How do I set up a branch office VPN tunnel with the Management Server?

Transcription

1 Fireware How To VPN How do I set up a branch office VPN tunnel with the Management Server? Introduction Using the WatchGuard Management Server, you can make fully authenticated and encrypted IPSec tunnels with a drag-and-drop or menu interface. The Management Server safely transmits IPSec VPN configuration information between Fireboxes and makes the task of creating IPSec VPN tunnels much easier. With WatchGuard System Manager and a Management Server, you configure, manage, and monitor all WatchGuard devices across a company. You can create and manage VPN tunnels between Firebox X Peak, Firebox X Core, Firebox, Firebox III, Firebox X Edge, and Firebox SOHO devices, even if the devices have dynamic IP addresses. The remote Fireboxes connect to the Management Server when they come online and download the VPN configuration information they need to configure their end of the VPN tunnel. If you use certificates for tunnel authentication, you can configure the Management Server as a certificate authority to create certificates automatically. Steps in creating a managed VPN Set up a Management Server (and Certificate Authority if needed) Add Fireboxes or Firebox X Edge or SOHO devices to the Management Server configuration Make policy templates to determine which networks have access through VPN tunnels Make security templates to set the encryption type and authentication type Create tunnels between the devices Is there anything I need to know before I start? Before you create a managed branch office VPN tunnel, you must make sure you have configured a Management Server and have added the VPN endpoints to the Management Server configuration as managed devices. For more information about this procedure, see HowTo_SetupManagementServer.pdf. Configuring a Firebox with a Dynamic IP Address as a Managed Client To allow WatchGuard System Manager to manage a Firebox, Edge, or SOHO with a dynamic IP address, you must enable it as a managed Firebox client. There are separate instructions below to configure a Firebox III or Firebox X as a managed Firebox client, and to configure a Firebox X Edge or SOHO as a managed Firebox client. Make sure that the Management Server is configured and that you added the required devices. For more information, see Caution After you add a dynamically addressed Firebox to the Management Server, you must restart the Firebox so that it can connect to the Management Server to get its configuration. 1

2 Configuring a Firebox X Core or X Peak running Fireware as a managed VPN client 1 From Policy Manager, select VPN > Managed Client. The Managed Client Setup dialog box appears. 2 To set up a Firebox as a managed device, select the Enable this Firebox as a Managed Client check box. 3 In the Client Name box, type the name you want to give the Firebox. 4 To enable the managed client to send log messages to the log server, select the Enable diagnostic logs check box. (We recommend this option only to perform troubleshooting.) 5 In the Management Server address box, type the IP address of the Management Server if it has a public IP address. Or, type the public IP address of the Firebox that protects the Management Server. The Firebox protecting the Management Server automatically monitors all ports used by the Management Server and will forward any connection on these ports to the configured Management Server. The Firebox protecting the Management Server is configured to do this when you run the Management Server Setup Wizard. If you did not use the Management Server Setup Wizard on the Management Server, or, if you skipped the Gateway Firebox step in the wizard, configure the gateway Firebox to forward TCP ports 4110, 4112, and 4113 to the private IP address of the Management Server. 6 In the Shared Secret box, type the shared secret. 7 Click OK. 8 Start the Firebox again. The Firebox connects to the Management Server. Configuring a dynamic Firebox III or Firebox X Core running WFS as a managed client 1 From Policy Manager, select VPN > Managed Client. 2 Select the check box Enable this Firebox as a Managed Client. 3 In the Firebox Name field, give the name of the Firebox. 4 To log messages for the Managed Client, select the check box Enable diagnostic log messages for the Managed Client. (WatchGuard recommends this option only to do troubleshooting.) 5 To add management servers that the client can connect to, click Add. 6 Type the IP address. Type the shared secret. Click OK. 7 Start the Firebox again. The Firebox connects to the Management Server. 2

