IP Tunnels September 2014

Transcription

1 IP Tunnels September 2014

2 Table of Contents 1. Introduction About this Document Concept Configuration and Parameters... 2 VASCO Data Security 2014 ii

3 VASCO Products VASCO Data Security, Inc. and/or VASCO Data Security International GmbH are referred to in this document as VASCO. VASCO Products comprise Hardware, Software, Services and Documentation. This document addresses potential and existing VASCO customers and has been provided to you and your organization for the sole purpose of helping you to use and evaluate VASCO Products. As such, it does not constitute a license to use VASCO Software or a contractual agreement to use VASCO Products. Disclaimer of Warranties and Limitations of Liabilities VASCO Products are provided as is without warranty or conditions of any kind, whether implied, statutory, or related to trade use or dealership, including but not limited to implied warranties of satisfactory quality, merchantability, title, non-infringement or fitness for a particular purpose. VASCO, VASCO DISTRIBUTORS, RESELLERS AND SUPPLIERS HAVE NO LIABILITY UNDER ANY CIRCUMSTANCES FOR ANY LOSS, DAMAGE OR EXPENSE INCURRED BY YOU, YOUR ORGANIZATION OR ANY THIRD PARTY (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF DATA) ARISING DIRECTLY OR INDIRECTLY FROM THE USE, OR INABILITY TO USE VASCO SOFTWARE, HARDWARE, SERVICES OR DOCUMENTATION, REGARDLESS OF THE CAUSE OF THE LOSS, INCLUDING NEGLIGENCE, EVEN IF VASCO HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, OR IF THEY WERE FORESEEABLE. OUR MAXIMUM AGGREGATE LIABILITY TO YOU, AND THAT OF OUR DISTRIBUTORS, RESELLERS AND SUPPLIERS SHALL NOT EXCEED THE AMOUNT PAID BY YOU FOR THE PRODUCT. THE LIMITATIONS IN THIS SECTION SHALL APPLY WHETHER OR NOT THE ALLEGED BREACH OR DEFAULT IS A BREACH OF A FUNDAMENTAL CONDITION OR TERM, OR A FUNDAMENTAL BREACH. THIS SECTION WILL NOT APPLY ONLY WHEN AND TO THE EXTENT THAT APPLICABLE LAW SPECIFICALLY REQUIRES LIABILITY DESPITE THE FOREGOING EXCLUSIONS AND LIMITATIONS. Intellectual Property and Copyright VASCO Products contain proprietary and confidential information. VASCO Data Security, Inc. and/or VASCO Data Security International GmbH own or are licensed under all title, rights and interest in VASCO Products, updates and upgrades thereof, including copyrights, patent rights, trade secret rights, mask work rights, database rights and all other intellectual and industrial property rights. No part of these Products may be transferred, disclosed, reproduced or transmitted in any form or by any means, electronic, mechanical or otherwise, for any purpose, except as expressly permitted by VASCO or its authorized licensee in writing. This document is protected under US and international copyright law as an unpublished work of authorship. No part of it may be transferred, disclosed, reproduced or transmitted in any form or by any means, electronic, mechanical or otherwise, for any purpose, except as expressly permitted in writing by VASCO or its authorized licensee. VASCO Trademarks VASCO, VACMAN, IDENTIKEY, axsguard, AXS GUARD, DIGIPASS, DIGIPASS as a Service, MYDIGIPASS.COM and the logo are registered or unregistered trademarks of VASCO Data Security, Inc. and/or VASCO Data Security International GmbH in the U.S. and other countries. Other company brand or product names or other designations, denominations, labels and/or other tags, titles, as well as all URLs (Internet addresses) linked to such designations or communications (irrespective of whether protected by intellectual property law or not), mentioned in VASCO Products may be the trademarks or registered trademarks or be part of any other entitlement of their respective owners. Other Trademarks Citrix and XenServer are trademarks or registered trademarks of Citrix Systems, Inc. VMware and vsphere are registered trademarks or trademarks of VMware, Inc. Hyper-V is a registered trademark of Microsoft Corporation. Copyright 2014 VASCO Data Security, VASCO Data Security International GmbH. All rights reserved. VASCO Data Security 2014 iii

