HTG XROADS NETWORKS. Network Appliance How To Guide: EdgeWALL (IPSec VPN) How To Guide

Transcription

1 HTG X XROADS NETWORKS Netwrk Appliance Hw T Guide: EdgeWALL (IPSec VPN) Hw T Guide

2 V 3. 2 E D G E N E T W O R K A P P L I A N C E Hw T Guide EdgeWALL XRads Netwrks Vn Karman Suite XROADS

3 V 3. 2 Table f Cntents EdgeWALL (IPSec VPN) Overview 3 C O M P O N E N T S Setting Up The IPSec VPN 4 IPSec Failver Cnfiguratin 8 Dynamic Addressing 10 Wrking with SnicWall 11 Wrking with Netscreen 18 Wrking with ZyXEL 29 Wrking with Cisc PIX 31 IPSec VPN Trubleshting 33

4 Edge Cnfiguratin Series EdgeWALL (IPSec VPN) Overview The Edge appliance prvides the ability t cnfigure a secure IPSec VPN tunnel between tw Edge devices, the Edge IPSec client, r any standards based IPSec prduct. Cnfiguratin f the IPSec VPN is perfrmed under the EdgeWALL tab f the web interface. IPSec VPN Overview (Netwrk Diagram) The typical methd fr setting up an IPSec tunnel is either between an Edge appliance acting as a hub and a remte IPSec sftware client, r between tw Edge appliances, with ne acting as a hub and the ther as a client. The hub must always have a static IP address; the client may have a dynamic address as it initiates the IPSec cnnectin. NOTE: Dynamic clients can t be used when lad balancing. The next sectins detail the setup and cnfiguratin f an IPSec tunnel and hw t setup IPSec failver. IPSec failver nly wrks with ther IPSec clients that cmply with ur IPSec failver specificatins, manual restart is required therwise. 3

5 Setting Up The IPSec VPN (Example Cnfiguratin) This sectin prvides a step-by-step verview f ur IPSec VPN tunneling capabilities, including hw t create an IPSec tunnel, Start/Stp a tunnel, reset the IPSec VPN engine, View IPSec VPN debug infrmatin, and delete IPSec VPN tunnels frm the Edge appliance. Create An IPSec Tunnel The fllwing is an example IPSec tunnel being cnfigured between tw end-pints, a main ffice hub lcatin, and a remte ffice client lcatin. The fllwing diagram prvides the IP addressing infrmatin. This example shws hw t cnnect tw lcatins that have static IP addressing. Fr dynamic addressing, review this sectin, then review the dynamic addressing sectin fr mre details n nn-static client addressing. The image belw demnstrates what the IPSec tunnel cnfiguratin shuld lk like using the parameters in the example abve. 4

6 The prcedure fr creating an IPSec tunnel is fairly simple; here is a list f the infrmatin required: - What will be the name f the cnnectin? - What key type will yu use? (Shared Secret is recmmended) - If Shared Secret, what is the key? (letters/numbers nly) - What are the WAN IP addresses f each side f the IPSec VPN? - What are the LAN IP addresses/netwrks f each site? The next step is t begin cnfiguring the HUB end f the IPSec VPN tunnel. T d this, g t the EdgeWALL->Virtual Private Netwrking (IPSec) menu and begin the cnfiguratin. Step 1) Enable the IPSec Tunnel Step 2) Enter the name f the IPSec Tunnel Step 3) Select Shared Secret r RSA Key and enter a key NOTE: If yu have a key randmly generated, yu must COPY that key fr each f the IPSec VPN clients which will cnnect. As the randm key is rather lng, it is smetimes easier t generate yur wn. Step 4) Select which WAN interface the IPSec tunnel will use PART TWO: With the general parameters entered, it is nw time t enter the actual IP addressing. Step 5) Tunnel Lcal Netwrk Enter the netwrk/subnet t be tunneled. By default this is the netwrk attached t the LAN interface, hwever if yur netwrk is behind a firewall, yu may enter that netwrk here. Step 6) Remte VPN Device Enter the WAN IP address f the remte IPSec VPN client/appliance. 5

