profile Configuration 107 Specify a Name and Type for a LAN-to-LAN Connection Profile 107 Configure LAN-to-LAN Connection Profile General Attributes 108 Configure LAN-to-LAN IPsec IKEv1 Attributes 108 Configure Connection Profiles for Clientless SSL VPN Sessions 111 CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.8 vi Contents Configure General Tunnel-Group Attributes for Clientless SSL VPN Sessions 111 Configure Tunnel-Group Attributes for Clientless SSL VPN Sessions 114 Customize Login Windows for Users of Clientless SSL VPN Sessions 119 About Tunnel Groups for Standards-based IKEv2 Clients 120 Standards-based IKEv2 Attribute Support 121 DAP Support 121 Tunnel Group Selection for Remote Access Clients 121 Authentication Support for Standards-based IKEv2 Clients 122 Add Multiple Certificate Authentication 123 Configure the query-identity Option for Retrieval of EAP Identity 124 Configure Microsoft Active Directory Settings for Password Management 126 Use Active Directory to Force the User to Change Password at Next Logon 126 Use Active Directory to Specify Maximum Password Age 126 Use Active Directory to Enforce Minimum Password Length 127 Use Active Directory to Enforce Password Complexity 127 Configure the Connection Profile for RADIUS/SDI Message Support for the AnyConnect Client 128 Configure the Security Appliance to Support RADIUS/SDI Messages 128 Group Policies 130 Modify the Default Group Policy 130 Configure Group Policies 133 Configure an External Group Policy 133 Create an Internal Group Policy 134 Configure General Internal Group Policy Attributes
Load more

Recommended publications
  • Application Profile Avi Networks — Technical Reference (16.3)
    Page 1 of 12 Application Profile Avi Networks — Technical Reference (16.3) Application Profile view online Application profiles determine the behavior of virtual services, based on application type. The application profile types and their options are described in the following sections: HTTP Profile DNS Profile Layer 4 Profile Syslog Profile Dependency on TCP/UDP Profile The application profile associated with a virtual service may have a dependency on an underlying TCP/UDP profile. For example, an HTTP application profile may be used only if the TCP/UDP profile type used by the virtual service is set to type TCP Proxy. The application profile associated with a virtual service instructs the Service Engine (SE) to proxy the service's application protocol, such as HTTP, and to perform functionality appropriate for that protocol. Application Profile Tab Select Templates > Profiles > Applications to open the Application Profiles tab, which includes the following functions: Search: Search against the name of the profile. Create: Opens the Create Application Profile popup. Edit: Opens the Edit Application Profile popup. Delete: Removes an application profile if it is not currently assigned to a virtual service.Note: If the profile is still associated with any virtual services, the profile cannot be removed. In this case, an error message lists the virtual service that still is referencing the application profile. The table on this tab provides the following information for each application profile: Name: Name of the Profile. Type: Type of application profile, which will be either: DNS: Default for processing DNS traffic. HTTP: Default for processing Layer 7 HTTP traffic.