3 Configuring a Firebox with a Dynamic IP Address as a Managed Client Configuring a Firebox X Edge as a managed client 1 To connect to the Firebox X Edge System Status page, type in the browser address bar, and the IP address of the Edge trusted interface. The default URL is: 2 From the navigation bar, select Administration > WSM Access. The WatchGuard System Manager Access page appears. 3 Select the Enable remote management check box. 4 From the Management Type drop-down list, select WatchGuard Management System. 5 To put the Firebox X Edge into the control of WatchGuard System Manager centralized Edge management, click the Use Centralized Management check box. Do not select the Use Centralized Management check box if you are using WatchGuard System Manager only to manage VPN tunnels. When the Firebox X Edge is under centralized management, access to the Firebox X Edge configuration pages is set to readonly. The only exception is access to the WSM Access configuration page. If you disable the remote management feature, you get read-write access to the Firebox X Edge configuration pages again. 6 Type a status passphrase for your Firebox X Edge and then type it again to confirm in the correct fields. 7 Type a configuration passphrase for your Firebox X Edge and then type it again to confirm in the correct fields. Caution These passphrases must match the passphrases you use when you add the device to WatchGuard System Manager or the connection will fail. 8 In the Management Server Address text box, type the IP address of the Management Server if it has a public IP address. If the Management Server has a private IP address, type the public IP address of the Firebox protecting the Management Server. The Firebox protecting the Management Server automatically monitors all ports used by the Management Server and will forward any connection on these ports to the configured Management Server. No special configuration is necessary for this to occur. 9 Type the Client Name to give your Firebox X Edge. This is the name used to identify the Edge in the Management Server. 10 Type the Shared Key. The shared key is used to encrypt the connection between the Management Server and the Firebox X Edge. This shared key must be the same on the Edge and the Management Server. You must get the shared key from your VPN administrator. 11 Click Submit. 12 Start the Firebox again. The Firebox connects to the Management Server. Configuring a dynamic Firebox SOHO6 as a managed client 1 Start your web browser. Type the IP address of the SOHO6. 2 If the SOHO6 must have a login and passphrase, type the login and passphrase.

4 3 Below Administration, click VPN Manager Access. The VPN Manager Access page appears. 4 Select the Enable VPN Manager Access check box. 5 Type the status passphrase for VPN Manager access. Type the status passphrase again to confirm the passphrase. 6 Type the configuration passphrase for VPN Manager access. Type the configuration passphrase again to confirm the passphrase. 7 Click Submit. The SOHO6 device is configured for management by the Management Server. 8 Start the Firebox again. The Firebox connects to the Management Server. Adding Policy Templates For a VPN, you can configure (and put a limit to) the networks that have access through the tunnel. You can make a VPN between two hosts or between more networks. To configure the networks that are available through a given VPN device, you make policy templates. By default, WatchGuard System Manager (WSM) adds and applies a network policy template that gives access to the network behind the VPN device, if the device has a static IP address. Get the current templates from a device Before you add more policy templates, get the current templates from the device. This is most important for dynamic devices because the Firebox automatically adds a network policy template for static devices. Before you update a device, make sure that it is configured as a managed Firebox client. 1 In WatchGuard System Manager on the Device Management tab, select a managed client, and then select Edit > Update Device. The Update Device dialog box appears. 2 Select the Download Trusted and Optional Network Policies check box. 3 Click OK. Make a new policy template To make a policy template, on the Device Management tab: 1 Select the device for which you want to configure a policy template. 4