7 Step 7) Remte VPN Netwrk Enter the netwrk/subnet t be tunneled n the client side f the cnnectin. Step 8) Failver VPN Is nt t be cnfigured until bth a primary and secndary IPSec VPN tunnels have been created. Once bth tunnels are cnfigured, yu can select the tunnel and enter the Failver IPSec VPN infrmatin. Step 9) Failver Prbe Address This shuld be a LAN address within the remte IPSec VPN netwrk. In the example culd be used. Step 10) VPN Hub/Client Select which side f the tunnel is currently being cnfigured. Client Side Cnfiguratin The client side f the cnfiguratin is exactly the same fr PART ONE. PART TWO (abve) is simply the reverse f the hub cnfiguratin. Where the remte VPN device wuld be and the remte VPN netwrk wuld be The prcess is just reversed frm the hub side. Failver IPSec VPN Settings The reasn the Failver VPN field shuld nt be entered is t ensure that the VPN can be established prir t creating a failver cnnectin. 6

8 Start/Stp Tunnels By default, when an IPSec tunnel is created it is nt activated t ensure that n prblems are caused n the netwrk. T activate a tunnel, first select the tunnel t be activated and click the Start buttn. Similarly t de-activate a tunnel, select the tunnel t be de-activated and click the Stp buttn. This will turn dwn the selected IPSec tunnel. The Restart All buttn will stp ALL tunnels are restart them. This is useful when debugging a cnnectin. NOTE: The STATUS parameter nly prvides whether the IPSec tunnel has been started, it des nt guarantee that a cnnectin has been made. Client vs Hub Display When starting a client tunnel yu shuld see Activated change t Yes and Status change up UP, hwever a hub tunnel will shw a Status f HUB. This is always the case as the HUB side f the cnnectin is always up. Delete Tunnels Once a tunnel has been deleted, it will be stpped, remved frm the IPSec tunnel list and deleted frm the IPSec plicies. NOTE: Be sure t save the cnfiguratin after all adds/updates and deletins. 7

9 IPSec Failver Cnfiguratin When creating a failver r backup tunnel ALWAYS start by shutting dwn the primary tunnel. T d this, select the primary tunnel and select the STOP buttn. Create The Failver Tunnel Fllwing the same steps as befre, create the backup tunnel. The differences include: 1) The WAN Interface shuld be different. 2) The Remte VPN Device shuld be different. 3) The Failver VPN name shuld be equal t the cnnectin name f the primary tunnel. 8

10 Re-Cnfiguring The Primary Tunnel Fr Failver Once the backup tunnel has been created, the primary tunnel must be assciated with the backup tunnel via its cnnectin name. T d this, select the primary tunnel frm the tunnel listing and edit its cnfiguratin. Change the Failver VPN name t that f the backup tunnel. Once this is dne, update the tunnel infrmatin, yu shuld see smething similar t the fllwing: Activating The Failver IPSec Service An IMPORTANT NOTE is t make sure NOT t start bth tunnels. When cnfiguring a backup tunnel scenari, ONLY the primary tunnel shuld be active. The secndary r backup tunnel shuld remain inactive. When a failver cnditin is detected, the IPSec tunnel will autmatically start the backup tunnel. Again, the administratr shuld NEVER start the backup tunnel. This image shws the crrect status fr a backup r failver cnfiguratin. 9

11 Dynamic Addressing When the client side f the IPSec VPN has a dynamic IP address and can nt be cnfigured statically, the Dynamic Tunnel ptin can be enabled. This ptin MUST be enabled n bth ends f the IPSec tunnel; hwever the hub side f the cnnectin des nt need the Remte VPN Device address t be entered. NOTE: The client end MUST ALWAYS have the Remte VPN Device address infrmatin entered. WARNING: Dynamic addressing can nt be used with either side in a lad balanced mde. Lad balancing requires static rutes be added fr each cnnectin and this can nt be accmplished when using a dynamic IP address. NOTE: When using the Dynamic Tunnel ptin, bth sides MUST have the same Remte ID r the IPSec tunnel will nt authenticate. 10

