Jump to:navigation, search
Wiki

VPN configuration Core-UTM

From Securepoint Wiki





























In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden

































































Configuring a UTM as Core in the VPN configuration – Adaptive Secure Connect (ASC) – in the Securepoint Portal

Last adaptation to the version: 2.20.3

New:
  • The landing page for Adaptive Secure Connect has been updated
notempty
This article refers to a Beta version
-
Access: portal.securepoint.cloud Unified Security Console VPN Configuration

Introduction

This article describes how a UTM device available in the Securepoint Portal Unified Security Console can be configured as a core for a VPN configuration (ASC).
If, on the other hand, an unmanaged device is to be used as the core, this is described in the wiki article Configuring Unmanaged Core Devices.

Requirement

notempty
VPN configurations in the USC require a UTM v14.0 or higher.
This version is currently only available as a reseller preview


Add Core UTM

 Add Core now Opens the dialog for adding a core UTM.
Appearance of the VPN configuration if no core UTM has been configured yet.
It is possible to have several core UTMs. Each core UTM is assigned to a topology Topology 1
Default designation and it is numbered consecutively
.
  • with Rename the selected topology can be renamed
  • with the topologies can be sorted

If a further Core-UTM and thus a further topology is to be added, this is done with the button Add topology

  • UTMs that have already been selected as core UTMs or satellite UTMs cannot be selected as new core UTMs
    • In the dialogue box that opens, select UTM for the Type option
    Caption Value Description
    Dialog box for adding a core UTM
    Typ UTM Select the type UTM
    Name
    Mandatory field    		 Name Name of the topology
    UTM TTT-Point AG V
    • List of available UTMs that can be selected as core UTMs
    • Only UTMs that have a public IP address, are connected to the portal and are online are available for selection
    • UTMs that are connected to the portal but are offline, or whose version is not compatible, are listed in the not available list section
    • The next steps are only displayed after a UTM has been selected
    Alias
    Mandatory field    		 LG1 An alias must be assigned for the core UTM in order to be able to assign generated objects to this UTM.
    Interface
    Mandatory field    		 eth0 (203.113.0.113)
    • The interface of the core UTM to be used for establishing the connection
    • By default the first interface that is connected to the Internet is used
    Hostname/ public IP address
    Mandatory field    		 203.113.0.113
    • The host name, or the public IP address, which is used to establish the connection
    • By default the public IP address of the Internet interface of the UTM is used
    Transfer network
    Mandatory field    		 192.168.20.0/24 Private IPv4 or IPv6 address to be used as the transfer network.
     (Optional) DNS settings for Roadwarrior
    • Here you can specify which DNS servers should be used for Roadwarrior VPN connections
    • Requests are always routed through the tunnel
    • This enables, for example, name resolution for servers on the internal network being used
    Primary DNS server (optional) Add DNS Server
    • DNS servers in the network of the core UTM can be selected here so that the name resolution works for the Roadwarrior clients
    • Rules are automatically created in the Roadwarrior pools
      Dialog box for adding a DNS server
    Core as DNS
    • The Core UTM is used as a DNS server
    • It then displays Core
      notempty
      If the Core UTM is set as the DNS server, DNS queries are automatically resolved through the UTM's name server.
    Network object
    Not with Core as DNS    		 Please select a Network object Selection of a network object that is assigned to a DNS server.

    If no suitable network object is available, a new one can be created using the Add button .

    Name Name Name to be given to the network object.
    Host Type of the network object. '‘'Host’ is selected by default, alternatively ‘'Network’' is possible.
    Address IP address IPv4 or IPv6 address that the network object is to use as the transfer network.
    Zone Select a zone Zone in which the network object should be located. If no suitable zone exists, one must be created in the UTM.
    Network Group Select Network Group Adds this network object to an existing network group.
    Service
    Not with Core as DNS    		 dns Selection of the service or service group that makes DNS possible.

    If no suitable service is available, a new one can be created using the Add button .

