    SunScreen(TM) 3.1 Lite for the Solaris(TM) Operating Environment
    ----------------------------------------------------------------
					June 2000



CONTENTS
--------

    Product Description
    Documentation Location
    SunScreen 3.1 Lite Installation Overview
    Optional Netscape Java Plugin Installation



Product Description
-------------------

SunScreen 3.1 Lite is a stateful, packet-filtering firewall. 
It has a subset of the features in the full version of
SunScreen 3.1 for the Solaris operating environment. 
SunScreen lite protects individual servers and small work
groups. The full version provides additional capabilities.

A machine running SunScreen 3.1 Lite has the following features 
and limitations:

    * Centralized management: Can be a member of a centralized 
      management group but cannot create and cannot be made the 
      primary Screen in the group.

    * Routing interfaces: Supports only two; others are ignored by 
      the filtering mechanisms.

    * Network address translation (NAT): Supports up to ten 
      individual IP addresses that can be translated and is
      limited to two NAT rules.

The SunScreen 3.1. Lite editor:

    * Enables all data to be displayed but only for supported 
      SunScreen 3.1 Lite types and data fields.

    * Does not support and cannot create the time objects 
      data type; also, does not support and cannot create the 
      ADMIN, HA, or STEALTH interfaces.

SunScreen 3.1 Lite:

    * Cannot be a member of a high availability (HA) cluster.

    * Does not support stealth-mode operation.

    * Ignores the time-of-day field, which makes all rules 
      active while that policy is active.

    * Does not include proxies.

Both SunScreen 3.1 Lite and the full version of SunScreen 3.1 
have the following features: 

    * Remote Screen administration from an Administration
      Station.
	
    * Virtual private network (VPN).

SunScreen 3.1 Lite can be installed as a layered product on
any Solaris host.

You can start the SunScreen 3.1 Lite installation procedure 
using the Solaris Web Start Wizards(TM) installer from the 
File Manager or the command line.

SunScreen 3.1 Lite uses SunScreen SKIP (Simple Key-Management 
for Internet Protocols) for encryption, which is included as 
part of SunScreen 3.1 Lite. Encryption is used to protect 
access and to limit management of a Screen to an authorized 
Administration Station, as well as for VPN and tunneling 
capabilities.

SunScreen 3.1 Lite has been tested and verified to run under 
the Solaris 8 operating environment (OE).



Documentation Location
----------------------

The SunScreen 3.1 Lite documentation is available online in 
Adobe(R) Acrobat Portable Document Format (PDF). PDF files 
require the Adobe Acrobat reader (available free from Adobe).
	
The SunScreen 3.1 Lite README, the PDF files of the SunScreen 
3.1 Lite documentation, as well as any known bug reports are 
located on the web at the following URL:
    http://www.sun.com/software/securenet/



SunScreen 3.1 Lite Installation Overview
----------------------------------------

NOTE:   SunScreen cannot be installed over NFS.  You must
        install it from the CDROM or from local files.

The following procedure describes the default SunScreen 3.1 
Lite installation in which the administration and Screen 
software are installed locally on a single machine, and
which creates a policy named Initial.

NOTE: 	Administration of SunScreen 3.1 Lite can also be 
	done remotely from an Administration Station,  
	which is used to define rules and to administer 
	a remote Screen.

Before installing SunScreen 3.1 Lite, read the SunScreen 3.1 
Lite documentation located on the web at the URL:
    http://www.sun.com/software/securenet/

1. Install Solaris 8 operating environment (OE) on the 
   machine on which you will run SunScreen 3.1 Lite.

2. Gather the information for the SunScreen 3.1 Lite 
   installation as described in Chapter 2 of the "SunScreen 
   3.1 Lite Installation Guide."
   
3. Make a map of your network, including at a minimum:
   
    * Names and IP addresses of all routers, 
      FTP servers, WWW servers, Telnet servers, 
      and application relay servers

    * IP addresses of remote networks

    * Specific services to ALLOW

    * Specific services to DENY
   	
4. Insert the Solaris 8 CD-ROM 2 of 2 into the CD-ROM drive,
   which automatically mounts the CD-ROM and causes File 
   Manager to display the sol_8_sparc_2 directory.

5. Start the Solaris Web Start Wizards installer in one of 
   the following ways:

    * Using File Manager, go to the directory: 
      Solaris_8/EA/products/SunScreen_3.1_Lite/
      and double-click on the installer icon.
   
    * Using the command line, as root, mount the CD-ROM and type: 
# /cdrom/cdrom0/Solaris_8/EA/products/SunScreen_3.1_Lite/installer

   To ensure that your SunScreen 3.1 Lite installation is a 
   success, provide the information for which you are prompted 
   by the Solaris Web Start Wizards installer.
   


Optional Netscape(TM) Java(TM) Plug-in Installation
---------------------------------------------------

The Netscape Java plug-in provided with Solaris 8 is not 
compatible with the SunScreen administration GUI. To save log 
files and load certificates using Netscape 4.5, you must install 
the correct version of the plug-in that is included on the 
Solaris 8 CD-ROM 2 of 2 in the directory: 
/Solaris_8/EA/products/SunScreen_3.1_Lite/javaplugins.
Or, you can use the HotJava(TM) browser that is bundled with 
SunScreen 3.1 Lite.

In this procedure, the Java plug-in 1.1.2 is installed, 
the identitydb.obj file is saved, and the NPX_PLUGIN_PATH 
environment variable is set.

1. Ensure that the Solaris 8 CD-ROM 2 of 2 that contains the
   SunScreen 3.1 Lite is inserted into the CD-ROM drive.

2. Install the Java plug-in by typing:
   	 
    % cd /cdrom/cdrom0/Solaris_8/EA/products/SunScreen_3.1_Lite
      /javaplugins
    % cp plugin-112i-solsparc.sh /tmp 
    % cd /tmp 
    % sh plugin-112i-solsparc.sh
 
3. Save the identitydb.obj file by typing:

    % cd /opt/SUNWicg/SunScreen/admin/htdocs/plugin/plugins/
    % cp identitydb.obj $HOME
    % cd

4. Set the environment variable if using sh or ksh by typing:

    $ NPX_PLUGIN_PATH=$HOME/.netscape/plugins:$NPX_PLUGIN_PATH
    $ export NPX_PLUGIN_PATH

   or if using csh:

    % setenv NPX_PLUGIN_PATH $HOME/.netscape/plugins:$NPX_PLUGIN_PATH

5. Run the Netscape Navigator(TM) browser and use the URL for 
   the plug-in version of the GUI:

    % netscape http://localhost:3852/plugin &