12 Snicwall Interperability Guide The fllwing is a typical gateway-t-gateway IPSec VPN that uses a preshared secret fr authenticatin: Gateway A and Gateway B cnnects their internal LAN t the internet respectively. Here we want t set up an IPSec cnnectin using the Snicwall with the fllwing cnnectin parameters: IKE Phase 1 Parameters: Main mde 3des-md5 Pre-Shared secret IKE Phase 2 Parameters: 3des-md5 ESP tunnel mde Perfect Frward Secrecy (PFS) fr rekeying Steps fr setting up XRads Ruter Setting up the XRads IPSec mdule is quite simple. First let s start by ging ver a few steps: 1. EdgeWALL->Virtual Private Netwrking (Create a new Tunnel) select "VPN Tunnel Enabled" Radi Buttn. 11

13 enter "xrads" under cnnectin name. select "Shared Secret" Radi buttn. select "MD-5" Radi Buttn. enter preshared key in "Shared Secret Key" edit bx. select "WAN1" fr VPN Interface enter remte ip address in "Remte VPN Device" enter remte netwrk in "Remte VPN Netwrk" (leave this ptin blank if dynamic) select "Client Side" radi buttn 12

14 2) "Add/Update" then "View Tunnels >>" select the "Add/Update" buttn select "View Tunnels >>" buttn Steps fr setting up the Snicwall In this scenari, we assume that the Snicwall is Gateway A and that the subnet behind ur gateway is " /24" as depicted in the graph. All cmmands are given in the web-based User Interface prvided by the Snicwall.In this dcument, "F->Bar" indicates that yu select the "F" buttn n the left side f the windw, and in the resulting screen, select the "Bar" tab r Buttn frm the frm in the right side f the windw. 1. VPN->Add (Add a new VPN Tunnel) select "VPN" link select "Settings" Sub Link select "Add" Buttn n Right Frm 13

15 2) General Tab (General Tab n Ppup Windw) select "IKE using Preshared Secret" in drp dwn menu. enter "XRadsSnicwallVPN" fr the cnnectin name. enter " " fr the IP address. enter pre-shared key in "Shared Secret". select "Specify destinatin netwrks belw" radi buttn. select "Add" buttn t add netwrk. 14

16 3) VPN Netwrk Ppup Windw (Add Destinatin Netwrk) enter Netwrk IP address Under Netwrk, i.e " " enter Subnet Mask f Remte Netwrk under "Subnet Mask". select the "OK" buttn t save. select the "Prpsals" Tab 15

17 4) Prpsals Tab (Prpsals Tab n Ppup Windw) Under IKE (Phase 1) Prpsal select "Main Mde" fr "Exchange" select "Grup 2" under "DH Grup" select "3DES" under "Encryptin" select "MD5" under "Authenticatin" enter "28800" in "Life Time" Under Ipsec (Phase 2) Prpsal select "ESP" under "Prtcl" select "3DES" under "Encryptin" select "MD5" under "Authenticatin" Check "Enable Perfect Frward Secrecy" select "Grup 2" under "DH Grup" enter "28800" in "Life Time" 16

18 select the "OK" buttn t save 5) If the IPSec tunnel was cnfigured crrectly, yu shuld see a green circle next t the Plicy under the VPN Plicies chart as depicted in the next Figure. 17

19 NetScreen 5(XP) Interperability Guide The fllwing is a typical gateway-t-gateway IPSec VPN that uses a preshared secret fr authenticatin: Gateway A and Gateway B cnnects their internal LAN t the internet respectively. Here we want t set up an IPSec VPN cnnectin using the Netscreen 5(XP) with the fllwing cnnectin parameters: IKE Phase 1 Parameters: Main mde 3des-md5 Pre-Shared secret IKE Phase 2 Parameters: 3des-md5 ESP tunnel mde Perfect Frward Secrecy (PFS) fr rekeying Steps fr setting up XRads Ruter Setting up the XRads IPSec VPN mdule is quite simple. First let s start by ging ver a few steps: 1. EdgeWALL->Virtual Private Netwrking (Create a new Tunnel) select "VPN Tunnel Enabled" Radi Buttn. 18

20 enter "xrads" under cnnectin name. select "Shared Secret" Radi buttn. select "MD-5" Radi Buttn. enter preshared key in "Shared Secret Key" edit bx. select "WAN1" fr VPN Interface enter remte ip address in "Remte VPN Device" enter remte netwrk in "Remte VPN Netwrk" (leave this ptin blank if dynamic) select "Client Side" radi buttn 19