    Name Name of the Service Name of the Service.
    Service group name Service group name Adds the service to an existing service group.
    Protocol Select protocol Protocol that the service should have.
    Enable Split DNS for iOS profiles
    Only appears when a DNS server has been selected
    notempty
    New as of: 2.8
    		   
    • When enabled   , Split DNS can be used for iOS profiles
    • A distinction is made between internal and external domains to be resolved
    Split DNS configuration
    This will only be displayed if Split DNS for iOS Profiles is enabled   
    notempty
    New as of: 2.8
    		 Add domains
    • Only the domains entered here will be resolved via the specified DNS servers
    • External domains, where used, are resolved via Cloud Shield
    • This allows a VPN configuration to be used in conjunction with Cloud Shield
    • At least one domain must be entered; otherwise, the settings cannot be saved
    • If Enable Split DNS for iOS profiles is disabled   , any domains that have been entered will be retained but will no longer be active
    The DNS server is added with the  Add DNS button.
    Adds the UTM as a core UTM. The  Add UTM button only becomes active once all entries have been completed
    This configuration must then be made usable with the  Publish button.

    Edit core UTM

    An active, connected core UTM can be edited via the wrench button .
    Caption Value Description
    Dialog box for editing a core UTM
    Name Name Name of the topology
    UTM TTT-Point AG IV The UTM, which serves as the core UTM, cannot be changed retrospectively.
    Alias
    Mandatory field    		 LG1 An alias must be assigned for the core UTM in order to be able to assign generated objects to this UTM.
    Port 51820 Display of the port used by the VPN service. Cannot be changed.
    Interface eth0 (203.113.0.113) The interface used to establish the connection.
    Hostname/ public IP address 203.113.0.113 The host name or public IP address used to establish the connection.
    Transfer network 192.168.20.0/24 IPv4 or IPv6 address to be used as the transfer network.
     (Optional) DNS settings for Roadwarrior
    • Here you can specify which DNS servers should be used for Roadwarrior VPN connections
    • Requests are always routed through the tunnel
    • This enables, for example, name resolution for servers on the internal network being used
    Primary DNS server (optional) Add DNS Server
    • DNS servers in the network of the core UTM can be selected here so that the name resolution works for the Roadwarrior clients
    • Rules are automatically created in the Roadwarrior pools
      Dialog box for adding a DNS server
    Core as DNS
    • The Core UTM is used as a DNS server
    • It then displays Core
      notempty
      If the Core UTM is set as the DNS server, DNS queries are automatically resolved through the UTM's name server.
    Network object
    Not with Core as DNS    		 Please select a Network object Selection of a network object that is assigned to a DNS server.

    If no suitable network object is available, a new one can be created using the Add button .

    Name Name Name to be given to the network object.
    Host Type of the network object. '‘'Host’ is selected by default, alternatively ‘'Network’' is possible.
    Address IP address IPv4 or IPv6 address that the network object is to use as the transfer network.
    Zone Select a zone Zone in which the network object should be located. If no suitable zone exists, one must be created in the UTM.
    Network Group Select Network Group Adds this network object to an existing network group.
    Service
    Not with Core as DNS    		 dns Selection of the service or service group that makes DNS possible.

    If no suitable service is available, a new one can be created using the Add button .

    Name Name of the Service Name of the Service.
    Service group name Service group name Adds the service to an existing service group.
    Protocol Select protocol Protocol that the service should have.
    Enable Split DNS for iOS profiles
    Only appears when a DNS server has been selected
    notempty
    New as of: 2.8
    		   
    • When enabled   , Split DNS can be used for iOS profiles
    • A distinction is made between internal and external domains to be resolved
    Split DNS configuration
    This will only be displayed if Split DNS for iOS Profiles is enabled   
    notempty
    New as of: 2.8
    		 Add domains
    • Only the domains entered here will be resolved via the specified DNS servers
    • External domains, where used, are resolved via Cloud Shield
    • This allows a VPN configuration to be used in conjunction with Cloud Shield
    • At least one domain must be entered; otherwise, the settings cannot be saved
    • If Enable Split DNS for iOS profiles is disabled   , any domains that have been entered will be retained but will no longer be active
    This configuration must then be made usable with the  Publish button.
    Retrieved from "https://wiki.securepoint.de/index.php?title=USC/VPN/Core&oldid=112798"