How To Apply NAT over Site-to-Site VPN connection

Transcription

1 How To Apply NAT over Site-to-Site VPN connection How To Apply NAT over Site-to-Site VPN connection Applicable Version: onwards Scenario Consider the following network wherein both the Head Office (HO) LAN and the Branch Office (BO) LAN have the same internal IP schema. Network Parameters HO Network details BO Network details Local Server (WAN IP address) Local LAN address /24 Local NATted Address /24 VPN server (WAN IP address) LAN Network /24 NATted Address /24 As a result, the VPN endpoints fail to differentiate between own network and remote network. Any request initiated from HO destined for BO would be served within HO itself and vice versa. For example, a host from HO initiates a request to host in BO, but it is responded by Host in the HO itself because the endpoint cannot differentiate between HO LAN and BO LAN. As a solution to this, Cyberoam provides NATting over VPN which allows Cyberoam to assign Dummy LAN IP address (NATted LAN) to differentiate between LANs at both ends. This article describes how you can configure an IPSec Connection using NATted LANs.

2 HO Configuration The configuration is to be done from HO Cyberoam Web Admin Console using profile having readwrite administrative rights for relevant feature(s). Step 1: Create IPSec Connection To create a new IPSec connection, go to VPN > IPSec > Connection and click Add. Create the connection using the following parameters. Parameter Description Parameter Value Description Name HO_to_BO Name to identify the IPSec Connection Connection Type Site to Site Select Type of connection. Available Options: Remote Access Site to Site Host to Host Policy DefaultHeadOffice Select policy to be used for connection Action on VPN Restart Respond Only Authentication details Authentication Type Preshared Key Preshared Key Endpoints Details Select the action for the connection. Available options: Respond Only Initiate Disable Select Authentication Type. Authentication of user depends on the connection type. Preshared key should be the same as that configured in remote site. Local PortB Select local port which acts as end-point to the tunnel Remote Specify IP address of the remote endpoint. Local Network Details Local Subnet /24 Select Local LAN Address. Add and Remove LAN

3 NATed LAN /24 If NAT Local LAN is configured, select IP Host or Network Host from the available list. IP Host can also be added by clicking on the Add IP Host link. Remote Network Details Remote LAN Network /24 Select Remote LAN Address. Add and Remove LAN Click OK to create IPSec connection.

4 Step 2: Activate Connection On clicking OK, the following screen is displayed showing the connection created above. Click under Status (Active) to activate the connection. BO Configuration The configuration is to be done from BO Cyberoam Web Admin Console using profile having readwrite administrative rights for relevant feature(s). Step 1: Create IPSec Connection To create a new IPSec connection, go to VPN > IPSec > Connection and click Add. Create the connection using the following parameters.

5 Parameter Description Parameter Value Description Name BO_to_HO Name to identify the IPSec Connection Connection Type Site to Site Select Type of connection. Available Options: Remote Access Site to Site Host to Host Policy DefaultBranchOffice Select policy to be used for connection Action on VPN Restart Authentication details Authentication Type Initiate Preshared Key Preshared Key Endpoints Details Select the action for the connection. Available options: Respond Only Initiate Disable Select Authentication Type. Authentication of user depends on the connection type. Preshared key should be the same as that configured in remote site. Local PortB Select local port which acts as end-point to the tunnel Remote Specify IP address of the remote endpoint. Local Network Details Local Subnet /24 NATed LAN /24 Remote Network Details Remote LAN Network /24 Select Local LAN Address. Add and Remove LAN If NAT Local LAN is configured, select IP Host or Network Host from the available list. IP Host can also be added by clicking on the Add IP Host link. Select Remote LAN Address. Add and Remove LAN

6 Step 2: Activate and Establish Connection On clicking OK, the following screen is displayed showing the connection created above.

7 Click under Status (Active) and Status (Connection). The above configuration establishes an IPSec connection between the HO and BO. Note: Make sure that Firewall Rules that allow LAN to VPN and VPN to LAN traffic are configured. In a Head Office and Branch Office setup, usually the Branch Office acts as the tunnel initiator and Head Office acts as a responder due to following reasons: Since Branch Office or other Remote Sites have dynamic IPs, Head Office is not able to initiate the connection. As there can be many Branch Offices, to reduce the load on Head Office it is a good practice that Branch Offices retries the connection instead of the Head Office retrying all the branch office connections. Document Version July, 2014