21 2) "Add/Update" then "View Tunnels >>" select the "Add/Update" buttn select "View Tunnels >>" buttn Steps fr setting up the Netscreen 5(XP) In this scenari, we assume that the netscreen is Gateway A and that the subnet behind ur gateway is /24 as depicted in the graph. All cmmands are given in the web-based User Interface prvided by the Netscreen.In this dcument, "F->Bar" indicates that yu select the "F" buttn n the left side f the windw, and in the resulting screen, select the "Bar" tab frm the frm in the right side f the windw. 1. Address->Trusted (Define addresses fr the netwrk behind Gateway A) select "New Address" link enter "LAN A" fr the address name enter " " fr the IP address enter " " fr the netmask select "Trust" fr the lcatin select the "OK" buttn t save 20

22 2) Address->Untrusted (Define addresses fr the netwrk behind Gateway B) select "New Address" link enter "LAN B" fr the address name 21

23 enter " " fr the IP address enter " " fr the netmask select "Untrust" fr the lcatin select the "OK" buttn t save 22

24 3) IPSec VPN->Gateway (Specify Phase 1 fr Gateway B) select "New Remte Tunnel Gateway" link enter "Gateway B Phase 1" fr the gateway name select "Static IP address" fr the address type enter " " fr the IP address select "Main (ID prtectin)" fr the Mde (Initiatr) select "pre-g2-3des-md5" fr the first Phase 1 prpsal leave the ther Phase 1 prpsals set t "nne" enter yur preshared key select the "OK" buttn t save 23

25 4) IPSec VPN->AutKey (Specify Phase 2 fr Gateway B) select "New AutKey IKE Entry" link 24

26 enter "Gateway B Phase 2" fr the gateway name select "Gateway B Phase 1" fr the remte gateway tunnel select "g2-esp-3des-md5" fr the Phase 2 prpsal leave the ther Phase 2 prpsals set t "nne" select the "OK" buttn t save 25

27 5) Plicy->Outging (Create a new pair f plicies t link the LANs) select the "New Plicy" link enter "LAN B Plicy" fr the name select "LAN A" fr the surce address select "LAN B" fr the destinatin address select "ANY" fr the service chse "Off" fr NAT select "Tunnel" fr the actin select "Gateway B Phase 2" fr the VPN tunnel check "Mdify matching incming VPN plicy" t create the plicy in bth directins select the "OK" buttn t save 26

28 Nte: These new plicies must be abve ther nn-vpn plicies (such as the default utging plicy) in the plicy lists. In Plicy->Outging, click n the duble-arrw icn in the first clumn under Cnfigure fr the plicy yu just 27

29 created (it will have an icn f a lck with tw arrws n it in the Actin clumn). In the dialg bx, specify the psitin fr this plicy, namely abve the plicy fr "Inside Any" t "Outside Any". If yu had any nn-vpn plicies in Plicy- >Incming, yu will have t mve the new IPSec VPN plicy abve them as well. T view the IPSec cnnectins made, lk at the entries in Lg->Event Lg. T debug cnnectins, telnet t the system's cmmand line interface (CLI) and give the "debug ike detail" cmmand during IKE negtiatins. If everything has been cnfigured crrectly, yur netscreen shuld be ready t receive an IPSec tunnel cnnectin. 28

30 ZyXEL Interperability Guide The fllwing is a typical gateway-t-gateway IPSec VPN that uses a preshared secret fr authenticatin: In this example: Lcal Subnet = Remte Subnet = Edge Device = ZyXEL Device = DES/SHA1 Prtcl Setting Shared Secret = ashleys Simple Cnfiguratin 29

31 Many IPSec VPN devices, including the ZyXEL supprt nn-subnet addressing where a single, r range f addresses, is allwed. The Edge appliance des nt allw nn-subnet ranges as this is nt a recmmended methd fr netwrking. Always make sure that the IPSec VPN tunnel falls within subnet bundaries. Advanced Cnfiguratin 30