4 Chapter 1. Introduction 1.1. About this Document In this document, we explain how the concept and configuration of IP tunnels on the AXS GUARD appliance. Note that IP tunnels can only be created by VASCO personnel and require you to contact our technical support team. This document was last updated on 22 Sep Concept An IP tunnel is an Internet Protocol (IP) network communications channel between two networks. It is used to transport another network protocol by encapsulation of its packets. IP tunnels are often used for connecting two disjoint IP networks that don t have a native routing path to each other, via an underlying routable protocol across an intermediate transport network. Supported Types IP in IP, sometimes called ipencap, is IP encapsulation within IP and is described in RFC 2003 Figure 1.1. IP Encapsulation GRE in IP. GRE is a tunneling protocol that was originally developed by Cisco and can be used to transport multicast traffic through a GRE tunnel. GRE (defined in RFC 2784 and updated by RFC 2890) goes a step further than IP in IP, adding an additional header of its own between the inside and outside IP headers. Figure 1.2. GRE Encapsulation Advantages, Limitations and Requirements GRE can theoretically encapsulate any layer three protocol with a valid Ether type, unlike IP in IP, which can only encapsulate IP packets. Both tunnel types should only be used in trusted networks, as they offer no encryption. You should used IPSec, OpenVPN, PPTP or L2TP to tunnel traffic over insecure networks, such as the Internet. IP tunnels are bi-directional and must be configured on each endpoint, e.g. A to B and B to A. Appropriate routing must be added on each endpoint. VASCO Data Security

5 Chapter 2. Configuration and Parameters Example 2.1. Internet failover Assume you have two remote sites (A & B) that are physically connected with a leased line. Each site has one Internet connection. Let s imagine that site A loses it s Internet connection because there is a technical issue with the ISP. With an IP tunnel, site A can use the Internet connection of site B seamlessly while its own connection is down. Note that the Internet Redundancy module is required for this setup. Figure 2.1. IP Tunnel for Internet Redundancy Make sure to configure the Tunnel Interface type as Internet. The Internet can be reached via the default gateway of Site B, e.g /24. This range must be routed over the IP Tunnel (Network > Internet Redundancy). 1. Navigate to Network Devices Enc. 2. Click on Add new. 3. Enter the settings as explained in the tables below. 4. Update your configuration when finished. 5. Add the appropriate routing entries. 6. Reboot your system. 7. Configure the IP tunnel on the other endpoint. VASCO Data Security

6 Chapter 2. Configuration and Parameters Figure 2.2. IP Tunnel Configuration Parameter DNS Name Device Name Encapsulation Protocol Interface Type Description The name as known by the internal DNS repository The name to be given to the tunnel device, e.g. iptun1. The resulting device name will be enc.iptun1. Select the encapsulation type (GRE or IP). Not in use: Select to disable an active IP tunnel device. Internet: Select this type if the device is used to connect to the Internet (Internet Redundancy). Secure: Select this type if the device belongs to your secure network (LAN). MTU The size in bytes of the largest protocol data unit that can be transmitted. See Wikipedia for a table of commonly used MTUs. Table 2.1. General IP Tunnel Parameters Parameter Local enpoint IP Remote endpoint IP Description The IP address of the local device, i.e. the device that will be routing IP or GRE packets (start). The IP address of the remote appliance (destination). Table 2.2. Outside Tunnel Parameters Parameter Local virtual enpoint IP Remote virtual endpoint IP Description The IP address of your local IP tunnel device (start). The IP address of the IP tunnel device on the remote appliance (destination). Table 2.3. Inside Tunnel Parameters VASCO Data Security

7 Chapter 2. Configuration and Parameters Parameter Description Connectivity Check? Connectivity check IPs Check to enable The IP address(es) of (a) device(s) to ping. Table 2.4. Connectivity Check VASCO Data Security

8 List of Figures 1.1. IP Encapsulation GRE Encapsulation IP Tunnel for Internet Redundancy IP Tunnel Configuration... 3 VASCO Data Security 2014 v

9 List of Tables 2.1. General IP Tunnel Parameters Outside Tunnel Parameters Inside Tunnel Parameters Connectivity Check... 4 VASCO Data Security 2014 vi

10 List of Examples 2.1. Internet failover... 2 VASCO Data Security 2014 vii