Quick Install Guide - Data Server VPN

Transcription

1 Enterprise IP Solutions OfficeServ 7200 Quick Install Guide - Data Server VPN -1-

2 > IPSec Settings 1. IPSec Connection Between OS7200s RSA key Contents Pre-shared key X.509 Cert 2. IPSec Connection Between OS7200 and PC (Remote User) Pre-shared key X.509 Cert > PPTP Settings 3. PPTP Configuration on OS7200 System 4. PPTP Configuration on PC (Windows 2000/XP) > Application Cases 5. IP Networking (Qsig) Application Cases 6. H.323/SIP Application Cases -2-

3 IPSec Configuration -3-

4 1. IPSec Connection Between OS7200s VPN of OS7200 allows you to connect different networks. The following figure illustrates basic network settings for using OS7200 VPN: 2 New Dest IP New Src IP Dest IP Src IP payload Tunneling (IPSec, PPTP) WAN WAN LAN Dest IP Src IP payload LAN Dest IP Src IP payload 4 payload PC PC -4-

5 The above figure shows packet forwarding when making communications from PC ( ) to the target PC ( ) using VPN. 1 Create and forward a packet whose destination IP is and whose Src IP is from PC ( ). 2 The original packet is encrypted through the VPN gateway. Add a new IP header (Destination IP: , Src IP: ) to create and forward a new packet. 3 Decrypt the forwarded packet in the VPN gateway. Then, forward the packet to the destination host by referring to the destination IP of the original packet. 4 The PC ( ) receives the original packet properly. -5-

6 RSA key (1) If you click [VPN] from the main menu, the following window will appear. Click the [Add] button to select a VPN gateway and to determine an authorization method. -6-

7 RSA key (2) Set OS7200_1 first. Enter the information on OS7200_1 in Local settings and the information on OS7200_2 in Remote settings. Click the [Download] button to download the authorization key and to deliver the key to OS7200_2. -7-

8 RSA key (3) Note If you want to set OS7200 on the same network ( ), set Router to the IP address of OS

9 RSA key (4) Click the [Upload] button to find and upload the authorization key received from OS7200_2. -9-

10 RSA key (5) Click the [Add] button to complete OS7200_1 settings. -10-

11 RSA key (6) Set OS7200_2 in the same method as OS7200_

12 Pre-shared key (1) Set the Pre-shared key field in the same method as the RSA key field. Enter the shared key, which is a password to be used for user authorization, in the Pre-shared key field. -12-

13 Pre-shared key (2) Set OS7200_2 in the same method as OS7200_

14 X.509 (1) Click Certification from the left menus. Once the window below appears, click the [Add] button to create a CA certification. -14-

15 X.509 (2) Once a window that prompts you to create a CA certification appears, fill out all of the fields, and click the [OK] button. -15-

16 X.509 (3) Once a window that prompts you to create a host certification appears, fill out the fields, and click the [OK] button. Note that you must remember the password. -16-

17 X.509 (4) Click the [Download] button from the window below to download a certification. -17-

18 X.509 (5) Click Config from the left menus, and then click the [Add] button. Enter required information, and select X.509 Cert. Click the [List] button. -18-

19 X.509 (6) Once the Certification list window appears, select an item from the list, and click the [OK] button. (If several host certifications are created, several certifications will appear.)

20 X.509 (7) Click the [Upload] button to upload the CA certification received from OS7200_

21 X.509 (8) Enter the password used for creating a host certification in Password, and click the [Add] button. -21-

22 X.509 (9) If you click the [Advanced] button, the Advanced window will appear. Enter the Left ID value of OS7200_2 in the Right ID field, and click the [OK] button to complete X.509 settings. (Set OS7200_2 in the same method as OS7200_1.) -22-

23 X.509 (10) Click Management from the left menu. If Activity is set to Stopped, click the [Run] button. (If Activity is set to Running, click the [Stop] button, and then click the [Run] button again.) Select the Auto-start when system boots checkbox to automatically start the VPN service on system boot. -23-

