Securepoint Security Systems

Transcription

1 HowTo: VPN with L2TP and the Windows VPN client Securepoint Security Systems Version 2007nx Release 3

2 Contents 1 Configuration of the appliance Setting up network objects Creating firewall rules L2TP basic settings L2TP configuration Configuration with the assistant Configuration using the layer view Setting up users Configuration of the VPN L2TP roadwarriors under Windows Setting up the VPN connection Configure the VPN connection settings

3 VPN with L2TP and the Windows VPN client A VPN connects one or several computers or networks by using a different network, e. g. the internet, as a means of transport. For instance, this could be the computer of a member of staff at their home or in a subsidiary which is linked to the network at the headquarter through the internet. For the user, the VPN looks like a normal network connection to the destination computer. The actual way of transmission is not perceived. The VPN provides the user with a virtual IPconnection which is tunneled by an actual one. The data packages transmitted via this connection are encoded at the client and decoded by the Securepoint servers - and the other way around. Target: Setting up a VPN-L2TP between the Securepoint appliance and a Windows L2TPclient. fig. 1 VPN layer 3

4 1 Configuration of the appliance 1.1 Setting up network objects Proceed as follows: Over Firewall select the tab Network objects. Set up the network objects as shown in the following image. fig. 2 required network objects 4

5 1.2 Creating firewall rules Proceed as follows: Over Firewall select the tab Rules. Create the firewall-rules as shown in the following image. fig. 3 firewall rules 5

6 1.3 L2TP basic settings Proceed as follows: From the main menu VPN select VPN L2TP from the selection list. fig. 4 selecting VPN L2TP The local L2TP-interface should be a free IP-address from the internal net. The L2TP- IP-addresses (L2TP address-pool) are assigned following the L2TP-interface. As authentication method you can select between Radius Server and Active Directory. With this configuration the L2TP-client can communicate with the internal net via proxy-arp function, because it is assigned an IP-address from this net upon dial-in. fig. 5 VPN L2TP - general settings fig. 6 VPN L2TP - NS/WINS settings 6

7 1.4 L2TP configuration This configuration can be conducted in two different methods. Either through a assistant guided configuration or a manual configuration based on a drawing layer Configuration with the assistant Proceed as follows: Click the icon VPN and select the tab VPN connections. Click the icon New. The IPSec Wizard appears. Select Roadwarrior and click Next. fig. 7 IPSec Wizard - step 1 7

8 Select L2TP and click Next. fig. 8 IPSec Wizard - step 2 Insert a name for the connection and select Preshared Key and enter it. Then click Next. fig. 9 IPSec Wizard - step 3 8

9 The assistant advises what you have to do. Complete the assistant configuration by clicking the Finish button. fig. 10 IPSec Wizard - step 4 The new connection is listed in the table in the tab VPN connections as shown in fig. 11. fig. 11 result of the configuration with the IPSec Wizard Check the status of the services. SERVICE_IPSEC and SERVICE_L2TP are required for an L2TP-connection (fig. 20). 9

10 1.4.2 Configuration using the layer view Proceed as follows: Over VPN select the tab VPN connections. With the mouse move the existing firewallobject from the left window onto the VPN viewport. fig. 12 darging the firewall symbol onto the layer 10

11 Now set up a new roadwarrior object in the left window. Click on the Notebook-Symbol on the image bar of the upper window. In the dialog Roadwarrior add the roadwarrior is set up without IP as ( ), because this may vary all the time! Click on L2TP in the roadwarrior dialog in order to activate L2TP. fig. 13 create a roadwarrior object Now move the freshly created roadwarrior object from the left window onto the VPN viewport. fig. 14 draging the roadwarrior symbol onto the layer 11

12 Click on the icon Connect and on the roadwarrior object. A flag appears on the roadwarrior object with the information Please click destination object. Click on the firewall object. fig. 15 create connection between the objects on the layer Now a new dialog opens automatically: IPSec connection - accept Select the authentication method SECRET. In a default case further settings may simply be adopted. fig. 16 tab General of the dialog IPSec connection accept 12

13 Change to the tab firewall.foo.local. Under Local key click on the symbol (...) and enter the local key (Secret). fig. 18 enter the local key fig. 17 tab firewall.foo.local If the client-pc works behind a router (natted), the client-subnet has to be inserted as well. If the entry is to be valid for all kinds of subnets, one has to insert /0. After clicking OK the connection is established. You only have to update the connections by clicking on the icon Update. fig. 19 update the connections 13

14 In the following step check the status of the services. Click on the icon Applications and change to the tab Status of services. SERVICE_IPSEC and SERVICE_L2TP are required for an L2TP connection. fig. 20 checking the status of services 14

15 1.5 Setting up users Proceed as follows: Under Authentication click on the icon New. Set up an L2TP-user with name, login, password etc. fig. 21 adding new L2TP user Change to the tab Group Membership and activate the checkbox VPN L2TP user. Change to the tab VPN options and enter an IP-address out of the local address pool that is allocating to the user when he is connected to the firewall. fig. 22 activating VPN L2TP user fig. 23 allocate IP-address out of local address pool 15

16 2 Configuration of the VPN L2TP roadwarriors under Windows 2.1 Setting up the VPN connection Proceed as follows: First create a standard VPN connection with the network connection assistant. Start the assistant by clicking start Control Panel Network and Internet Connections Network Connections Create a new connection fig. 24 start the assistant fig. 25 select conecttion to a network fig. 26 select VPN connection fig. 27 insert a new for the connection fig. 28 enter IP-address or host name of the firewall connecting to fig. 29 finish assistant and create a shortcut if you want 16

17 HowTo: VPN with L2TP and the Windows VPN client 2.2 Configure the VPN connection settings Proceed as follows: On the dialog Connect name-of-the-connection insert your login name on the firewall and the password. Open the properties of the VPN connection, for further setup steps. Choose in the Properties Security IPSec-Settings. Put the Preshared Key (SECRET) and activate the checkbox to using it. fig. 30 insert connection data and select Properties fig. 32 insert preshared key fig. 31 change to tab Security and click IPSec settings

18 Under the tab Networking adjust the VPN type to L2TP IPSec VPN. In the Properties of the (TCP/IP) Protocol -> Advanced the option Use the default gateway on the remote network may also be selected in addition to that. Now you can start the IPSec-connection. fig. 33 change the VPN type fig. 34 click Advanced... fig. 35 activate the checkbox to use the default gateway 18