VPN Tracker for Mac OS X

1. Introduction 1. Introduction This document describes how VPN Tracker can be used to establish a connection between a Macintosh running Mac OS X and a WatchGuard Firebox Internet Security Appliance. You can either use the Manual IPsec configuration or the Mobile User VPN configuration in order to get connected with VPN Tracker. The WatchGuard Firebox is configured as a router connecting a company LAN to the Internet. This paper is only a supplement to, not a replacement for, the instructions that have been included with your WatchGuard Firebox. Please be sure to read those instructions and understand them before starting. All trademarks, product names, company names, logos, screenshots displayed, cited or otherwise indicated on the How-to are the property of their respective owners. EQUINUX SHALL HAVE ABSOLUTELY NO LIABILITY FOR ANY DIRECT OR INDIRECT, SPECIAL OR OTHER CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE USE OF THE HOW-TO OR ANY CHANGE TO THE ROUTER GENERALLY, INCLUDING WITHOUT LIMITATION, ANY LOST PROFITS, BUSINESS, OR DATA, EVEN IF EQUINUX HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 2

2. Prerequisites 2. Prerequisites First you have to make sure that your WatchGuard Firebox has VPN support built in. Please refer to your WatchGuard Firebox manual for details. Furthermore you should use a recent WatchGuard Firebox fimware version. The latest firmware release for your WatchGuard Firebox appliance can be obtained from http://www.watchguard.com/ For this document, WatchGuard Version 7.1.B1444 has been used. When using Pre-shared key authentication you need one VPN Tracker Personal or Professional Edition license for each Mac connecting to the WatchGuard Firebox. VPN Tracker is compatible with Mac OS X 10.2.5+, 10.3 and 10.4. 3

3. Connecting a VPN Tracker host to a WatchGuard Firebox In this example the Mac running VPN Tracker is directly connected to the Internet via a dialup or PPP connection. The WatchGuard Firebox is configured in NAT mode and has the static WAN IP address 169.1.2.3 and the private LAN IP address 192.168.1.1. The Stations in the LAN behind the WatchGuard Firebox use 192.168.1.1 as their default gateway and should have a working Internet connection. Chicago Mac-VPN Tracker dynamic IP Local Address 10.1.2.3 New York WatchGuard Firebox WAN 169.1.2.3 LAN 192.168.1.1 192.168.1.10 192.168.1.20 192.168.1.30 LAN 192.168.1.0/24 Figure 1: VPN Tracker WatchGuard Firebox connection diagram 4

3.1 WatchGuard Firebox Manual IPsec Configuration Please create a new Branch Office VPN -> Manual IPsec configuration on the WatchGuard Firebox. The pre-defined VPN Tracker connection type has been created using the default settings for your WatchGuard Firebox appliance. If you change any of the settings on the WatchGuard Firebox, you will eventually have to adjust the connection type in VPN Tracker. Step 1 Add a Remote Gateway: Name: an arbritary name: (i.e. mac-vpntracker) Remote ID Type: User Name Gateway Identifier: an unique identifier (i.e. vpntracker@domain.com) Shared Key: your Pre-shared key (i.e. secretkey) Enable Aggressive Mode: checked Figure 2: WatchGuard - Remote Gateway 5

Step 2 Create a new tunnel with the previously defined gateway and choose a name for the tunnel. The default Phase 2 settings should be fine in most cases. Figure 3: WatchGuard - Select Gateway Figure 4: WatchGuard - Configure Tunnel 6

Step 3 Add Routing Policy: Local Network: Local network behind WatchGuard (i.e. 192.168.1.0/24) Remote Host: Virtual IP address of VPN Tracker client (i.e. 10.1.2.3) Tunnel: The tunnel you ve created before. Figure 5: WatchGuard - Add Routing Policy Please note: The Remote Host is not the public IP address of the client. After the first three steps the configuration should look like this: Step 1 Step 2 Step 3 Figure 6: WatchGuard - IPsec Configuration 7

Step 4 Add a Firewall Rule: Incoming traffic from and outgoing traffic to the IP address 10.1.2.3 must be allowed. To create a new Firewall setting, add a service and select the Packet Filter Any. On the Incoming tab select Enabled and Allowed from the popup menu. Then add the virtual IP address (10.1.2.3) to the From list and the IP address of the LAN (192.168.1.0/24) to the To list. For the Outgoing tab use the same values with interchanged From and To addresses: Figure 7: WatchGuard - Firewall Properties 8

3.2 WatchGuard MUVPN Configuration Please create a new Remote User -> Firebox Authenticated User on your WatchGuard firewall: Step 1 Create a new user and and enter a password for this user: Figure 8: WatchGuard - MUVPN User 9

Step 2 Configure allowed Access: Allow user access to: Local network behind WatchGuard (i.e. 192.168.1.0/24 ) Virtual IP address for mobile user: Virtual IP address of VPN Tracker client (i.e. 10.1.2.3 ) Figure 9: WatchGuard - MUVPN Access 10

Step 3 Configure Encryption and Authentication: Authentication: SHA1-HMAC Encryption: 3DES-CBC Key expires: every 24 hours Figure 10: WatchGuard - MUVPN Encryption 11

After Step 3 your configuration should look like this: Figure 11: WatchGuard - MUVPN - Overview 12

3.3 VPN Tracker Configuration Step 1 Add a new connection with the following options: Vendor: WatchGuard Model: your VPN device Figure 12: VPN Tracker - Connection Settings 13

Step 2 Change your Network Settings: VPN Server Address: public IP address of your VPN Gateway (e.g. 169.1.2.3 ) Local Address: a virtual IP address assigned to the VPN Tracker client (e.g. 10.1.2.3) Remote Network/Mask: network address and netmask of the remote network (eg. 192.168.1.0/255.255.255.0 ). Figure 13: VPN Tracker - Network Settings Please note: In order to access multiple remote networks simultaneously, just add them by pressing the Plus-button. 1 1 For this step VPN Tracker Professional Edition is needed. 14

Step 3 Change your Authentication Settings: Pre-shared key: the same Pre-shared key as in the WatchGuard configuration. Figure 14: VPN Tracker- Authentication Settings 15

Step 4 Identifier Settings (Manual IPsec configuration): Local Identifier: E-mail address (e.g. vpntracker@domain.com ). Local Identifier type: Email Remote Identifier: Remote endpoint IP address. Figure 15: VPN Tracker - Identifier Settings 16

Identifier Settings (Manual User VPN configuration): Local Identifier: your username (e.g. vpntracker) Local Identifier type: Email Remote Identifier: Remote endpoint IP address Figure 16: VPN Tracker - Identifier settings - MUVPN Step 5 Save the connection and Click Start IPsec in the VPN Tracker main window. You re done. After 10-20 seconds the red status indicator for the connection should change to green, which means you re securely connected to the WatchGuard. After IPsec has been started, you may quit VPN Tracker. The IPsec service will keep running. Now to test your connection simply ping a host in the WatchGuard network from the dialed-in Mac in the Terminal utility: ping 192.168.1.10 17