Abstract. CRK; Reviewed: WCH 5/16/2003. Solution & Interoperability Test Lab Application Notes 2003 Avaya Inc. All Rights Reserved.

Transcription

1 Configuring a Site-to-Site VPN Tunnel between the Avaya VSU 100 VPN Gateway and a Checkpoint Next Generation (NG) VPN/Firewall with Avaya Communication Manager Issue 1.0 Abstract These Application Notes describe the setup and configuration of VPN devices in a site-to-site encryption tunnel between the Avaya VSU100 VPN Gateway and a Checkpoint NG VPN/Firewall with Feature Pack 2 (FP 2) with Avaya Communication Manager. 1 of 26

2 * 8 # * 8 # 1. Introduction These Application Notes describe the setup and configuration of VPN devices in a site-to-site encryption tunnel between the Avaya VSU100 VPN Gateway and a Checkpoint NG VPN/Firewall with Feature Pack 2 (FP 2) with Avaya Communication Manager. The following information describes the authentication and encryption of the tunnel between devices. Phase 1 Proposal: o Preshared Secret o Encryption Algorithm 3DES o Authentication Algorithm MD5 o Diffie-Hellman Group 2 Phase 2 Proposal: o No Compression o No Perfect Forward Secrecy o AH/ESP ESP Trailer o Encryption Algorithm 3DES o Authentication Algorithm HMAC-MD5 Figure 1 represents the sample network environment, including the Avaya S8300 Media Server with Avaya G700 Media Gateway, and Avaya S8100 Media Server with Avaya G600 Media Gateway. Avaya VSU100R Avaya P130 Switch /24 Checkpoint /24 Firewall /24 Avaya AP Avaya P333R Switch Workstation 2.99 Workstation Avaya IP Telephone Avaya IP Telephone-2.1 Avaya S8300/ G700 Avaya S8100/ G600 Avaya Series 6400 Digitial Telephone Trusted Zone B /24 Avaya Series 6400 Digitial Telephone Trusted Zone A /24 Figure 1: Network Configuration 2 of 26

3 Note: The IP addresses in Table 1 were used for the configuration shown in Figure 1. Device Name IP Address Comments Avaya S8300 Media Server with Avaya G700 Media Gateway Avaya P330 Stack Processor Media Gateway Processor (MGP) VoIP Module Media Server (S8300) Avaya S8100 Media Server with Avaya G600 Media Gateway CLAN MedPro Avaya VSU100R VPN Gateway Public Private Avaya P333R Switch Default VLAN VLAN 2 Avaya 4624 IP Telephone Avaya 4624 IP Telephone Checkpoint VPN / Firewall Avaya AP1000 Public Private VSU100R side Checkpoint side Workstation Workstation Table 1: IP address configuration for Figure 1 Default Gateway is Default Gateway is Default Gateway is Default VLAN = / 24 VLAN2 = / 24 Default Gateway is Equipment and Software Validated Table 2 shows the software/firmware versions were used during the verification: Devices Version Avaya S8300 Media Server with Avaya G700 Media Gateway R011x Avaya P333R MultiLayer Stackable Switch Avaya S8100 Media Server with Avaya G600 Media Gateway R011c Avaya P333T-PWR Power over Ethernet Stackable Switch Avaya P130 Workgroup Ethernet Switch Avaya VSU100R VPN Gateway Avaya 4624 IP Telephones def24r1_669 Avaya Access Point R3.1 QVPN Checkpoint VPN / Firewall NG with FP 2 Workstations MS Windows 2000 Pro 3 of 26

