Jump to:navigation, search
Wiki

VPN configuration (ASC) in the USC

From Securepoint Wiki





























In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden





















































































































Information on VPN configuration – Adaptive Secure Connect (ASC) – in the USC

Last adaptation to the version: 2.20.3

New:
notempty
This article refers to a Beta version
-
Access: portal.securepoint.cloud  Unified Security Console VPN configuration

Introduction

  • The VPN configuration enables the simple networking of sites, devices and users
  • Everything is managed centrally via the Securepoint Portal in the Unified Security Console (USC)
  • In addition to the star topology, there is a simple access system: sources access specific, defined services (sources → services)
  • At the centre is a core device, which acts as a central hub. From here, multiple sites can be securely connected to one another via satellite devices
  • In addition, groups of mobile end devices can be connected as ‘road warriors’
  • Both UTMs already present in the portal and unmanaged devices can be utilised

First configuration steps:

  1. Selection of the company headquarters as the core UTM.
    It forms the center of the star topology.
  2. Connection of further UTMs from other locations as satellites
  3. Configuration of the Roadwarrior for mobile devices


Prerequisite

notempty
VPN configurations in the USC require a UTM v14.0 or higher.
notempty
If unmanaged devices are to be used in the ASC VPN configuration, the following wiki articles describe their configuration:

Migration to the new model

notempty
New as of: 2.20
VPN configurations from the old ASC Model 1.0
Added and published prior to Portal version 2.20
can be migrated to the new ASC Model 1.1.

This process is carried out using the  Start migration button:

  • All rules and settings are carried over, and the topology rules are applied to the  Sources ,  Services and  Policies (see below)
  • The topology devices are transferred to the  Endpoints (see below)
  • Should any problems arise during migration, the process is blocked and a message describing the problem is displayed
    • The  Run check again button can then be used to run the migration again
notempty
If a topology with unpublished changes is to be migrated, the process will be blocked until these changes have been published.
notempty
If the address of a source or device lies outside the remote site’s network, the migration process will be blocked.
notempty
UTMs vor der Migration auf die neuste UTM-Version updaten!

Overview

Button Description
Buttons for general configuration above the table.
 Topology 1
  • The number of core devices and their topologies
  • Use Add topology to add another core device
  • Use Rename to rename the topology
  • Use to change the order of the topologies
 Endpoints

notempty
New as of: 2.20
 Sources

notempty
New as of: 2.20
 Services

notempty
New as of: 2.20
 Policies

notempty
New as of: 2.20
  • The policies for the ASC topology are displayed
  • The policies determine how the sources should access a service
  • Further policies for this ASC topology can be added
 Discard changes Changes that have not yet been published can be undone again
 Publish Changes made and new configurations are published and thus activated and made usable

