How To Establish IPSec VPN between Cyberoam and Microsoft Azure

Transcription

1 How To Establish IPSec VPN between Cyberoam and Microsoft Azure How To Establish IPSec VPN Connection between Cyberoam and Microsoft Azure Applicable Version: onwards Overview Microsoft Azure is a cloud computing platform and infrastructure, created by Microsoft, for building, deploying and managing applications and services through a global network of Microsoft-managed datacenters. It provides both PaaS and IaaS services and supports many different programming languages, tools and frameworks, including both Microsoft-specific and third-party software and systems. This article describes how to configure an IPSec VPN connection between Cyberoam and virtual networks hosted on Microsoft Azure. Cyberoam allows secure IPSec VPN connection with MS Azure such that an organization can safely use it as an extension of its own network. Scenario Establish IPSec VPN connection between Cyberoam and Microsoft Azure. Prerequisite You should be registered with and have access to Microsoft Azure. For details, refer to Azure Configuration You can configure the VPN connection in Azure by following the steps given below.

2 Step 1: Create Local Network How To Establish IPSec VPN Connection between Cyberoam and Microsoft Azure Sign in to your Azure Account and go to Networks > Local Networks and click Add a Local Network to create a Local Network that represents Cyberoam LAN in the VPN connection. Specify Local Network Details, as shown below.

3 Specify the Address Space of the LAN and click to save the Local Network. Step 2: Create Virtual Network Go to Networks > Virtual Networks and click Create a Virtual Network to launch the Create Virtual Network Wizard.

4 Specify the Name and Affinity Group of the Virtual Network. Click to go to the next configuration screen. Check Configure a site-to-site VPN and select Cyberoam_LAN, created in step 1, as the Local Network. Click to go to the next configuration screen.

5 Specify the address space and subnet of the Virtual Network, and add the gateway subnet by clicking add gateway subnet and specifying the values. Click to add to save the Virtual Network. Step 3: Add Gateway to Virtual Network Once Virtual Network is created, click on the newly created Virtual Network and go to the Dashboard. Click Create Gateway at the bottom of the screen and select Static Routing to associate a gateway to the Virtual Network through which it would connect to Cyberoam LAN.

6 It takes a few minutes to create the Gateway. Step 4: Obtain Preshared Key Once Virtual Network is configured, obtain the Preshared Key which would be used in Cyberoam by clicking Manage Key at the bottom of the screen.

7 The Preshared Key to be used is displayed on the screen, as shown below. Step 5: Create Virtual Machine to be accessed over VPN Go to Virtual Machines and click Create a Virtual Machine.

8 The New tab at the bottom of the screen pops up. Select Compute > Virtual Machine > From Gallery to start the Create Virtual Machine Wizard. Select the Image of Virtual Machine to be created. Here, as an example, we create a Windows Server 2012 R2 Datacenter. Click to go to the next configuration screen.

9 Specify the Virtual Machine details, as shown below.

10 Check Install the VM Agent and click to save the Virtual Machine. The above configuration prepares Azure to connect to Cyberoam over VPN. Cyberoam Configuration After configuration of VPN connection on Azure, configure IPSec connection in Cyberoam. You can configure IPSec in Cyberoam by following the steps given below. Configuration is to be done from the Cyberoam Web Admin Console using profile having read-write administrative rights over relevant features. Step 1: Create VPN Policy Go to VPN > Policy > Policy and click Add to add a new policy. Note: Configure IPSec Parameters in Cyberoam s VPN Policy to match the IPSec Parameters supported by Azure. For information on parameters supported by Azure, refer to

11 Parameter Value Description Name CR_Azure Specify a name to identify the VPN Policy. Keying Method Allow Re-Keying Key Negotiation Tries 3 Authentication Mode Pass Data in Compressed Format Perfect Forward Secrecy (PFS) Phase 1 Encryption Algorithm Authentication Algorithm DH Group (Key Group) Automatic Disable Main Mode Enable Disable 3DES SHA1 Key Life (DH1024) Keying Method defines how the keys for the connection are to be managed. Select Keying Method from the available options. Available Options: - Automatic - Manual Enable Re-Keying to start the negotiation process automatically before key expiry. Specify maximum key negotiation trials allowed. Set 0 for unlimited number of trials. Select Authentication Mode. Authentication Mode is used for exchanging authentication information. Available Options: - Main Mode - Aggressive Mode Enable to pass data in compressed format to increase throughput. Enable to generate new key for every negotiation on key expiry and disable to use same key for every negotiation. Select encryption algorithm that would be used by communicating parties for integrity of exchanged data for phase 1. Select Authentication Algorithm that would be used by communicating parties for integrity of exchanged data for phase 1. Select one Diffie-Hellman Group from 1, 2, 5, 14, 15 or 16. DH Group specifies the key length used for encryption. Specify Key Life in terms of seconds. Key Life is the amount of time that will be allowed to pass before the key expires.

12 Re-Key Margin 120 Randomize Re-Keying Margin By Dead Peer Detection Disable Phase 2 Encryption Algorithm Authentication Algorithm PFS Group (DH Group) Specify Re-Key Margin. Re-Key Margin is the time when the negotiation process should be started automatically without interrupting the communication before the key expiry. 0 Specify Randomize Re-Keying time. 3DES SHA1 Key Life 3600 Same as Phase-1 Enable to check at regular interval whether peer is live or not. Select Encryption Algorithm that would be used by communicating parties for integrity of exchanged data for phase 2. Select Authentication Algorithm that would be used by communicating parties for integrity of exchanged data for phase 2. Select one Diffie-Hellman group from 1, 2, 5, 14, 15 or 16. DH Group specifies the key length used for encryption. Specify Key Life in terms of seconds. Key Life is the amount of time that will be allowed to pass before the key expires. Click OK to save policy.

13 Step 2: Configure IPSec Connection Go to VPN > IPSec > Connection and click Add to create a new connection using parameters given below. Parameter Description Parameter Value Description Name CR_to_Azure Name to identify the IPSec Connection Connection Type Policy Site to Site Action on VPN Restart Respond Only Authentication details Authentication Type Preshared Key Endpoints Details Local Select Type of connection. Available Options: - Remote Access - Site to Site - Host to Host CR_Azure(created Select policy to be used for connection in step 1) Preshared Key Select the action for the connection. Available options: - Respond Only - Initiate - Disable Select Authentication Type. Authentication of user depends on the connection type. <As obtained from Azure Virtual To obtain Preshared Key from Azure, refer to step 4 of Network created Azure Configuration above > PortB Remote Local Network Details Local Subnet /24 Remote Network Details Remote LAN Network /27 Select local port which acts as end-point to the tunnel Specify Gateway IP Address assigned to Azure Virtual Network. It can be obtained from the Dashboard of the Virtual Network created in step 3 of Azure Configuration. Select Local LAN Address. Add and Remove LAN Address using Add Button and Remove Button Select IP addresses and netmask assigned to Azure Virtual Network.

14 Click OK to create the connection. How To Establish IPSec VPN Connection between Cyberoam and Microsoft Azure

15 Step 3: Activate IPSec Connection Go to VPN > IPSec > Connection and click BO_to_HO connection, created in step 2. under Active and Connection heads against Under the Active status indicates that the connection is successfully activated. Under the Connection status indicates that the connection is successfully established. Document Version: April, 2014