GlobalProtect Configuration for IPsec Client on Apple ios Devices

Transcription

1 GlobalProtect Configuration for IPsec Client on Apple ios Devices Tech Note PAN-OS 4.1 Revision D 2013, Palo Alto Networks, Inc.

2 CONTENTS OVERVIEW... 3 PREREQUISITES... 3 GLOBALPROTECT GATEWAY SETUP... 3 CERTIFICATE CREATION... 3 GLOBALPROTECT GATEWAY CONFIGURATION... 5 APPLE IOS SETUP... 6 EXPORTING AND IMPORTING CERTIFICATES... 6 CREATING A VPN PROFILE... 8 APPLE IPHONE CONFIGURATION UTILITY... 9 OBTAINING THE UTILITY... 9 CREATING A CONFIGURATION PROFILE... 9 DISTRIBUTING THE CONFIGURATION PROFILE PRE-SHARED SECRET AUTHENTICATION CONFIGURING A PRE-SHARED SECRET ON THE GLOBALPROTECT GATEWAY CONFIGURING A PRE-SHARED SECRET ON THE IOS DEVICE CONFIGURING A PRE-SHARED SECRET IN THE APPLE IPHONE CONFIGURATION UTILITY DISTRIBUTING CONFIGURATION PROFILES USING MDM SOFTWARE MOBILEIRON ZENPRISE REVISION HISTORY , Palo Alto Networks, Inc. [2]

3 Overview This document discusses the use of the built-in IPSec client for ios. For information on the new GlobalProtect app for ios released in March of 2013, refer to the tech note at The GlobalProtect ios app enables you to benefit from all features of GlobalProtect solution and is recommended over the built-in IPsec client. The IPSec configuration described in this tech note only applies to configuration of built in IPsec VPN client of Apple ios devices. In its original design, IKE only addressed authentication of two devices through a pre-shared symmetric key or a private/public key, in which the public key needed to be exchanged between the two devices to establish a secure tunnel. Extended Authentication (X-Auth) describes a method of authenticating users as part of the IKE handshake between an IPSec client and gateway after the initial key exchange in phase 1. This concept is supported in a variety of IPSec VPN clients, such as the built in VPN client of Apple ios devices like the iphone and ipad. In this tech note, we describe the steps needed to configure an existing GlobalProtect Portal/Gateway environment to enable Apple ios devices to establish VPN connectivity using the built-in ios IPSec client. There are three methods for authentication that will be discussed: self-signed certificate, certificate issued by a root Certificate Authority (CA), and pre-shared secret. Prerequisites GlobalProtect Gateway Support for X-Auth is introduced in PAN-OS 4.1 as a feature of GlobalProtect Gateway and doesn t require any specific license to be activated. Apple ios Supported Apple ios device running ios 4.3 and later. GlobalProtect Gateway Setup This section describes how to setup the GlobalProtect Gateway and Apple ios with certificate based authentication for IKE phase 1 and user based authentication (X-Auth) thereafter. The benefit of such a setup is that you could either use certificates created in the PAN-OS management UI to reliably identify corporate devices, but also use certificates issued by an external certificate authority to authenticate individual devices in the enterprise prior to authenticating the user. Certificate Creation In order to setup certificate-based IKE phase 1 authentication, you need to create three certificates either in the PAN-OS management UI or in an external certificate authority. 2012, Palo Alto Networks, Inc. [3]

4 Root Certificate Authority Every Public Key Infrastructure requires a central source of its trust, which in an X.509 world is usually referred to as the Root Certificate Authority. Like every product leveraging certificate based authentication, GlobalProtect requires the existence of a Root Certificate, which can be either created within PAN-OS or from an external certificate authority (CA). If an external certificate authority is used, the root certificate needs to be imported into PAN-OS. 1. To create a certificate locally, navigate to the Certificate page on the Device tab and select Generate. 2. Enter a unique name for the certificate. 3. Leave the Signed By field empty and select the Certificate authority checkbox underneath. 4. Click Generate. Gateway Certificate The certificate for the gateway can be created on PAN-OS or imported from an external certificate authority. This section only covers how to create a certificate locally with a CA certificate on the device 1. To create a certificate locally, navigate to the Certificate page on the Device tab and select Generate. 2. Enter a unique name for the certificate in the configuration. 3. Enter the gateway s DNS hostname as the Common Name (CN). 4. Enter the gateway s IP address in IP address field. Use the device s internal and assigned IP address if your device resides behind a NAT device. 5. Select the certificate authority created in the Root Certificate Authority section in the Signed By drop-down to issue this certificate. 6. Click Generate. 2012, Palo Alto Networks, Inc. [4]