Endpoints

  • The existing configurations for the selected ASC topology are displayed
  • Under Endpoint, the devices in use and their status are shown
  • Under Type, the connected devices are shown as Core devices Core, satellite device Satellite or roadwarrior Roadwarrior
    • In addition, whether the Core or Satellite devices are a UTM UTM or an unmanaged device Unmanaged Device
  • Different actions are available depending on the object
Actions Description
An overview of an exemplary VPN configuration with one Core UTM, two Satellite UTMs and two Roadwarriors.
This overview is only visible once a core UTM has been added.
 Satellite / Roadwarrior
Core-UTM
Edit Opens the dialog to edit the object
Delete
  • Procedure for deleting the relevant endpoint
  • A dialogue box opens, displaying all associated sources, services and policies that will be deleted along with the endpoint
    • Select  Delete satellite /  Delete road warrior to confirm the deletion
  • When deleting a core device, the entire VPN configuration is deleted
    • For a core device, you must enter its PIN and then confirm the process by selecting  Delete
notempty
Deleting sources, services and policies may cause problems or disruptions to existing services and policies.
Open menu
Core or Satellite		  UTM details Opens the detailed display for this UTM in the menu  Unified Security ConsoleUTMs
 Exchange UTM
  • Replaces the core or satellite UTM of the existing VPN configuration
  • Further information on this can be found in the section Exchange UTM
 Update Updates the view of the stored information
 Websession
  • Opens the dialog to start the administrative web interface of the UTM
  • Further information can be found in the following Wiki article.
Profiles
Roadwarrior
  • Displays the Roadwarrior profiles that are connected to the Core-UTM
  • Click on the profile to edit it
Show status
Different status displays are shown depending on the object. If you hover over the status display, further information is displayed.
Status display Description
 Not published Indicates that the object has been added but has not yet been published
 Not published Indicates that there have been changes to the object that have not yet been published
 Not published Indicates that the object has been deleted but not yet published
 Publish... Indicates that the configuration is in the process of being published. This process may take some time.
Indicates that the core UTM is connected
Indicates that the core UTM is not connected
Indicates that the Satellite UTM is connected
Indicates that the Satellite UTM is not connected
This address pool is linked and there are no changes to be published
✕ This address pool is not connected
  Shows which profile type (Android or iOS) this address pool belongs to. If you hover over the status label, the name of the profile is displayed.
Exchange UTM
This function offers the option of replacing the core and satellite UTM in an existing VPN configuration without losing settings or even having to create a new VPN configuration.

This makes it possible, for example, to replace a faulty UTM in a VPN configuration so that this configuration works again.

It is irrelevant whether the UTM to be replaced is online or not.
It is not possible to exchange a satellite UTM directly with a core UTM and vice versa. This requires another third UTM as a placeholder UTM.
notempty
Before the new UTM can be exchanged, strongly recommends to create a new backup of the old UTM!
It is irrelevant whether it is a manual backup (further information in this Wiki article), or a Cloudbackup.
Procedure for replacing a UTM:
  • Check that the backup of the new UTM is up-to-date
  • →   Exchange UTM Select the core/satellite UTM to be replaced
  • the new UTM is selected in the Replace Core-UTM or Replace Satellite-UTM dialog box for the UTM option
  • if desired, the core/satellite UTM can be edited, see Edit_Core-UTM, or Edit_Satellite-UTM
  •  Save and then click  Publish to publish the change to the VPN configuration

Further information can be found in the Wiki article Exchange core/satellite UTMs

Sources

notempty
New as of: 2.20
Overview of sources
  • The defined sources of the existing endpoints in the selected ASC topology are displayed here in a table
    • The networks/IPs of the sources are summarised via
      • Clicking this button displays them with Name and IP / Network
    • Name displays the name of the source
    • UTM displays the core or satellite UTM for the corresponding source
    • Type displays the type of the corresponding source: UTM, Satellite, group
    • Tags displays any tags associated with the sources
      • With Edit tags, further tags can be added
  • Using Edit, this source can be edited
  • Using Policy references, the policies relating to this source are displayed
  • Click Delete to delete this source
    • This button only becomes active if this source has no policy
  • The  Add sources button can be used to add a new source
Caption Value Description
Dialogue box for adding new sources
Name Name of the source
  • The name of this source
  • Required field
Symbol Select an icon
  • A symbol can be selected for the source
  • Optional
Tags Add tags
  • Tags can be added to this source
  • Optional
Description Description
  • A description can be added
  • Optional
Node Select a node
  • Select a node – i.e. a core or satellite device – for which the source network and IP addresses are defined
  • Required field
Networks / IP addresses
  • This is where the source networks and IP addresses for this source are configured
  • Use the  Add entry button to add another network or IP address
  • This is only displayed once a device has been selected under Node
  • All fields are required
Name Name Name for this network / IP
IP / Network e.g. 192.168.1.0/24 The source’s IP address or network
If all required fields have been filled in, a new source is saved and added via the active button  Add source.