4 Table 2: Equipment & Software Validated 3. Configuring the Avaya VSU100 VPN Gateway Use the Avaya VPNmanager software for configuration of the VSU100R. Steps Description Connect to VSU 1 Using a null modem cable, connect the VSU 100R to the PC. 2 Start a HyperTerminal session to the VSU 100R Bits per second 9600 Data bits 8 Parity None Stop bits 1 Flow control None 3 Enter the VSU console password defined during initial use of the VSU. Reset VSU 4 On the main console menu Select 1 - Configuration Select 6 - Flush Configuration Enter the password At the prompt: Do you really want to flush all configurations? [yn], enter y At the prompt: Reboot required to complete the flush. Do you really want to reboot? [yn] enter y Run Quick Setup 5 On the main console menu Enter the password Select 5 Quick Setup and enter the following responses when prompted: o IP Address o IP Mask o At the prompt Do you want a secondary IP address on this unit? [yn], enter y o IP Address o IP Mask o Default Route o At the prompt Reboot Now? [yn], enter y Launch VPNmanager 6 On the Start menu Select Start! Programs! VPNmanager! VPNmanager Console 4 of 26

5 7 In the VPNmanager Login window Enter the User Name and Password (these were defined during VPNmanager installation) Choose VPNmanager Server Click the Connect button Create a VSU Domain 8 In the VPNmanager: No Domain opened window Select VPN Domain! New on the pull-down menu Enter the Name for the new domain, e.g. Avaya Click Apply 9 In the VPNmanager: Avaya window Click on the Config button 5 of 26

6 10 In the VSU Setup Wizard Enter the new VSU name, e.g. VSU100R Click Next Choose the New VSU Setup radio button Click Next Choose IP Address radio button Enter (Primary IP Address of the VSU) Enter (Secondary IP address of the VSU) Enter (Secondary IP Mask) Click Next Use default for Allow VSU to use VPNmanager Server to authenticate administrators checkbox Click Next Leave SNMP community String set to public Click Next Click Deny all non VPN traffic Click the VSU Setup Wizard Next button Select Setup Now Click Finished When prompted, enter superuser user name and password Click Save (highlighted in yellow) in the Configuration Console Click Update VSUs in the Configuration Console 6 of 26

7 Create IP Group (Trusted Side) 11 In the Configuration Console window Select Edit! New Object! IPGroup on the pull-down menu 12 In the New IP Group popup window Enter the name of the IP Group, e.g. Trusted Click Apply Click Close 13 In the Configuration Console window Click IP Group Add In the Add IPGroup Members popup window, enter o New IP Network o New IP Mask Click Apply Click Close Click on the Associate this group with VSU list Select VSU100R in place of Extranet device Click Save (yellow button) Click Update VSUs Create IP Group (Untrusted Side) 14 In the Configuration Console window Select Edit! New Object! IPGroup on the pull-down menu 15 In the New IP Group popup window Enter the name of the IP Group, e.g. Untrusted Click Apply Click Close 7 of 26

8 16 In the Configuration Console window Click IP Group Add In the Add IPGroup Members popup window, enter o New IP Network o New IP Mask Click Apply New IP Network New IP Mask Click Apply Click Close Click on the Associate this group with VSU list Enter for Extranet IP Address (Public IP address of the other VPN Gateway) Click Save (yellow button) Click Update VSUs 8 of 26

9 Create a VPN 17 In the Configuration Console window Select Edit! New Object! VPN on the pull-down menu In the New VPN, enter: o New VPN Name VSU-Checkpoint o VPN Type IKE Click Apply Click Close 18 Select the General tab o Click Preshared Secret o Check the Enable VPN checkbox 19 Select the Members IP Groups tab Move the Trusted and Untrusted Networks from the Available to the Members column 9 of 26

10 20 Select the Security (IKE) tab Provide the following information: o Encryption Algorithm 3DES o Authentication Algorithm MD5 o Lifetime (Time Based) 1 Day o Lifetime (Throughput) 0GB o Diffie-Hellmam Group 2 o Click Modify Secret to provide the Pre-Shared Secret key 21 Select the Security (IPSec) tab Provide the following information: o LZS NO o Perfect Forward Secrecy NO o AH/ESP ESP Trailer 10 of 26

11 22 Click Add.. and enter the following: o Encryption 3DES o Authentication HMAC-SHA o Lifetime (Time Based) 1 Day o Lifetime (Throughput) 0GB o Click OK 23 Click Save (yellow button) Click Update VSUs 11 of 26