5 Adding Security Templates 2 Right-click and select Insert VPN Resource or click the Insert VPN Resource icon. The VPN Resource dialog box for that device appears. 3 In the Policy Name box, type the policy name you want. 4 Add, edit, or delete resources from the tunnel policy. Click Add to add an IP address or a network address to the tunnel policy. Click Edit to edit a resource that you have selected in the list. Select a resource in the Resources list and click Remove to delete a resource. 5 Click OK. The policy template is configured and is available in the VPN configuration area. Adding resources to a policy template 1 From the VPN Resource dialog box, click Add. The Resource dialog box appears. 2 From the Allow to/from drop-down list, select the resource type, and then type the IP address or network address in the adjacent address box. 3 Click OK. Adding Security Templates A security template gives the encryption type and authentication type for a tunnel. Default security templates are supplied for the available encryption types. You can also make new templates. Security templates make it easy to set the encryption type and authentication type with the tunnel from the Configuration Wizard. To make a policy template, on the Device Management tab: 1 Right-click in the window, and select Insert Security Template or click the Insert Security Template icon (shown at the left side). The Security Template dialog box appears.

6 2 In the Template Name box, type the template name you want to use. From the Authentication and Encryption drop-down lists, select the authentication method and encryption method. 3 To set the end date for a key, select the Force key expiration check box, and then select the kilobytes or hours until the expiration. If you give two values, the key stops at the event that comes first. The security template is configured. You can select it in the VPN Wizard when you make a VPN tunnel with that device. 4 Click OK. Making Tunnels Between Devices You can configure a tunnel with the drag-and-drop procedure or the Add VPN wizard. Using the drag-and-drop procedure To use the drag-and-drop tunnel procedure, dynamic Fireboxes and Firebox X Edge or SOHO devices must have networks that are configured before you can use this procedure. You must also get the policies from any new dynamic devices before you configure drag-and-drop tunnels. On the Device Management tab: 1 On one of the tunnel endpoints, click the device name. Drag-and-drop the name to the device name at the other tunnel endpoint. The Add VPN wizard starts. 2 Click Next. 3 The gateway devices screen shows the two endpoint devices you selected with drag-and-drop, and the policy templates that the tunnel uses. If the endpoints are not shown, select them on this screen. 4 From the drop-down list, select a policy template for each device. The policy template configures the resources available through the tunnel. Resources can be a network or a host. The drop-down list shows the policy templates that you added to WatchGuard System Manager. 5 Click Next. The wizard shows the Security Policy dialog box. 6 Select the security template applicable for the type of security and type of authentication to use for this tunnel. The list shows the templates you added to the Management Server. 7 Click Next. The wizard shows the configuration. 8 Select the Restart devices now to download VPN configuration check box. Click Finish to start the devices again and deploy the VPN tunnel. Using the Add VPN wizard without drag-and-drop To create tunnels using the Add VPN wizard without drag-and-drop: 1 From the Device Management tab, select Edit > Create a new VPN or click the Create New VPN icon. This starts the Add VPN wizard. 2 Click Next. The wizard shows two lists that each show all the devices registered in the Management Server. 6

7 3 Select a device from each list box to be the endpoints of the tunnel you make. 4 Select the policy templates for the end of the tunnel of each device. The list shows the templates added to the Management Server. 5 Click Next. The wizard shows the Security Template dialog box. 6 Select the applicable security template for this VPN and click Next. The wizard shows the configuration. 7 Select the Restart devices now to download VPN configuration check box. Click Finish to start the devices again and deploy the VPN tunnel. Frequently Asked Questions About This Procedure Can I restrict the traffic through the managed VPN tunnel to allow only specified ports? No. The Management Server automatically adds an Any service to the configuration of a Firebox III or Firebox X using WFS appliance software. It automatically adds an Any policy to the configuration of a Firebox X running Fireware appliance software. You cannot delete the Any service or policy when you use managed VPN tunnels. The Firebox X Edge and Firebox SOHO6 have a hidden policy that opens all ports through a managed VPN tunnel. You cannot change this hidden policy. If you want to restrict the ports that are open in a VPN tunnel, you must use a manual IPSec branch office VPN tunnel, instead of a managed BOVPN tunnel. SUPPORT: [email protected] U.S. and Canada COPYRIGHT 2006 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, Firebox, and Core are registered trademarks or trademarks of WatchGuard Technologies, Inc. in the United States and/or other countries. 7

8 8