Services

notempty
New as of: 2.20
Overview of services
  • The defined services of the existing endpoints in the selected ASC topology are displayed here in a table
    • The services of the core devices are summarised via
      • Clicking this button displays them with Name, Protocol, Details and Destination (IP / Network)
    • Name displays the name of the service
    • UTM displays the core UTM associated with the service
    • Type displays the type of the associated source: UTM, Satellite, Core
    • Tags displays existing tags for the sources
      • Additional tags can be added using Edit tags
  • Using Edit, this service can be edited
  • Using Policy references, the policies relating to this service are displayed
  • Click Delete to delete this service
    • This button only becomes active if this service has no policy
  • Use the  Add service button to add a new service
Caption Value Description
Dialogue box for adding new services
Name Name of the service
  • The name of this service
  • Required field
Symbol Select an icon
  • An icon can be selected for the service
  • Optional
Tags Add tags
  • Tags can be added to this service
  • Optional
Description Description
  • A description can be added
  • Optional
Node Select a node
  • Select a node – i.e. a core or satellite device – on which the service is to be configured
  • Required field
Endpoints
  • This is where the new endpoints for the service are configured
  • The  Individual rules button adds a single endpoint; the  Rule matrix button allows multiple endpoints to be added to a service
  • This is only displayed once a device has been selected under Nodes
Name Name of the endpoint
  • The name of the endpoint
  • Required field
Protocol TCP
  • Select the required protocol for the service
  • Depending on your selection, further parameters may be required
    • If the default value TCP is selected, the source port and destination port are displayed and must be entered
  • Required field
Destination (IP/network) IP / Network ·
  • Select the IP address or network of the endpoint
  • Required field
 Advanced settings
  • Depending on the selected protocol, further optional settings can be configured here
If all required fields have been filled in, a new endpoint is added by clicking the active button  Add endpoint.
If all required fields have been filled in, a new service is saved and added by clicking the active button  Add service.

Policies

notempty
New as of: 2.20
Overview of the policies
  • The defined policies for the existing endpoints of the selected ASC topology are displayed here in tabular form
    • Source shows the source
    • Destination (Service) shows the destination or service
    • Tags shows the existing tags for the policies
      • Using Edit tags, further tags can be added
  • Clicking Delete deletes this policy
  • Use the  Add policy button to add a new service
Caption Value Description
Dialogue box for adding new policies
Source Select a source Se­lect the source whose traf­fic should be al­lowed
Destination (Service) Select a service Se­lect the ser­vice that should be reach­able for this source
Tags Add tags Add tags to or­ga­nize poli­cies more eas­i­ly
If all fields contain an entry, a new policy is saved and added by clicking the active  Save button.

Configuration of the Core-UTM


In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden























































Add Core UTM

 Add Core now Opens the dialog for adding a core UTM.
Appearance of the VPN configuration if no core UTM has been configured yet.
It is possible to have several core UTMs. Each core UTM is assigned to a topology Topology 1
Default designation and it is numbered consecutively
.
  • with Rename the selected topology can be renamed
  • with the topologies can be sorted

If a further Core-UTM and thus a further topology is to be added, this is done with the button Add topology