    [Show full text]
  • SSL/TLS Implementation CIO-IT Security-14-69
    DocuSign Envelope ID: BE043513-5C38-4412-A2D5-93679CF7A69A IT Security Procedural Guide: SSL/TLS Implementation CIO-IT Security-14-69 Revision 6 April 6, 2021 Office of the Chief Information Security Officer DocuSign Envelope ID: BE043513-5C38-4412-A2D5-93679CF7A69A CIO-IT Security-14-69, Revision 6 SSL/TLS Implementation VERSION HISTORY/CHANGE RECORD Person Page Change Posting Change Reason for Change Number of Number Change Change Initial Version – December 24, 2014 N/A ISE New guide created Revision 1 – March 15, 2016 1 Salamon Administrative updates to Clarify relationship between this 2-4 align/reference to the current guide and CIO-IT Security-09-43 version of the GSA IT Security Policy and to CIO-IT Security-09-43, IT Security Procedural Guide: Key Management 2 Berlas / Updated recommendation for Clarification of requirements 7 Salamon obtaining and using certificates 3 Salamon Integrated with OMB M-15-13 and New OMB Policy 9 related TLS implementation guidance 4 Berlas / Updates to clarify TLS protocol Clarification of guidance 11-12 Salamon recommendations 5 Berlas / Updated based on stakeholder Stakeholder review / input Throughout Salamon review / input 6 Klemens/ Formatting, editing, review revisions Update to current format and Throughout Cozart- style Ramos Revision 2 – October 11, 2016 1 Berlas / Allow use of TLS 1.0 for certain Clarification of guidance Throughout Salamon server through June 2018 Revision 3 – April 30, 2018 1 Berlas / Remove RSA ciphers from approved ROBOT vulnerability affected 4-6 Salamon cipher stack
    [Show full text]
  • Protecting Encrypted Cookies from Compression Side-Channel Attacks
    Protecting encrypted cookies from compression side-channel attacks Janaka Alawatugoda1, Douglas Stebila1;2, and Colin Boyd3 1 School of Electrical Engineering and Computer Science, 2 School of Mathematical Sciences 1;2 Queensland University of Technology, Brisbane, Australia [email protected],[email protected] 3 Department of Telematics, Norwegian University of Science and Technology, Trondheim, Norway [email protected] December 28, 2014 Abstract Compression is desirable for network applications as it saves bandwidth; however, when data is compressed before being encrypted, the amount of compression leaks information about the amount of redundancy in the plaintext. This side channel has led to successful CRIME and BREACH attacks on web traffic protected by the Transport Layer Security (TLS) protocol. The general guidance in light of these attacks has been to disable compression, preserving confidentiality but sacrificing bandwidth. In this paper, we examine two techniques|heuristic separation of secrets and fixed-dictionary compression|for enabling compression while protecting high-value secrets, such as cookies, from attack. We model the security offered by these techniques and report on the amount of compressibility that they can achieve. 1This is the full version of a paper published in the Proceedings of the 19th International Conference on Financial Cryptography and Data Security (FC 2015) in San Juan, Puerto Rico, USA, January 26{30, 2015, organized by the International Financial Cryptography Association in cooperation with IACR. 1 Contents 1 Introduction 3 2 Definitions 6 2.1 Encryption and compression schemes.........................6 2.2 Existing security notions................................7 2.3 New security notions..................................7 2.4 Relations and separations between security notions.................8 3 Technique 1: Separating secrets from user inputs9 3.1 The scheme.......................................9 3.2 CCI security of basic separating-secrets technique.................
    [Show full text]
  • A Comprehensive Study of the BREACH A8ack Against HTTPS
    A Comprehensive Study of the BREACH A8ack Against HTTPS Esam Alzahrani, JusCn Nonaka, and Thai Truong 12/03/13 BREACH Overview Browser Reconnaissance and Exfiltraon via AdapCve Compression of Hypertext Demonstrated at BlackHat 2013 by Angelo Prado, Neal Harris, and Yoel Gluck • Chosen plaintext aack against HTTP compression • Client requests a webpage, the web server’s response is compressed • The HTTP compression may leak informaon that will reveal encrypted secrets about the user Network Intrusion DetecCon System Edge Firewall Switch Router DMZ Clients A8acker (Vicm) 2 BREACH Requirements Requirements for chosen plain text (side channel) aack • The web server should support HTTP compression • The web server should support HTTPS sessions • The web server reflects the user’s request • The reflected response must be in the HTML Body • The aacker must be able to measure the size of the encrypted response • The aacker can force the vicCm’s computer to send HTTP requests • The HTTP response contains secret informaon that is encrypted § Cross Site Request Forgery token – browser redirecCon § SessionID (uniquely idenCfies HTTP session) § VIEWSTATE (handles mulCple requests to the same ASP, usually hidden base64 encoded) § Oath tokens (Open AuthenCcaon - one Cme password) § Email address, Date of Birth, etc (PII) SSL/TLS protocol structure • X.509 cerCficaon authority • Secure Socket Layer (SSL) • Transport Layer Security (TLS) • Asymmetric cryptography for authenCcaon – IniCalize on OSI layer 5 (Session Layer) – Use server public key to encrypt pre-master
    [Show full text]
  • A Perfect CRIME?