5 Identity Certificate In the case of certificate based authentication, the client and the gateway go through a mutual authentication. Therefore the ios device requires a certificate from a certificate authority trusted by the gateway. This certificate can either be issued by an external certificate authority or from PAN-OS. This section describes the creation of a client certificate (referred to as an Identity Certificate in ios) in PAN-OS and the process to export this certificate. 1. To create a certificate locally, navigate to the Certificate page on the Device tab and select Generate. 2. Enter a unique name for the certificate in the configuration. 3. Enter any name in the Common Name (CN). 4. Select the certificate authority to issue this certificate. 5. Click Generate. Certificate Profile In order to validate the client certificate, a Client Certificate Profile needs to be created which includes the CA certificate used to create the Identity Certificate. Please refer to the corresponding section on creating Client Certificate Profiles in the Palo Alto Networks Administrator s Guide. GlobalProtect Gateway Configuration The following section describes the necessary steps to enable X-Auth required to support Apple ios devices on an existing GlobalProtect gateway configuration. 2012, Palo Alto Networks, Inc. [5]

6 Note: If there is no existing GlobalProtect Portal/Gateway configuration, please refer to the corresponding section in the Palo Alto Networks Administrator s Guide on how to configure a GlobalProtect Gateway. 1. In the Server Certificate drop-down, select the gateway certificate created in the Gateway Certificate section of this document. 2. In the Client Certificate Profile drop-down, select the certificate profile which includes the CA certificate used to issue the client certificate in the Client Certificate section. 3. Enable Tunnel Mode and select Enable IPSec. 4. Enable Enable X-Auth Support to enable Extended Authentication. 5. Leave the Group Name and Group Password fields empty to enable certificate authentication in IKE phase Click OK and commit the configuration changes. Apple ios setup As with the previous section, this section focuses on integrating Apple ios devices into GlobalProtect Gateway using certificate based authentication in IKE phase 1. Exporting and Importing Certificates As the first step, the certificates created in the Root Certificate Authority and Identity Certificate section need to be exported from PAN-OS and imported into the ios device. Exporting the Root Certificate Authority 1. In the PAN-OS management UI, navigate to the certificate section in the device configuration tab. 2012, Palo Alto Networks, Inc. [6]

7 2. Select the Root CA certificate created in the Root Certificate Authority section of this document. 3. Click Export and select Base64 Encoded Certificate (PEM) as the file format. 4. Uncheck the Export private key checkbox and click OK. Importing the Root Certificate into ios 1. Create a new and attach the Root Certificate exported in the section above. 2. Send the to the ios user. 3. On the device, open the new and tap on the root certificate attached. 4. Select install in the certificate information. 5. Select Install Now when prompted in the dialog and enter your device password. Exporting the Identity Certificate 1. In the PAN-OS management UI navigate to the certificate section in the device configuration tab. 2. Select the Identity Certificate created in the Identity Certificate section of this document. 3. Click Export and select Encrypted Private Key and Certificate (PKCS12) as the file format. 4. Enter an export password and click OK. 2012, Palo Alto Networks, Inc. [7]

8 Importing the Identity Certificate into ios 1. Compose a new and attach the Identity Certificate exported in the section above. 2. Send the to the ios user. 3. On the device, open the new and tap on the identity certificate attached. 4. Select install in the certificate information. 5. Select Install Now when prompted in the dialog and enter your device password. 6. Enter the export password you specified in the previous section and click Next Creating a VPN Profile To create a VPN profile in ios, open the settings dialog and navigate to the General > Network > VPN section and perform the following: 1. Select IPSec as the type. 2. Define a descriptive name for this connection. 3. Enter the address of the GlobalProtect Gateway. 4. Enter the username and password for this ios device user. 5. Enable the Use Certificate option. 6. Select the Identity Certificate in the certificate selection. 2012, Palo Alto Networks, Inc. [8]

