Full Tunnel Setup Example. Summary. Configuration Configuration Difficulty: Intermediate

Transcription

1 Full Tunnel Setup Example Summary This document provides the steps necessary to configure a VPN tunnel so all traffic is routed through the tunnel. In this example we will be configuring a Headquarters and a Branch. All traffic from the remote site will be routed back to the headquarters before reaching the internet. Configuration Configuration Difficulty: Intermediate Headquarters Setup: - Step 1: Log into the router s Setup Page. For help with logging in please click here. - Step 2: Click on Networking and select Tunnels and then IPSec VPN. - Step 3: Click Add - Step 4: Give the tunnel a name. - Step 5: Select Anonymous Mode and Responder Mode. - Step 6: Set a Local Identity. - Step 7: Set a Remote Identity. - Step 8: Enter a Pre-shared key. - Step 9: Set the mode to Tunnel. 1

2 - Step 10: Click Next. - Step 11: Click Add and enter Headquarters local network(s). - Step 12: Click Next. - Step 12: Click Add and enter Branch s local network(s). 2

3 - Step 13: Click Next. - Step 14: Set the Key Lifetime, Encryption, Hash, and DH Group you would like to use for IKE Phase 1. - Step 15: Click Next. - Step 16: Specify the IKE Phase 2 settings. - Step 17: Click Next. - Step 18: Configure Dead Peer Detection. 3

4 - Step 19: Click Finish. - Step 22: Click Enable VPN Service and then Save. If you want remote tunnel traffic to egress out the HQ WAN we need to enable 'Force NAT' for the WAN(s). o Go to Connection Manager and select the appropriate WAN(s) and click edit. o In the General Settings menu check the box labeled Force NAT. Branch Setup: VPN Configuration - Step 1: Log into the router s Setup Page. For help with logging in please click here. - Step 2: Click on Networking and select Tunnels and then IPSec VPN. - Step 3: Click Add. - Step 4: Give the tunnel a name. - Step 5: Set the Local Identity. o Note: The Local Identity should match the Remote Identity from Step 7 above. 4

5 - Step 6: Set the Remote Identity. o Note: The Remote Identity should match the Local Identity from Step 6 above. - Step 7: Enter a Pre-shared key. - Step 8: Set the mode to Tunnel. - Step 9: Click Next. - Step 10: Click Add and enter Branch s local network(s). - Step 11: Click Next. - Step 12: Set the Remote Gateway to Headquarters WAN IP or Hostname. - Step 13: Click Add and enter for both the Network ID and Subnet Mask. o Note: To send router generated traffic (NTP, ECM) through the tunnel check the Router Services check box. 5

6 - Step 14: Click Next. - Step 15: Set the Exchange Mode to Aggressive. - Step 16: Set the Key Lifetime, Encryption, Hash, and DH Group you would like to use for IKE Phase 1. - Step 17: Click Next. - Step 18: Specify the IKE Phase 2 settings. - Step 19: Click Next. - Step 20: Configure Dead Peer Detection. - Step 21: Click Finish. 6

7 - Step 24: Click Enable VPN Service and the Save. DNS Configuration - Your setup may require the configuration of static DNS servers which can be on the HQ LAN or a public DNS server. In this example we'll use a Google DNS server for Primary DNS and the HQ LAN IP for the Secondary DNS. o Go to Network Settings > DNS. Change the automatic config to 'Static' and input the Primary and Secondary DNS IPs. Check Force All DNS Request To Router. o Any LAN clients will need to renew their DHCP lease before DNS will work. 7