24 X.509 (11) Click Status from the left menu to check the current status of VPN connections. -24-

25 2. IPSec Connection Between OS7200s and PC (Remote User) Remote User Internet Tunneling (IPSec, PPTP) WAN LAN PC -25-

26 Pre-Shared key (1) Enter information on PC in Remote settings. (Since a PC does not have subnet, leave the fields on subnet blank.) -26-

27 Pre-Shared key - VPN Client (1) If you select [Start] -> [Run], and run mmc, the window below will appear. Select [File] -> [Add/Remove Snap-In] from the Console window. -27-

28 Pre-Shared key - VPN Client (2) If you click the [Add (D)] button from the <Add/Remove Snap-in> window, the window below will appear. Select IP Security Policy Management from the snap-in list, and click the [Add (A)] button. -28-

29 Pre-Shared key - VPN Client (3) Once the window below appears, select Local Machine (T), and click the [Finish] button. -29-

30 Pre-Shared key - VPN Client (4) If you move the <Console> window, the IP Security Policy of Local Computer submenu is created under Console Route. Right-click the submenu to select [Create IP Security Policy (C)]. -30-

31 Pre-Shared key - VPN Client (5) Enter the name of description of the IP security policy in the <IP Security Policy Wizard> window, and click the [Next (N)] button. -31-

32 Pre-Shared key - VPN Client (6) Clear the Activate Default Response Rule (R) checkbox, and click the [Next (N)] button. Once the window below appears, select the Edit Properties (P) checkbox, and click the [Finish] button. -32-

33 Pre-Shared key - VPN Client (7) If the <XP IPSec Properties> window appears, the created item will be displayed. Clear the checkbox, and click the [Add (D)] button. -33-

34 Pre-Shared key - VPN Client (8) Once <Security Rule Wizard> starts, click the [Next (N)] button to select The tunnel endpoint is specified by this IP address: (I). Enter the external IP address ( ), and click the [Next (N)] button. -34-

35 Pre-Shared key - VPN Client (9) If you select LAN(Local Area Network) from the <Network Type> window and click the [Next (N)] button, the <Authentication Method> window will appear. Select the Use this string to protect the key exchange (preshared key) (S): checkbox, and enter the user password registered with the firewall. Click the [Next (N)] button. -35-

36 Pre-Shared key - VPN Client (10) If you click the [Add (A)] button from the <IP Filter List> window, the window below will appear. Enter outbound in the Name field, and click the [Add (A)] button. -36-

37 Pre-Shared key - VPN Client (11) If you click the [Next (N)] button from the <IP Filter Wizard> window, the window below will appear. Select My IP address in the Source Address option, and click the [Next (N)] button. -37-

38 Pre-Shared key - VPN Client (12) Select Specific IP Subnet in the Destination Address option. Enter the address of the internal network ( ) and subnet mask ( ), and click the [Next (N)] button. -38-

39 Pre-Shared key - VPN Client (13) Select All from IP Protocol Type, and click the [Next (N)] button. Select the Edit Properties (P) checkbox, and click the [Finish] button. -39-

40 Pre-Shared key - VPN Client (14) If you click the [OK] button, the outbound option will be created as shown in the figure below. Click the [Add (A)] button to create the inbound option. Enter and in Specific IP Subnet of Source Address (S). Select My IP Address from Destination Address (D). The next settings are the same as the previous ones. -40-

41 Pre-Shared key - VPN Client (15) If you click the [OK] button, the window below will appear. Select the outbound option, and click the [Next (N)] button. -41-

42 Pre-Shared key - VPN Client (16) Select the Request Security (Option) option, and click the [Edit (E)] button. -42-

43 Pre-Shared key - VPN Client (17) Select Negotiate security (N), and then select an option from each of AH Integrity (None), ESP Confidentiality (3DES), and ESP Integrity (MD5) in Security Method Priority. Click the [Move Up (U)] button to move to the top. Select the Session Key Transmission Security (PFS) checkbox, and click the [OK] button. -43-