9 7. Click Save Your VPN profile is now configured and you can enable the VPN connection through the ios device Settings. Apple iphone Configuration Utility To simplify configuration of the ios VPN client and push out a configuration to all of your users, you can use the iphone Configuration Utility from Apple. This section describes how to create a configuration for ios devices and distribute it. Obtaining the Utility The utility and documentation can be accessed at Creating a Configuration Profile First, after opening the iphone Configuration Utility, you need to create a new configuration profile for your ios users. Importing the Credentials As the next step, you need to import the Root Certificate and Identity Certificate created in the previous sections. 1. In the iphone Configuration Utility, select Credentials and click configure 2012, Palo Alto Networks, Inc. [9]

10 2. Click the add icon and select the Root Certificate file you exported earlier and click ok. 3. Click the add icon and select the Identity Certificate file (PKCS12) you exported earlier and then click ok. 4. Enter the export password you defined earlier in the password field below the Identity Certificate display. Creating a VPN profile Next you need to create the profile for the IPSec client connection. 1. In the iphone Configuration Utility, select VPN and click Configure. 2. Define a meaningful connection name. 3. For the connection type, choose IPSec. 4. Leave the Account Name empty unless you want to pre-populate a user name for this configuration. 5. Select Certificate under Machine Authentication and choose the Identity Certificate imported in the previous section. 6. Select Share in the toolbar to start the distribution of the profile. 2012, Palo Alto Networks, Inc. [10]

11 Optional Automatic Connection Configuration If you want the ios VPN to automatically bring up a VPN connection when accessing internal resources, you can use the Enable VPN On Demand settings. This is only available when using the Certificate authentication type. In the VPN On Demand section, add strings that match internal hostnames or IP addresses. When ios attempts a connection to anything containing a string in the list that is set to Always establish it will initiate the VPN first. 2012, Palo Alto Networks, Inc. [11]

12 Distributing the Configuration Profile The easiest way to distribute the configuration profile to a group of users is via . After you select Share in the iphone Configuration Utility, you can select to send the profile via Send the to the target user or users. 2. On the ios device, open the and tap on the attached configuration profile. 3. Select Install in the configuration verification dialog and Install now in the following pop-up dialog. Your VPN profile is now configured and you can enable the VPN connection through the ios device Settings. For more information on distributing profiles, refer to Distributing Configuration Profiles Using MDM Software. Pre-Shared Secret Authentication As an alternative to using certificate based authentication in IKE phase 1, you can configure a preshared secret based authentication method. This configuration is recommended for a single gateway environment or for a small number of gateways since the configuration would have to be replicated on each gateway. Also, the client will not have the functionality to find the nearest gateway in a multi-gateway environment; it will only connect directly to the gateway that is defined on the client. Configuring a Pre-Shared Secret on the GlobalProtect Gateway 1. On the GlobalProtect Gateway, navigate to Network > GlobalProtect > Gateways and create a new Gateway configuration or modify an existing Gateway. 2. From the General tab, enable Tunnel Mode and then select Enable IPSec and Enable X-Auth Support. 3. Enter a Group Name. 4. Enter and confirm the Group Password. 5. Click Ok and then commit the configuration. Configuring a Pre-Shared Secret on the ios Device 1. On the Apple device, open Settings and navigate to General > Network > VPN section and select Add VPN Configuration. 2. Select type IPSec. 3. Enter a description of the new profile in the Description field. 4. In the Server field, enter the address of the GlobalProtect Gateway. 5. Enter your username in the Account field and your password in the Password field. 6. Enter the group name configured previously in the Group Name field. 2012, Palo Alto Networks, Inc. [12]

13 7. Enter the group password in the Secret field. 8. Select Save to save your configuration. 9. To enable the VPN, open Settings and navigate to General > Network > VPN and change VPN to ON. If you have multiple VPN profiles, select the desired profile first, then enable the VPN. 2012, Palo Alto Networks, Inc. [13]

14 Configuring a Pre-Shared Secret in the Apple iphone Configuration Utility If you configure a pre-shared secret through the iphone Configuration Utility, you don't need to go through any of the certificate import steps previously outlined. Just perform the following steps to create your VPN configuration profile: 1. In the iphone Configuration Utility, select VPN and click Configure. 2. Define a meaningful connection name. 3. For the connection type chose IPSec. 4. Leave the Account Name empty unless you want to pre-populate a user name for this configuration. 5. Select Shared Secret / Group Name in the Machine Authentication drop down menu. 6. Enter the group name configured previously in the Group Name field. 7. Enter the group password in the Secret field. 8. Select Share in the toolbar to start the distribution of the profile. 2012, Palo Alto Networks, Inc. [14]