32 Cisc PIX Interperability Guide Setting up the Cisc PIX requires much f the same cnfiguratin as the ther tunnels. The key parameters being: IKE Phase 1 Parameters: Main mde 3des-md5 Pre-Shared secret IKE Phase 2 Parameters: 3des-md5 ESP tunnel mde Perfect Frward Secrecy (PFS) fr rekeying The fllwing is an example cnfiguratin file frm a PIX which cntains the standard methds used fr setting up a IPSec tunnel between a PIX and an Edge device: EDGE CONFIGURATION lan, / wan1, / , GW VPN / / PIX CONFIGURATION PIX Versin 6.3(5) interface ethernet0 aut interface ethernet1 100full nameif ethernet0 utside security0 nameif ethernet1 inside security100 hstname Gateway dmain-name abc.cm access-list utside_acl permit tcp any any access-list utside_acl permit icmp any any access-list utside_acl permit ip any any access-list 115 permit ip

33 ip address utside ip address inside arp timeut glbal (utside) 1 interface nat (inside) 0 access-list 115 static (inside,utside) netmask static (inside,utside) netmask access-grup utside_acl in interface utside rute utside fldguard enable syspt cnnectin permit-ipsec crypt ipsec transfrm-set myset esp-3des esp-md5-hmac crypt map rtpmap 10 ipsec-isakmp crypt map rtpmap 10 match address 115 crypt map rtpmap 10 set peer crypt map rtpmap 10 set transfrm-set myset crypt map rtpmap interface utside isakmp enable utside isakmp key ******** address netmask isakmp identity address isakmp nat-traversal 20 isakmp plicy 10 authenticatin pre-share isakmp plicy 10 encryptin 3des isakmp plicy 10 hash md5 isakmp plicy 10 grup 1 isakmp plicy 10 lifetime isakmp plicy 20 authenticatin pre-share isakmp plicy 20 encryptin 3des isakmp plicy 20 hash md5 isakmp plicy 20 grup 2 isakmp plicy 20 lifetime

34 IPSec VPN Trubleshting Mst VPN prblems are due t cnfiguratin issues. Mst Cmmn VPN Setup Errrs 1) The first thing t check fr is that the Remte VPN Device address matches that f the remte devices WAN interface, and vice versa. This is ne f the mst cmmn mistakes, particularly when bth a primary and backup tunnel are cnfigured. 2) Anther cmmn errr is that the Remte Prbe Address is nt pingable by the Edge appliance when the VPN is enabled. This can be due t a number f reasns, including: the device is nt able t respnd t pings, a firewall rule, r a NAT/Vectr Map rule which nly allws the prbe address t respnd thrugh the WAN interface (nt the VPN interface). NOTE: The prbe address shuld never be a device that has any NAT/Vectr Map translatins. 3) The Shared Secret key des nt match at each end f the VPN tunnel. This is an bvius ne, but very cmmn. 4) The Remte Netwrk Address is either incrrect, r a static rute has nt been prperly added t either side f the VPN. If yu are ruting VPN traffic thrugh an existing firewall t the LAN netwrk, static rutes MUST be added t ensure that the unencrypted traffic cming ut f the tunnel knws hw t get t the LAN netwrk. 5) If a primary and backup tunnel are created, the backup tunnel was als started, which will nt wrk. VPN Stps Wrking There are a hst f issues that culd cause a VPN t stp wrking. Including: 1) High latency between remte sites which causes the VPN prbes t fail 2) The flapping f the WAN interface(s) 3) Packet lss between remte sites which culd stp the VPN frm receiving keep-alive packets in a timely fashin. Mst f these issues can be addressed using the VPN Parameters sectin t ffset high latency and packet lss issues. Tls->VPN Parameters 33

35 The abve image shws the default settings fr the VPN, hwever they may be changed in rder t accmmdate varius netwrk envirnments. Increasing the Heartbeat infrmatin is generally the mst useful way f allwing fr higher latency and packet lss. Resetting The VPNs If a VPN failure ccurs and des nt cme back up autmatically, yu may need t manually reset the tunnels. The prcess fr resetting the tunnels is as fllws: 1) Stp ALL assciated VPN tunnels. 2) Start nly the primary tunnel fr the cnnectin. 3) Make sure that any backup tunnels are stpped. NOTE: If yu nly have a single tunnel, the Restart All buttn shuld be clicked at bth ends f the tunnel, starting with the HUB and then the client. 34