44 Pre-Shared key - VPN Client (18) If you select the Edit Properties (P) checkbox, and click the [Finish] button, the outbound option will be created as shown in the figure below. Click the [Add (A)] button to create the inbound option. -44-

45 Pre-Shared key - VPN Client (19) Once <Security Rule Wizard> starts, click the [Next (N)] button to select the The tunnel endpoint is specified by this IP address (I) checkbox, and enter the external IP address ( ). Click the [Next (N)] button. -45-

46 Pre-Shared key - VPN Client (20) If you select LAN(Local Area Network) from the <Network Type> window and click the [Next (N)] button, the <Authentication Method> window will appear. Select the Use this string to protect the key exchange (preshared key) (S): checkbox, and enter the user password registered with the firewall. Click the [Next (N)] button. -46-

47 Pre-Shared key - VPN Client (21) If you click the [OK] button, the <IP Filter List> window will appear. Select inbound from the window, and select the [Next (N)] button. The next settings are the same as the previous ones. -47-

48 Pre-Shared key - VPN Client (22) Select the [General] tab from the <XP IPSec Security> window, and click the [Advanced (V)] button. Once the <Key Exchange Settings> window appears, select the Master Key Transmission Security (PFS) (P) checkbox, and click the [Method (M)] button. -48-

49 Pre-Shared key - VPN Client (23) Select an option from each of Encryption (3DES), Integrity (MD5), and Diffie-Hellman (Medium) of the <Key Exchange Security Methods> window, and click the [Move Up (U)] button to move to the top. Click the [OK] button. -49-

50 Pre-Shared key - VPN Client (24) Select the IP Security Policy of Local Computer submenu from the <Console> window. Right-click the newly created item at the right window, and select the Assign (A) menu. The policy assignment is set to Yes. -50-

51 Pre-Shared key - VPN Client (25) Select [Start]->[Programs]->[Administrative Tools]->[Services] from the Windows taskbar. Right-click IPSEC Services, and click Restart (E). -51-

52 Pre-Shared key - VPN Client (26) Check connection status of the internal IP address ( ) by executing ping at the command prompt. If a response is made as shown in the figure below, it means that the connection has been successfully made. -52-

53 X.509(1) Enter information on OS7200 and PC in the same method as the pre-shared key settings. Enter X.509 Cert, and register a host certificate. Enter the password. -53-

54 X.509(2) Create an additional host certificate to authorize a PC. -54-

55 X.509(3) Download a new PC certificate, and deliver it to the PC. -55-

56 X VPN Client (1) If you select [Start]-> [Run] from the Windows taskbar and run mmc, the window below will appear. Select [File]->[Add/Remove Snap-in] from the Console window. -56-

57 X VPN Client (2) If you click the [Add (D)] button from the <Add/Remove Snap-in> window, the window below will appear. Select Certificate from the snapin list, and click the [Add (A)] button. -57-

58 X VPN Client(3) Select Computer Account (C), and click the [Next (N)] button. -58-

59 X VPN Client(4) Select Local computer: (the computer this console is running on) (L), and click the [Finish] button. -59-

60 X VPN Client(5) Select IP Security Policy Management from the snap-in list, and click the [Add (A)] button. -60-

61 X VPN Client(6) Select Local Computer (T) from the Select Computer or Domain window, and click the [Finish] button to complete. -61-

62 X VPN Client(7) Right-click the Private submenu under the Certificate menu of the Console window, and select All Tasks -> Import in sequence. -62-

63 X VPN Client(8) Once a window that prompts you to start Certificate Import Wizard appears, click the [Next (N)] button, and find a file to be imported by clicking the [Browse (R)] button. If you find the file, click the [Next (N)] button. -63-