15 Distributing Configuration Profiles using MDM Software Many organizations utilize Mobile Device Management Software to enable users to securely access corporate resources with either their own personal or corporate owned tablets or smart phones. These platforms can also be leveraged to distribute and maintain GlobalProtect ios VPN Connectivity. Two vendors that have been tested and verified to work with Palo Alto Networks Next Generation Firewalls are MobileIron and Zenprise. MobilIron Zenprise MobileIron MobileIron reduces the cost, risk and usability challenges associated with mobile device management. The MobileIron Virtual Smartphone Platform is the first solution to combine data-driven smart device management with real-time wireless cost control. MobileIron is a flexible platform and offers many features to control and secure mobile platforms, this configuration relies on a properly installed VSP instance with ios MDM Certificate signed and installed prior to configuring the MobileIron VSP platform to distribute GlobalProtect profiles. It is also assumed that ios devices are already enrolled in the MobileIron system. First, create or ensure that a label exists within the MobileIron VSP, in this case we are leveraging an existing label Company-Owned Next, the certificates created in the Root Certificate Authority and Identity Certificate section need to be exported from PAN-OS and imported into the MobileIron VSP. 2012, Palo Alto Networks, Inc. [15]

16 Exporting the Root Certificate Authority 1. In the PAN-OS management UI, navigate to the certificate section in the device configuration tab. 2. Select the Root CA certificate created in the Root Certificate Authority section of this document. 3. Click Export and select Base64 Encoded Certificate (PEM) as the file format. 4. Uncheck the Export private key checkbox and click OK. Importing the Root Certificate into MobileIron VSP 1. Under Apps & Files select Add New > Certificates. 2. Fill in the required fields and upload the exported Root Certificate Authority and click save. 2012, Palo Alto Networks, Inc. [16]

17 3. Apply the Certificate to the label by selecting the check box next to the certificate entry that was just created, then Select More Actions > Apply to Label. 4. Select the check box next to Company-Owned and click Apply. Exporting the Identity Certificate 1. In the PAN-OS management UI navigate to the certificate section in the device configuration tab. 2. Select the Identity Certificate created in the Identity Certificate section of this document. 3. Click Export and select Encrypted Private Key and Certificate (PKCS12) as the file format. 4. Enter an export password and click OK. Importing the Identity Certificate into MobileIron VSP 1. Under Apps & Files select Add New > Certificates. 2012, Palo Alto Networks, Inc. [17]

18 2. Fill in the required fields and upload the exported Identity Certificate and click save. 3. Apply the Certificate to the label by selecting the check box next to the certificate entry that was just created, then Select More Actions > Apply to Label. 4. Select the check box next to Company-Owned and click Apply. 2012, Palo Alto Networks, Inc. [18]

19 Creating an ios VPN Profile in MobileIron VSP To create a VPN profile in MobileIron, Under Apps & Files > App Settings Select Add New > VPN: 1. Define a name for this connection. 2. Enter a Description. 3. Select IPSec as the connection type. 4. Enter the IP Address or resolvable hostname of the GlobalProtect gateway. 5. Enter $USERID$ to automatically populate user name with enrolled user data. 6. Enter $PASSWORD$ to automatically populate password with enrolled user data. 7. For Authentication, select Certificate from the drop down list. 8. For Identity Certificate, select the Client Identity Certificate that was just imported. 2012, Palo Alto Networks, Inc. [19]