    AA PerfectPerfect CRIME?CRIME? OnlyOnly TIMETIME WillWill TellTell Tal Be'ery, Amichai Shulman i ii Table of Contents 1. Abstract ................................................................................................................ 4 2. Introduction to HTTP Compression ................................................................. 5 2.1 HTTP compression and the web .............................................................................................. 5 2.2 GZIP ........................................................................................................................................ 6 2.2.1 LZ77 ................................................................................................................................ 6 2.2.2 Huffman coding ............................................................................................................... 6 3. CRIME attack ..................................................................................................... 8 3.1 Compression data leaks ........................................................................................................... 8 3.2 Attack outline ........................................................................................................................... 8 3.3 Attack example ........................................................................................................................ 9 4. Extending CRIME ............................................................................................
    [Show full text]
  • Randomized Lempel-Ziv Compression for Anti-Compression Side-Channel Attacks
    Randomized Lempel-Ziv Compression for Anti-Compression Side-Channel Attacks by Meng Yang A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master of Applied Science in Electrical and Computer Engineering Waterloo, Ontario, Canada, 2018 c Meng Yang 2018 I hereby declare that I am the sole author of this thesis. This is a true copy of the thesis, including any required final revisions, as accepted by my examiners. I understand that my thesis may be made electronically available to the public. ii Abstract Security experts confront new attacks on TLS/SSL every year. Ever since the compres- sion side-channel attacks CRIME and BREACH were presented during security conferences in 2012 and 2013, online users connecting to HTTP servers that run TLS version 1.2 are susceptible of being impersonated. We set up three Randomized Lempel-Ziv Models, which are built on Lempel-Ziv77, to confront this attack. Our three models change the determin- istic characteristic of the compression algorithm: each compression with the same input gives output of different lengths. We implemented SSL/TLS protocol and the Lempel- Ziv77 compression algorithm, and used them as a base for our simulations of compression side-channel attack. After performing the simulations, all three models successfully pre- vented the attack. However, we demonstrate that our randomized models can still be broken by a stronger version of compression side-channel attack that we created. But this latter attack has a greater time complexity and is easily detectable. Finally, from the results, we conclude that our models couldn't compress as well as Lempel-Ziv77, but they can be used against compression side-channel attacks.
    [Show full text]
  • Categorizing Efficient XML Compression Schemes
    John N. Dyer Categorizing Efficient XML Compression Schemes John N. Dyer, Department of Information Systems, College of Business Administration, Georgia Southern University, P.O. Box 7998, Statesboro, GA 30459 Abstract Web services are Extensible Markup Language (XML) applications mapped to programs, objects, databases, and comprehensive business functions. In essence, Web services transform XML documents into and out of information technology systems. As more businesses turn to web services data transfer, XML has become the language of web services. Unfortunately, the structure of XML results in extremely verbose documents, often 3 times larger than ordinary content files. As XML becomes more common through Web services applications, its large file sizes increasingly burden the systems that must utilize it. This paper provides a qualitative overview of existing and proposed schemes for efficient XML compression, proposes three categories for relating XML compression scheme efficiency for Web services, and makes recommendations relating to efficient XML compression based on the proposed categories of XML documents. The goal of this paper is to aid the practitioner and Web services manager in understanding the impact of XML document size on Web services, and to aid them in selecting the most appropriate schemes for applications of XML compression for Web services. Keywords: Compression, Web services, XML Introduction XML is the foundation upon which Web services are built, and provides the description of data, as well as the storage and transmission format of data exchanged via Web services (Newcomer, 2002). XML is similar to Hypertext Markup Language (HTML), and well-formed XML documents can even be displayed in Web browsers.