64 X VPN Client(9) Enter the password used for creating a host certificate, and click the [Next (N)] button. -64-

65 X VPN Client (10) Select Automatically select the certificate store based on the type of certificate (U), and click the [Next (N)] button to exit the wizard. -65-

66 X VPN Client(11) If you click the Certificate submenu under the Private menu from the Console window, the saved certificate will appear at the right of the window. Double-click the certificate. -66-

67 X VPN Client (12) Enter like the information in Subject from the Details tab in the Right ID field of the Advanced window for OS7200 settings. -67-

68 X VPN Client (13) Right-click IP Security Policy of Local Computer under the Console Route menu of the Console window, and click the [Create IP Security Policy (C)]. The next settings are the same as pre-shared key settings. -68-

69 X VPN Client (14) Select Use Certificate of the Following Certificate Authority (CA) (C) in the Authorization Method Edit Properties window. Then, select a certificate by using the [Browse (R)] button. (Set outbound and inbound in the same method.) -69-

70 X VPN Client(15) -70-

71 PPTP Configuration -71-

72 3. PPTP Configuration at OS7200 System 1. Click Config from the left menu. If you click the [Add] button to add a PPTP user, the window below will appear. Enter the user ID and password, and select a method of assigning a user IP (dynamic/static). -72-

73 2. Click Management from the left menu. If Activity is set to Stopped, click the [Run] button. (If Activity is set to Running, click the [Stop] button, and then click the [Run] button again.) -73-

74 4. PPTP Configuration on PC (Windows 2000/XP) 1. Run [Start]->[Settings]->[Control Panel]->[Network Connection]-> [Create New Connection] on the Windows taskbar. Once the New Connection Wizard starts, click the [Next (N)] button. -74-

75 2. Select Connect to Corporate Network (O) from Network Connection Type and Connect to Virtual Private Network (V) in Network Connection. Click the [Next (N)] button. -75-

76 3. Enter a company name and the IP address of the VPN server. Select Connect to Corporate Network (O) from Network Connection Type, and Connect to Virtual Private Network (V) from Network Connection. Select the [Next (N)] button. -76-

77 4. Complete the New Connection Wizard, and Attempt to connect to the corporate VPN server. -77-

78 - Example - (VoIP Service Using VPN) -78-

79 Network Environment VoIP Connection Without VPN 2 Internet WAN Tunneling (IPSec, PPTP) WAN LAN 1 VoIP Connection Using VPN LAN MCP: /24 MGI: /24 MCP: /24 MGI: / Site A (Node 0) Site B (Node 1) -79-

80 Conditions 1. Set NAT from [Firewall/Network] of WIM. Then, set network information as shown in the figure below. 2. Set the external port of MGI to No. 20, Pre-set static NAPT on MCP and MGI. 4. Set IPSec between Site A and Site B. E.g.) Refer to the [OfficeServ 7200]Quick Install Guide(VoIP Service) file. -80-

81 5. H.323/SIP Application Case CASE I: H.323/SIP Call Connection Using NAPT Site A MMC Configuration -. MMC 830 IP: / GW: / Netmask: / Public Port: 1719 / Public IP: System IP Type: Private or Public -. MMC 831 IP: / GW: / Netmask: / Public Port: / Public IP: System IP Type: Private or Public -. MMC 724 Enter an MGI Dial No. (E.g ~ 3816). -. MMC 615 Enter a VoIP trunk and a public IP trunk (E.g ~ 3816). -. MMC (80) -. MMC (Site B WAN IP address) -81-

82 Site B MMC Configuration -. MMC 830 IP: / GW: / Netmask: / Public Port: 1719 / Public IP: System IP Type: Private or Public -. MMC 831 IP: / GW: / Netmask: / Public Port: / Public IP: System IP Type: Private or Public -. MMC 724 Enter an MGI Dial No. (E.g ~ 3816). -. MMC 615 Enter a VoIP trunk and a public IP trunk (E.g ~ 3816). -. MMC (80) -. MMC (Site A WAN IP address) -82-

