Note. GNAT Box to Linksys Cable DSL Router IKE VPN

Transcription

1 G N AT B o x t o L i n k s y s C a b l e D S L R o u t e r I K E V P N This paper was written using GB-OS and the Linksys Cable DSL Router version firmware version It is written with the assumption that the user is familiar with both GNAT Box and Linksys configuration methods. The Linksys system in our examples is in the default configuration, except for the VPN. This configuration is only supported when both the GNAT Box and Linksys DSL router have static IP addresses. The Linksys Cable DSL router can be set up to work with a dynamic IP address using this method. However, each time the DSL router changes IP addresses, the GNAT Box system s remote gateway and filters for the VPN will need to be re-configured to reference the new IP address of the Linksys router. VPN interoperability should be possible with any GNAT Box system that supports IKE. For best support, the latest version of GB-OS is recommended. For more explanations of the VPN configuration, GTA highly recommends you read your systems User s Guide on the set up and configuration of the VPNs before attempting to configure your systems. E n c r y p t i o n a n d A u t h e n t i c a t i o n M e t h o d s Mode: IKE ESP: or 3 (Triple ) Hash: Sha-1 or Key Group: Diffie-hellman group 1 or 2 The Proposal lifetime of a Linksys configuration cannot exceed the configured lifetimes of the GNAT Box VPN Objects. By default phase 1 is 90 minutes and phase 2 is 60 minutes. A d d r e s s e s u s e d i n c o n f i g u r a t i o n e x a m p l e s GTA Firewall IP Addresses: External : Protected Network: /24 Linksys IP Addresses: External : Protected Network: /24

2 GNAT Box Configuration Example to a Linksys Cable DSL Router There are four functional areas to define on a GNAT Box system: VPN object. (Objects>VPN Objects) VPN Definition (Authorization>VPNs) Remote access filters to allow ESP and IKE connections to the GNAT Box firewall. (Filters>Remote Access) IP Pass Through Filters to allow communication through the VPN. (Pass Through>Filters) For more information on configuring GNAT Box VPN s and filters please refer to the GNAT Box VPN Guide and Users Guide C r e a t i n g t h e V P N O b j e c t To create a VPN object, navigate to Objects>VPN Objects. Name GB -> Linksys GNAT Box to Linksys IKE VPN Local Gateway <EXTERNAL> ; < > Local Network <PROTECTED NETWORKS> ; < /24> Mobile Authentication Unchecked Force Mobile Unchecked Phase 1 Force NAT-T DISABLED Local Identity <IP Address> ; Leave field blank Exchange Mode Main Encryption (ESP) Hash Key Group Diffie-Hellman Group 2 Lifetime 90 minutes DPD Invterval 30 seconds Phase 2 Encryption Hash Key Group Diffie-Hellman Group 2 Lifetime 60 minutes

3 C r e a t i n g t h e V P N To create the VPN, navigate to Authorization>VPNs. Key Exchange Identity VPN Object Remote Gateway Remote Network IKE GNAT Box to Linksys Leave blank GB -> Linksys (Linksys External ) /24 (Linksys Protected Network) C r e a t i n g D e f a u l t R e m o t e A c c e s s F i l t e r s To create default remote access filters, navigate to Filtes>Remote Access. 1. #DEFAULT: VPN: Allow ESP connections (GNAT Box -> Linksys VPN). Any 50 (ESP) Source IP Destination IP Destination Port Blank or 0 2. #DEFAULT: VPN: Allow IKE connections (GNAT Box -> Linksys VPN). Any UDP Source IP Destination IP Destination Port 500

4 C r e a t i n g I P P a s s T h r o u g h F i l t e r s The example filters below all allow access between the Linksys Protected Network and the GTA firewall networks. Set these filters according to your corporate security policy. 1. Example Inbound Connections Pass Through Filter VPN, inbound connections (GNAT Box -> Linksys) <EXTERNAL> ANY Source IP /24 Destination IP /24 Destination Port Blank or 0 2. Example Outbound Connections Pass Through Filter VPN, outbound connections (GNAT Box -> Linksys) <PROTECTED> ANY Source IP /24 Destination IP /24 Destination Port Blank or 0 It is recommended that the NTP service is enabled on all GTA firewalls using VPNs.

5 L i n k s y s C o n f i g u r a t i o n E x a m p l e The Linksys Cable/DSL router has only two functional areas to define for the VPN VPN Sections Advance VPN configuration. Login into your Linksys DSL router using the web administration interface and go to the VPN section. Enter the following information: This Tunnel Tunnel Name Local Secure Group Enable GB<->Linksys <Subnet> Local Secure Group IP Local Secure Group Mask Remote Secure Group <Subnet> Remote Secure Group IP Remote Secure Group Mask Remote Security Gateway IP address of the GTA firewall. In this example, the value is Encryption Authentication Key Management PFS (Perfect Forward Secrecy) Pre-shared Key key Lifetime AUTO (IKE) Enabled (Must match the GNAT Box system exactly) 3600 seconds (Must be less than or equal to the GTA firewall lifetime) The LOCAL SECURE GROUP IP ADDRESS entered should be the network address of the Linksys router s protected network. The REMOTE SECURE GROUP IP ADDRESS entered should be the network address of the GNAT Box s protected network. Encryption methods must match those set in the VPN Object s Phase 1. Figure 1: Linksys Router VPN Configuration Screen

6 Once configuration is complete, click APPLY. After applying the settings, click on the ADVANCED button to open the Advanced Option Screen. On the Advanced option Screen you should have the following settings. Operation Mode Proposal 1 Encryption Proposal 1 Authentication Main mode Proposal 1 Group 1024-bit (Corresponds to Diffie-Hellman Group 2) Proposal 1 Key Lifetime Proposal 2 Encryption Proposal 2 Authentication 3600 seconds (Must be less than or equal to the GTA firewall lifetime) (Set on the previous configuration screen) (Set on the previous configuration screen) Proposal 2 Group 1024-bit (Corresponds to Diffie-Hellman Group 2) Proposal 2 Key Lifetime NetBIOS Broadcast Anti-Replay Keep-Alive If IKE failed more than seconds (Must be less than or equal to the GTA firewall lifetime) Unchecked Checked Unchecked Unchecked Figure 2: Linksys Router VPN Advanced Configuration Screen Once the advanced configuration is complete, click APPLY. Your GNAT Box to Linksys VPN should now be operational. To test the VPN we recommend you ping from a host in the protected network defined on one system to the host on the protected network of the other.