    [Show full text]
  • Session Overhead Reduction in Adaptive Streaming
    Session Overhead Reduction in Adaptive Streaming A Technical Paper prepared for SCTE•ISBE by Alexander Giladi Fellow Comcast 1899 Wynkoop St., Denver CO +1 (215) 581-7118 [email protected] © 2020 SCTE•ISBE and NCTA. All rights reserved. 1 Table of Contents Title Page Number 1. Introduction .......................................................................................................................................... 3 2. Session overhead and HTTP compression ........................................................................................ 4 3. Reducing traffic overhead ................................................................................................................... 5 3.1. MPD patch .............................................................................................................................. 6 3.2. Segment Gap Signaling ......................................................................................................... 7 3.3. Efficient multi-DRM signaling ................................................................................................. 8 4. Reducing the number of HTTP requests ............................................................................................ 9 4.1. Asynchronous MPD updates.................................................................................................. 9 4.2. Predictive templates ............................................................................................................. 10 4.3. Timeline extension ..............................................................................................................
    [Show full text]
  • Protecting Encrypted Cookies from Compression Side-Channel Attacks Douglas Stebila
    Protecting encrypted cookies from compression side-channel attacks Douglas Stebila Joint work with Janaka Alawatugoda (QUT) and Colin Boyd (NTNU) Supported by ARC Discovery Project DP130104304. Financial Crypto 2015 • IACR eprint 2014/724 Royal Holloway, University of London • January 22, 2015 Royal Holloway • 2015/01/22 Protecting encrypted cookies from compression side-channel attacks • Stebila 2 Introduction Encryption and compression Royal Holloway • 2015/01/22 Protecting encrypted cookies from compression side-channel attacks • Stebila 3 Symmetric key encryption A symmetric key Main security goal: encryption scheme • indistinguishability is a triple of algorithms: Attacker cannot tell apart • KeyGen() –> k encryptions of two messages • Enck(m) –> c of the same length: • Deck(c) –> m Enck(m0) looks like Enck(m1) KeyGen and Enc when |m0|=|m1| can be probabilistic Royal Holloway • 2015/01/22 Protecting encrypted cookies from compression side-channel attacks • Stebila 4 Symmetric key encryption I voted for Bush. Enck 8jv0cKErN3aafBc6i len = 17 I voted for Gore. Enck WpmuUzU581bgOvMLZ len = 17 same length input => same length output Royal Holloway • 2015/01/22 Protecting encrypted cookies from compression side-channel attacks • Stebila 5 Compression A compression Main security goal: scheme is a pair of • none algorithms: • Comp(m) –> o Main functionality goal: • Decomp(o) –> m • |Comp(m)| << |m| for common distribution of m Comp may be • Can’t be true for all m due probabilistic (but to Shannon’s theorem usually isn’t) Royal Holloway •
    [Show full text]
  • Publication 5258, Affordable Care Act (ACA) Information Returns (AIR)
    Publication 5258 Affordable Care Act (ACA) Information Returns (AIR) Submission Composition and Reference Guide Processing Year 2021 Publication 5258 (Rev. 11-2020) Catalog Number 69127G Department of the Treasury Internal Revenue Service www.irs.gov Last updated 1/12/2020 Change/Document History It will be assured that this document is current. Printed documents and locally copied files may become obsolete due to changes to the master document. Date Summary of Changes Changes Marked 9/10/2020 Updated Table 5-2 -- update No Indentrust ACES information 9/10/2020 Updated Figure 5-3 No 9/10/2020 Updated Table 12-1 information for No TPE1101, 1122 and 1123,1131, 1133 9/22/2020 Updated text in section 6.5.5 No 9/22/2020 Renumbered Table 7.8 No 9/22/2020 Updated Table 7.10 with new element No Age of Employee (AgeNum) 9/22/2020 Updated Table 7.10 with new element No Plan Start Month. 9/22/2020 Updated Table 7.10 added offer of No coverage codes 1K 1L 1M 1N 10 1P 1Q 1R 1S 1T 1U 1V 1W 1X 1Y 1Z 9/22/2020 Updated Table 7.10 added Employee No Share of Lowest Cost Monthly Premium, for Self-Only Minimum Value Coverage codes 1K 1L 1M 1N 10 1P 1Q 9/22/2020 Updated Table 7.10 ICHRA – Individual No Coverage Health Reimbursement Agreement 1/12/2021 Added Change/Document History table No Table of Contents 1 Introduction ............................................................................................................................................. 1 1.1 Identification ............................................................................................................................... 1 1.2 Scope ......................................................................................................................................... 1 1.3 Purpose ...................................................................................................................................... 2 1.4 Document Organization ............................................................................................................