83 CASE II: H.323/SIP Call Connection Using IPSec Site A MMC Configuration -. MMC 830 IP: / GW: / Netmask: / Public Port: 1719 / Public IP: System IP Type:Private or Public -. MMC 831 IP: / GW: / Netmask: / Public Port: / Public IP: System IP Type:Private or Public -. MMC 724 Enter an MGI Dial No. (E.g ~ 3816). -. MMC 615 Enter a VoIP trunk and a public IP trunk (E.g ~ 3816). -. MMC (79) (80) -. MMC (Site B MCP private IP address) -83-

84 Site B MMC Configuration -. MMC 830 IP: / GW: / Netmask: / Public Port: 1719 / Public IP: System IP Type:Private or Public -. MMC 831 IP: / GW: / Netmask: / Public Port: / Public IP: System IP Type:Private or Public -. MMC 724 Enter an MGI Dial No. (E.g ~ 3816). -. MMC 615 Enter a VoIP trunk and a public IP trunk (E.g ~ 3816). -. MMC (79) (80) -. MMC (Site A MCP private IP address) -84-

85 6. IP Networking (Qsig( Qsig) ) Application Case CASE III: IP Networking (Qsig) Call Connection Using NAPT Site A MMC Configuration -. MMC 830 IP: / GW: / Netmask: / Public Port: 6100 / Public IP: System IP Type:Private or Public -. MMC 831 IP: / GW: / Netmask: / Public Port: / Public IP: System IP Type:Private or Public -. MMC 724 Enter an MGI Dial No. (E.g ~ 3816). -. MMC 615 Enter a VoIP trunk and a public IP trunk (E.g ~ 3816). -. MMC (80) -. MMC 820 SELF LINK ID:0 / Signal GW: SYS01 LINK ID:1 / Signal GW: / IP Type:Public -85-

86 Site B MMC Configuration -. MMC 830 IP: / GW: / Netmask: / Public Port: 6100 / Public IP: System IP Type:Private VS Public -. MMC 831 IP: / GW: / Netmask: / Public Port: / Public IP: System IP Type:Private VS Public -. MMC 724 Enter an MGI Dial No. (E.g ~ 3816). -. MMC 615 Enter a VoIP trunk and a public IP trunk (E.g ~ 3816). -. MMC (80) -. MMC 820 SELF LINK ID:1 / Signal GW: SYS01 LINK ID:0 / Signal GW: / IP Type:Public -86-

87 CASE IV: IP Networking (Qsig) Call Connection Using IPSec Site A MMC Configuration -. MMC 830 IP: / GW: / Netmask: / Public Port: 6100 / Public IP: System IP Type:Private or Public -. MMC 831 IP: / GW: / Netmask: / Public Port: / Public IP: System IP Type:Private or Public -. MMC 724 Enter an MGI Dial No. (E.g ~ 3816). -. MMC 615 Enter a VoIP trunk and a public IP trunk (E.g ~ 3816). -. MMC (79) (80) -. MMC 820 SELF LINK ID:0 / Signal GW: SYS01 LINK ID:1 / Signal GW: / IP Type:Private -87-

88 Site B MMC Configuration -. MMC 830 IP: / GW: / Netmask: / Public Port: 6100 / Public IP: System IP Type:Private or Public -. MMC 831 IP: / GW: / Netmask: / Public Port: / Public IP: System IP Type:Private or Public -. MMC 724 Enter an MGI Dial No. (E.g ~ 3816). -. MMC 615 Enter a VoIP trunk and a public IP trunk (E.g ~ 3816). -. MMC (79) (80) -. MMC 820 SELF LINK ID:1 / Signal GW: SYS01 LINK ID:0 / Signal GW: / IP Type:Private -88-

89 Thank you! -89-