12 4. Configuring the Checkpoint NG VPN/Firewall with FP2 Steps Description 1 Start the program by selecting Start!Programs!Checkpoint Management Clients! Policy Editor NG FP2 Create New Policy 2 Create a new policy by selecting File! New and providing the following information: Policy Package Name Checkpoint-VSU100R Click Traditional mode Click OK 12 of 26

13 Create Networks (Trusted and Untrusted) 3 Select Network Objects! Networks Using the right mouse button, select New Network Create a Trusted Network by providing the following information: o Name Trust o Network Address o Net Mask o Click the Broadcast Included button o Click OK Use the above steps to create additional trusted networks. Using the right mouse button, select New Network to create Untrusted Networks by providing the following information: o Name Untrust-2 o Network Address o Net Mask o Click the Broadcast Included button o Click OK Use the above steps to create additional untrusted networks. 13 of 26

14 Configure Near-End Checkpoint VPN Tunnel 4 Select Network Objects! Check Point Using the right mouse button, select New! Gateway 5 Select General Properties! Topology. The Topology page will be displayed. Click Manually Defined for VPN Domain and select the trusted network. 14 of 26

15 6 Select General Properties! VPN Click IKE for Encryption Schemes. 15 of 26

16 7 Click Edit... The IKE Properties window will appear. Click 3DES for Encryption Click MD5 for data Integrity Click Pre-Shared Secret 8 Select Edit Secrets to create the secret key. Provide the secret key and select Set Click OK to go back to the IKE Properties page. 16 of 26

17 9 Click the Advanced Button. The Advanced IKE Properties page will appear. Click Group 2 for Diffie-Hellman Groups Provide Re-keying parameters. Click Support Aggressive Mode Click OK to go back to the IKE Properties page. Click OK from the IKE Properties page to return to the Check Point Gateway page. 17 of 26

18 Configure Far-End Checkpoint VPN Tunnel 10 Select Network Objects! Interoperable Devices Using the right mouse button, select New Interoperable Device The Interoperable Device window will appear. Provide the following information: o Name VSU100R o IP Address (Public) Select General Properties! Topology. The Topology page will be displayed. Click Manually Defined for VPN Domain and select the untrusted network 18 of 26

19 Select General Properties! VPN. The VPN page will be displayed. Click IKE for Encryption Schemes. Select Edit... The IKE Properties window will appear. Click 3DES for Encryption Click MD5 for data Integrity Click Pre-Shared Secret 19 of 26

20 Select Edit Secret. for creating the secret key. Provide the secret key and select Set Click OK to go back to the IKE Properties page. Select the Advanced. Button. The Advanced IKE Properties page will appear. Click Group 2 for Diffie-Hellman Groups Provide Re-keying parameters. Click Support Aggressive Mode Click OK to go back to the IKE Properties page. 20 of 26

21 Click OK from the IKE Properties page to go back to the Check Point Gateway page. Create Rules 11 Provide the following information for setting up rules, as shown in the screen below Rule 1: This rule will be for outgoing traffic. SOURCE DESTINATION SERVICE ACTION TRACK Rule 2: This rule will be for incoming traffic. SOURCE DESTINATION SERVICE ACTION TRACK Rule 3: This rule will be for Explicit Deny. To set the values for a given rule (i.e., row), click the corresponding column using the right mouse button. For example, for either Rule 1 or 2, click the ACTION cell using the right mouse button, and select Encryption Properties. The Encryption Properties window will appear. 21 of 26

22 Select Edit The IKE Phase 2 Properties window will appear. Select the following information: 3DES for Encryption Algorithm MD5 for Data Integrity None for Compression Method Any for Allowed Peer Gateway Click OK Install Policy 7 Select Policy! Install to install the policy to be active. 22 of 26