    [Show full text]
  • Advanced Authentication
    Administration Guide Advanced Authentication Version 5.5 Legal Notice For information about legal notices, trademarks, disclaimers, warranties, export and other use restrictions, U.S. Government rights, patent policy, and FIPS compliance, https://www.netiq.com/company/legal/. Copyright © 2016 NetIQ Corporation, a Micro Focus company. All Rights Reserved. Contents About NetIQ Corporation 7 About this Book 9 1 Advanced Authentication Overview 11 1.1 How Is Advanced Authentication Better Than Other Solutions . 11 1.2 Key Features . 11 1.3 Advanced Authentication Server Components. 12 1.3.1 Administration Portal . 12 1.3.2 Self-Service Portal . 13 1.3.3 Helpdesk Portal . 13 1.3.4 Reporting Portal. 13 1.4 Architecture . 14 1.4.1 Basic Architecture . 14 1.4.2 Enterprise Level Architecture. .15 1.4.3 Enterprise Architecture With A Load Balancer . 17 1.5 Terminologies . 18 1.5.1 Authentication Method . 18 1.5.2 Authentication Chain . 18 1.5.3 Authentication Event . 18 1.5.4 Endpoint. 18 1.5.5 Tenant . 18 Part I Installing and Upgrading Advanced Authentication 19 2 System Requirements 21 3 Installing Advanced Authentication 23 4 Upgrading Advanced Authentication 25 Part II Configuring Advanced Authentication 27 5 Configuring the Basic Settings 29 5.1 Configuring Host Name . 29 5.2 Configuring HTTP Proxy Server. 30 5.3 Configuring Appliance Networking . 30 5.4 Configuring Time and NTP Servers . 30 5.5 Rebooting Appliance . 30 5.6 Shutting Down Appliance . 31 6 Configuring Global Master Server 33 6.1 Configuring YubiHSM. 33 Contents 3 7 Logging In to the Advanced Authentication Administrative Portal 35 8 Configuring Advanced Authentication Server Appliance 37 8.1 Adding a Tenant .
    [Show full text]
  • XML Document Management (XDM) Specification Historic Version 1.0.1 – 28 Nov 2006
    XML Document Management (XDM) Specification Historic Version 1.0.1 – 28 Nov 2006 Open Mobile Alliance OMA-TS-XDM_Core-V1_0_1-20061128-H 2006 Open Mobile Alliance Ltd. All Rights Reserved. Used with the permission of the Open Mobile Alliance Ltd. under the terms as stated in this document. [OMA-Template-Spec-20050101-I] OMA-TS-XDM_Core-V1_0_1-20061128-H Page 2 (47) Use of this document is subject to all of the terms and conditions of the Use Agreement located at http://www.openmobilealliance.org/UseAgreement.html. Unless this document is clearly designated as an approved specification, this document is a work in process, is not an approved Open Mobile Alliance™ specification, and is subject to revision or removal without notice. You may use this document or any part of the document for internal or educational purposes only, provided you do not modify, edit or take out of context the information in this document in any manner. Information contained in this document may be used, at your sole risk, for any purposes. You may not use this document in any other manner without the prior written permission of the Open Mobile Alliance. The Open Mobile Alliance authorizes you to copy this document, provided that you retain all copyright and other proprietary notices contained in the original materials on any copies of the materials and that you comply strictly with these terms. This copyright permission does not constitute an endorsement of the products or services. The Open Mobile Alliance assumes no responsibility for errors or omissions in this document. Each Open Mobile Alliance member has agreed to use reasonable endeavors to inform the Open Mobile Alliance in a timely manner of Essential IPR as it becomes aware that the Essential IPR is related to the prepared or published specification.
    [Show full text]