Gateway-to-Gateway VPN with Certificate

Transcription

1 VPN Gateway-to-Gateway VPN with Certificate Product SonicWALL PRO 2040 with SonicOS Enhanced SonicWALL TZ 150 Wireless with SonicOS Standard Microsoft Windows Server 2003, Standard Edition This document describes how to configure a SonicWALL Internet security appliance running SonicOS Enhanced and SonicOS Standard to implement a VPN Tunnel with Certificates. This document contains the following sections: Import CA certificate to appliance Create local certificates for appliances Create VPN Tunnel (IKE using 3rd Party Certificates) Diagnostics Gateway SonicWALL TZ 150 connects the internal LAN /24 to the Internet. Gateway SonicWALL TZ 150 s LAN interface has the address , and its WAN (Internet) interface has the address Gateway SonicWALL PRO 2040 connects the internal LAN /24 to the Internet. Gateway SonicWALL PRO 2040 s WAN (Internet) interface has the address Gateway SonicWALL PRO 2040's LAN interface address,

2 Setup Process Tasks Connect the management workstation to a SonicWALL TZ 150 LAN interface. Set the IP address of the management workstation to Log in to the management GUI of the SonicWALL security appliance using a current Web browser. Change the IP address of the internal (LAN) interface to and apply the changes. Set the IP address of the management workstation to and login again to the SonicWALL security appliance. Change the IP address of the external (WAN) interface to and apply the changes. Connect the management workstation to the SonicWALL PRO 2040 LAN interface. Set the IP address of the management workstation to Log in to the management GUI of the SonicWALL security appliance using a current Web browser. Change the IP address of the internal (LAN) interface to and apply the changes. Set the IP address of the management workstation to and login again to the SonicWALL security appliance. Change the IP address of the external (WAN) interface to and apply the changes.

3 Setup Procedures for the SonicWALL TZ 150 Import the certificate of the CA to the security appliance. The Certification Authority is part of the Microsoft Windows Server 2003 in the Microsoft Management Console 2.0. To activate the Certification Authority please follow START > Administrative Tools > Certification Authority. The Certification Authority must run as Standalone Root CA. Please select your Certification Authority, in this example it is SonicDEMO. Open the CA (for example: SonicDEMO) with a right mouse click. Select properties. Select View Certificate.

4 Under Details copy the certificate via Copy to File.

5 This starts the Certificate Export Wizard. Please use for the export file the following format: Export File Format: DER encoded binary X.509 (.CER) This file can now be copied to the management console, which is connected to TZ 150. Log into the SonicWALL security appliance s Management GUI using a current Web browser. Proceed to the VPN > CA Certificates page. Under the Please select a CA cert to import section, import the CA certificate by clicking on the Select icon. This will bring up the Select File dialog page. Now the CA certificate is imported and can be used.

6 Obtain a local certificate. Proceed to the VPN > Local Certificates page. Under the Generate Certificate Signing Request section, request a local certificate by filling the needed fields. For this scenario we also need the additional attribute , which can be specified under Subject Alternative Name (Optional) and select Address. As value we use [email protected] By clicking on the Generate icon, the request will be generated and needs to be stored. This will bring up the Export dialog page. Please select a location on your local machine.

7 Create a signed certificate Back to the CA server in the Certification Authority application. With the right mouse click on the active CA (e.g. SonicDEMO) > All Tasks > Submit new request we import the CA request from our Appliance TZ 150 to the CA system into the container pending requests To make this request a valid certificate we have to activate it. In the container pending requests select the actual request (last in the row) and with a right mouse click > All Tasks > Issue This step will move the request from pending requests to Issued certificates Export it to a file. In the container Issued certificates select the actual certificate (last in the row) and with a right mouse click > Open

8 Under Details, copy the content with Copy to File. Please use for the export file the following format: Export File Format: DER encoded binary X.509 (.CER) This file can now be copied to the management console, which is connected to TZ 150.

9 Back to the management console TZ 150, the signed certificate can be now imported. The certificate details can look like this:

10 VPN-Tunnel Definition Proceed to the VPN > Settings page. Under the VPN Policies section, add a new policy. Note: the -address is case-sensitive. All other settings are default for this Main Mode tunnel.

11 Setup Procedures PRO 2040 Import the certificate of the CA to the appliance. Log into the SonicWALL security appliance s Management GUI using a current Web browser. Proceed to the System > Certificates page. Under the Import section, import the CA certificate by selecting Import a CA certificate and clicking on the Select icon. This will bring up the Select File dialog page. Now the CA certificate is imported and can be used.

12 Obatain a local certificate. Proceed to the System > Certificates page and click the New Signing Request bottom. For this scenario we also need the additional attribute , which can be specified under Subject Alternative Name (Optional) and select Address. As value we use [email protected]

13 With the Generate botton we create the request and can save it to a file. Create a signed certificate. Please proceed the same way as TZ 150. Back to the management console on the PRO 2040, the signed certificate can be now imported with the icon.

14 The new certificate for the PRO 2040 will show up in the list of certificates. Setup Procedures VPN-Tunnel All other settings are default for this Main Mode tunnel. Diagnostics The Diagnostic Tools are located on the System > Diagnostics page. To test network connectivity you can pick Ping from the list of Diagnostic Tools. To test the tunnel from the TZ 150 to the PRO 2040 (LAN interface): PING To test the tunnel from the PRO 2040 to the TZ 150 (LAN interface): PING