23 5. Configuring the Avaya P333R Multilayer Stackable Switch Steps Description 1 Start a HyperTerminal session to the Console Port Bits per second 9600 Data bits 8 Parity None Stop bits 1 Flow control None 2 Enter User Name and Password. 3 Set the P330 to routing (Layer III) mode. P330-1(super)# session router Enter the configuration mode. Router-1(super)# configure Only two VLANs, the default VLAN and vlan , were configured for this example. If more than the default VLAN is needed, use the command set vlan <IfIndex> name <IfName> Router-1(configure)# set vlan 100 name vlan Create an interface for VLANs using interface <interface name>. Create an interface for the default vlan. Router-1(configure)# interface int Router-1(config-if:int )# ip address Router-1(config-if:int )# ip vlan 1 Router-1(config-if:int )# exit Create the interface for the vlan Router-1(configure)# interface int Router-1(config-if:int )# ip address Router-1(config-if:int )# ip vlan 100 Router-1(config-if:int )# exit 5 Create a static route. This route is pointing to the other side of the tunnel. Router-1(configure)# ip route Copy the running configuration to the startup configuration. Router-1(configure)# copy run start 6. Special H.323 configuration requirements The Checkpoint firewall controls inbound and outbound H.323 signaling packets based on administrable port values. Avaya MultiVantage software controls the destination port only, as shown in Figure 2. The source ports chosen are not administrable. 23 of 26

24 change signaling-group 7 Page 1 of 5 SIGNALING GROUP Group Number: 7 Group Type: h.323 Remote Office? n Max number of NCA TSC: 0 Max number of CA TSC: 0 Trunk Group for NCA TSC: Trunk Group for Channel Selection: 7 Supplementary Service Protocol: a Network Call Transfer? n Near-end Node Name: clan Far-end Node Name: s8300 Near-end Listen Port: 1720 Far-end Listen Port: 1720 Far-end Network Region: 1 LRQ Required? n Calls Share IP Signaling Connection? n RRQ Required? n Bypass If IP Threshold Exceeded? n Direct IP-IP Audio Connections? y IP Audio Hairpinning? y Figure 2: MultiVantage software Administration Screen for H.323 Signaling Port To support H.323 IP Telephony, the following additional configuration steps are required on the Checkpoint firewall so that it will pass all H.323 signaling information. These steps will set the destination port at 1720 and allow any source port to be used. Steps Description 1 On the Checkpoint, create a new TCP service: Name TCP-Trunk-1. Port Click the Advanced button and enter the following: 24 of 26

25 Source port (blank) Protocol Type None 7. Verification Steps To verify that the configuration was implemented correctly for VoIP calls, place calls between the S8300/G700 and the S8100/G600. To test the basic network connection and data traffic, use Ping. To verify encryption between two VPN Gateways, use a network analyzer. 8. Conclusion These Application Notes illustrate how to configure a site-to-site encryption tunnel between an Avaya VSU100R VPN Gateway and a Checkpoint NG VPN/Firewall with FP 2. Readers can use these Application Notes to replicate this configuration or as a starting point for a specific situation. 9. References For configuring the Avaya S8100 Media Server with Avaya G600 Media Gateway, please refer to the following Application Notes: Configuring devices for the Avaya Disaster Recovery Unit (DRU) Solution Issue 1.0 For configuring Avaya S8300 Media Server with Avaya G700 Media Gateway, please refer to the following Application Notes: Configuring the Avaya S8300 Media Server with Avaya G700 Media Gateway in a Stack With Other Avaya P330 Multilayer Stackable Switches Issue of 26

26 2003 Avaya Inc. All The Rights Reserved. Avaya and the Avaya Logo are trademarks of Avaya Inc. All trademarks identified by and are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners. The information provided in these Application Notes is subject to change without notice. The configurations, technical data, and recommendations provided in these Application Notes are believed to be accurate and dependable, but are presented without express or implied warranty. Users are responsible for their application of any products specified in these Application Notes. Please any questions or comments pertaining to these Application Notes along with the full title and filename, located in the lower the right corner, directly to the Avaya Solution & Interoperability Test Lab at 26 of 26