20 9. If desired, select VPN on Demand and populate match criteria for automatically bringing up the VPN. 10. Save the VPN Profile, then select More Actions > Apply to Label. 11. Select the check box next to Company-Owned and click Apply. Your VPN profile is now configured in MobileIron and will be automatically distributed to all managed devices attached to the Company-Owned label. Once deployed, the VPN connection can be enabled through the ios device Settings or automatically depending on the VPN on-demand and match settings in MobileIron. Zenprise Zenprise is focused on managing mobile device lifecycle for enterprise customers. Whether delivered as an on-premise mobile device management server or cloud solution, Zenprise MobileManager lets you manage the device lifecycle across every major platform-----iphone, ipad, Android, BlackBerry, Symbian, and Windows Mobile. Zenprise is a flexible platform and offers many features to control and secure mobile platforms, this configuration relies on a properly installed Device Manager instance with ios MDM Certificate signed and installed prior to configuring the Zenprise Device Manager platform to distribute GlobalProtect profiles. It is also assumed that ios devices are already enrolled in the Zenprise system. First, the certificates created in the Root Certificate Authority and Identity Certificate section need to be exported from PAN-OS and imported into the Zenprise Device Manager. 2012, Palo Alto Networks, Inc. [20]

21 Exporting the Root Certificate Authority 1. In the PAN-OS management UI, navigate to the certificate section in the device configuration tab. 2. Select the Root CA certificate created in the Root Certificate Authority section of this document. 3. Click Export and select Base64 Encoded Certificate (PEM) as the file format. 4. Uncheck the Export private key checkbox and click OK. Importing the Root Certificate into Zenprise Device Manager 1. Under Policies, select ios > Configurations from the left menu. 2. Select New Configuration > Profiles and Settings > Credentials. 3. Fill in the required fields, Select the Credential tab and upload the exported Root Certificate Authority and click Create , Palo Alto Networks, Inc. [21]

22 2. Exporting the Identity Certificate 1. In the PAN-OS management UI navigate to the certificate section in the device configuration tab. 2. Select the Identity Certificate created in the Identity Certificate section of this document. 3. Click Export and select Encrypted Private Key and Certificate (PKCS12) as the file format 4. Enter an export password and click OK. Importing the Identity Certificate into Zenprise Device Manager 1. Under Policies, select ios > Configurations from the left. 2. Select New Configuration > Profiles and Settings > Credentials. 3. Fill in the required fields, Select the Credential tab and upload the exported Identity Certificate and click Create. 2012, Palo Alto Networks, Inc. [22]

23 Creating an ios VPN Profile in Zenprise Device Manager To create a VPN profile in Zenprise, Under Policies, select ios > Configurations from the left menu: 1. Select New Configuration Profiles and Settings VPN 2. Under General, enter a unique Identifier and Display Name 3. Under VPN, enter the Connection name displayed on the device 4. Select IPSec as Connection type 2012, Palo Alto Networks, Inc. [23]

24 5. Enter the Hostname or IP of the GlobalProtect Gateway 6. Enter User account and password if desired (Variables can also be utilized to auto populate from database) 7. For Authentication type for the connection, select Credential from the drop down list 8. For Identity credential, Select the Client Identity Certificate that was just imported 9. If desired Select VPN on Demand and populate match criteria for automatically bringing up the VPN. 10. Click Create , Palo Alto Networks, Inc. [24]

25 4. Deploying an ios VPN Profile in Zenprise Device Manager 1. Under Deployment tab, select New Package > New ios Package. 2. Enter the Package Name and click next. 3. Select appropriate groups of users to receive package and click next. 4. Under Available resources > Configurations select the imported Root Certificate and click the right arrow to move it to the Resources to Deploy window. Repeat with the Identity Certificate and VPN Profile and click next. 5. For the deployment schedule, accept the default values and click next. 6. For Deployment rules, skip this by clicking next. 2012, Palo Alto Networks, Inc. [25]

26 7. On the Summary page click Finish Your VPN profile is now configured in Zenprise and will be automatically distributed to all managed devices attached to the deployment package that you created. Once deployed, the VPN connection can be enabled through the ios device settings or automatically depending on the VPN on-demand and match settings in Zenprise Device Manager. 2012, Palo Alto Networks, Inc. [26]

27 Revision History Date Revision Comment 3/27/2013 D Paragraph added under the Overview section that talks about the new GlobalProtect ios app that was released in March of It is recommended that you use this app, instead of the built-in IPsec client installed with Apple ios. 7/9/2012 C Updated Prerequisites to show that Apple ios 4.3 and later is supported. Specifically, ios 5.1 is now supported and future releases of ios will also be supported. Minor formatting updates to the pre-shared secret section. 4/20/2012 B New section on MobileIron and Zenprise added. 11/7/2011 A Initial release of this document. 2012, Palo Alto Networks, Inc. [27]