Configuring SSH Sentinel Internet Pilot VPN Client to establish a Road-Warrior VPN tunnel with a Merilus Gateway Guardian or FireCard product

Transcription

1 Configuring SSH Sentinel Internet Pilot VPN Client to establish a Road-Warrior VPN tunnel with a Merilus Gateway Guardian or FireCard product Date: February 11, 2002 Version: 1.3 Copyright 2002, Merilus, Inc. All Rights Reserved, Worldwide. Introduction The purpose of this document is to describe the process of connecting an SSH Sentinel Internet Pilot Client to Gateway Guardian or FireCard products using a Road-Warrior IPSec Virtual Private Network (VPN). Sample Network To configure the SSH Sentinel Internet Pilot to establish a VPN tunnel with the Gateway Guardian or FireCard we will use the following diagram as a sample network. When a configuration step refers to an IP address or subnet mask pertaining to this sample network, be sure to substitute the IP address information appropriate for your network. For this network we will use as an external public IP address for the Merilus Firewall connected to the Internet, along with an internal private IP address of and an internal network of with a netmask of (refer to Figure 1 Sample Network). Please Note: All IP s used in this document are randomly chosen and do not pertain to a particular setup. You will have to replace the IP s used in this document with your own. Sentinel Host Gateway Guardian or FireCard Internal LAN Internet External IP: Internal IP: [Figure 1 Sample Network]

2 Configuring Inferno for Gateway Guardian or FireCard It is assumed that Gateway Guardian or FireCard is already configured and running as your Internet firewall and protecting your internal private network. This is also assuming that the Inferno configuration tool is installed and able to communicate with Gateway Guardian or FireCard. To configure Inferno for Gateway Guardian or FireCard as a Road Warrior VPN Server, perform the following (refer to Figure 2 Inferno Configuration): 1. Start Inferno and open the device you are going to configure as the Road Warrior VPN Server. 2. Select the VPN node of the device. 3. Click on the IPSec VPN Setup tab. If you are using Gateway Guardian VPN Edition or FireCard, skip to Step If you are using Gateway Guardian Enterprise Edition, or FireCard Plus or EXT, click on the Add button and a Tunnel Creation dialogue will be displayed. 5. Select Road-warrior Server from the Local VPN Tunnel Type dropdown. 6. Enter a name for your VPN tunnel in the Tunnel Name field. This will help distinguish different VPN tunnels. Please Note: The tunnel name cannot contain spaces, and must not start with a number. 7. In the Shared Secret field, enter a shared password that matches the password on the VPN Client (SSH Sentinel Internet Pilot). The shared secret must match exactly on both sides of the VPN connection, or the session will be aborted. 8. If you are using Gateway Guardian Enterprise Edition, or FireCard Plus or EXT, click on the Add button. 9. Click on the device in the left tree that you just configured, right-click and save your changes. 10. Right-click on the device again, update your settings to the device and restart it for the changes to take affect. Please Note: For more information on configuring Inferno for VPN, refer to the VPN section of the Inferno Administration Guide.

3 [Figure 2 Inferno Configuration] Configuring the SSH Sentinel Internet Pilot VPN Client To configure the SSH Sentinel Internet Pilot VPN Client for Road-Warrior VPN, perform the following: 1. Download the SSH Sentinel Internet Pilot from on the machine that you wish to be the remote road-warrior device and start the installation. 2. Follow the on-screen directions until you get to the Authentication Key Information screen. From the Select Primary Identifier drop-down select Host IP Address. Your computer s IP address should automatically show up in the Host IP Address field. If the address is incorrect, change it to your workstation s IP address (refer to figure 3 Authentication Key Information). [Figure 3 Authentication Key Information]

4 3. Click Next and you should be at a Certificate Enrollment Method screen. Select CA is unavailable (this is the default) and click Next. 4. Restart your computer when it asks you to. 5. When you finish rebooting, the SSH Sentinel should appear in your taskbar. Right-Click on it and select Run Policy Editor. 6. Select the Key Management tab. You should see a folder for Authentication keys and within this is a folder for primary host key. Under the primary host key double-click the Add item (refer to Figure 4 Key Management). [Figure 4 Key Management] 7. In the Authentication Key wizard select Create a new preshared key and click Next (refer to Figure 5 Preshared Key). [Figure 5 Preshared Key]

5 8. The Preshared Key Name can be left as is. Enter and confirm your shared secret. This secret must match at both ends of the tunnel or the tunnel will not be created. When you are done click Finish (refer to figure 6 Create a Preshared Key). You should see your preshared key name under the list of Authentication Keys. [Figure 6 Create Preshared Key] 9. Click back on the Security Policy tab. Open the VPN Connections folder and double-click on Add (see Figure 7 SSH Sentinel). [Figure 7 SSH Sentinel]

6 10. This should bring you to an Add VPN Connection screen (refer to Figure 8 Add VPN Connection). In the Gateway Host Name field click on the IP button to the right. Enter the external IP of the Merilus FireCard or Gateway Guardian. 11. From the Authentication key drop-down, select your preshared key name that was configured in step In the Intranet IP address field, enter the internal network protected by your Merilus FireCard or Gateway Guardian, in this example In the Subnet Mask field enter the subnet mask of the Internal network protected by your Merilus FireCard or Gateway Guardian, in this example [Figure 8 Add VPN Connection] 13. Click OK. The SSH Sentinel Internet Pilot will now attempt to probe the connection to your Merilus firewall. Click Cancel. Click Yes. 14. You should be back at the Security Policy tab. The VPN Connection to your Merilus Firewall should be listed. Double-click on it and your Connection Properties window will open up (refer to Figure 9 Connection Properties). 15. Leave the Gateway Host, IP address and subnet mask as is. Ensure that the Authentication Key is showing your preshared key name. Leave the Proposal type as normal. 16. From the Encryption drop-down select 3DES. 17. Leave the IKE mode drop-down as Main Mode. 18. Leave the IKE group drop-down as MODP 1024.

7 [Figure 9 Connection Properties] 19. Go to the SA Lifetimes tab (refer to Figure 10 SA lifetimes). 20. Change the IKE SA lifetime to 480 min. [Figure 10 SA lifetimes]

8 21. Click OK. You should be back to the SSH Sentinel main window. 22. Click on your VPN connection and select Diagnostics. Sentinel will probe your tunnel and should come back saying that a connection is possible. 23. Click OK. Verifying the VPN Connection Your tunnel should now be up. While the tunnel is up, your Sentinel Client will not be able to ping the external IP of the Merilus FireCard / Gateway Guardian this is normal, though you should be able to ping the internal IP address of the device and any workstations behind the firewall. If so, you have successfully created an IPSec tunnel between your SSH Sentinel Internet Pilot host and your Gateway Guardian or FireCard device. If you double-click the SSH Sentinel icon in your taskbar you should see your active security association. To disable the tunnel, right-click on the SSH Sentinel in your taskbar and select Disable IPSec. If you have any problems please contact Merilus Technical Support by phone at (604) or by at support@merilus.com. SSH and SSH Sentinel are registered trademarks of SSH Communications Security Corp