  • UTMs that have already been selected as core UTMs or satellite UTMs cannot be selected as new core UTMs
    • In the dialogue box that opens, select UTM for the Type option
    Caption Value Description
    Dialog box for adding a core UTM
    Typ UTM Select the type UTM
    Name
    Mandatory field    		 Name Name of the topology
    UTM TTT-Point AG V
    • List of available UTMs that can be selected as core UTMs
    • Only UTMs that have a public IP address, are connected to the portal and are online are available for selection
    • UTMs that are connected to the portal but are offline, or whose version is not compatible, are listed in the not available list section
    • The next steps are only displayed after a UTM has been selected
    Alias
    Mandatory field    		 LG1 An alias must be assigned for the core UTM in order to be able to assign generated objects to this UTM.
    Interface
    Mandatory field    		 eth0 (203.113.0.113)
    • The interface of the core UTM to be used for establishing the connection
    • By default the first interface that is connected to the Internet is used
    Hostname/ public IP address
    Mandatory field    		 203.113.0.113
    • The host name, or the public IP address, which is used to establish the connection
    • By default the public IP address of the Internet interface of the UTM is used
    Transfer network
    Mandatory field    		 192.168.20.0/24 Private IPv4 or IPv6 address to be used as the transfer network.
     (Optional) DNS settings for Roadwarrior
    • Here you can specify which DNS servers should be used for Roadwarrior VPN connections
    • Requests are always routed through the tunnel
    • This enables, for example, name resolution for servers on the internal network being used
    Primary DNS server (optional) Add DNS Server
    • DNS servers in the network of the core UTM can be selected here so that the name resolution works for the Roadwarrior clients
    • Rules are automatically created in the Roadwarrior pools
      Dialog box for adding a DNS server
    Core as DNS
    • The Core UTM is used as a DNS server
    • It then displays Core
      notempty
      If the Core UTM is set as the DNS server, DNS queries are automatically resolved through the UTM's name server.
    Network object
    Not with Core as DNS    		 Please select a Network object Selection of a network object that is assigned to a DNS server.

    If no suitable network object is available, a new one can be created using the Add button .

    Name Name Name to be given to the network object.
    Host Type of the network object. '‘'Host’ is selected by default, alternatively ‘'Network’' is possible.
    Address IP address IPv4 or IPv6 address that the network object is to use as the transfer network.
    Zone Select a zone Zone in which the network object should be located. If no suitable zone exists, one must be created in the UTM.
    Network Group Select Network Group Adds this network object to an existing network group.
    Service
    Not with Core as DNS    		 dns Selection of the service or service group that makes DNS possible.

    If no suitable service is available, a new one can be created using the Add button .

    Name Name of the Service Name of the Service.
    Service group name Service group name Adds the service to an existing service group.
    Protocol Select protocol Protocol that the service should have.
    Enable Split DNS for iOS profiles
    Only appears when a DNS server has been selected
    notempty
    New as of: 2.8
    		   
    • When enabled   , Split DNS can be used for iOS profiles
    • A distinction is made between internal and external domains to be resolved
    Split DNS configuration
    This will only be displayed if Split DNS for iOS Profiles is enabled   
    notempty
    New as of: 2.8
    		 Add domains
    • Only the domains entered here will be resolved via the specified DNS servers
    • External domains, where used, are resolved via Cloud Shield
    • This allows a VPN configuration to be used in conjunction with Cloud Shield
    • At least one domain must be entered; otherwise, the settings cannot be saved
    • If Enable Split DNS for iOS profiles is disabled   , any domains that have been entered will be retained but will no longer be active
    The DNS server is added with the  Add DNS button.
    Adds the UTM as a core UTM. The  Add UTM button only becomes active once all entries have been completed
    This configuration must then be made usable with the  Publish button.


    Edit core UTM

    An active, connected core UTM can be edited via the wrench button .
    Caption Value Description
    Dialog box for editing a core UTM
    Name Name Name of the topology
    UTM TTT-Point AG IV The UTM, which serves as the core UTM, cannot be changed retrospectively.
    Alias
    Mandatory field    		 LG1 An alias must be assigned for the core UTM in order to be able to assign generated objects to this UTM.
    Port 51820 Display of the port used by the VPN service. Cannot be changed.
    Interface eth0 (203.113.0.113) The interface used to establish the connection.
    Hostname/ public IP address 203.113.0.113 The host name or public IP address used to establish the connection.
    Transfer network 192.168.20.0/24 IPv4 or IPv6 address to be used as the transfer network.
     (Optional) DNS settings for Roadwarrior
    • Here you can specify which DNS servers should be used for Roadwarrior VPN connections
    • Requests are always routed through the tunnel
    • This enables, for example, name resolution for servers on the internal network being used
    Primary DNS server (optional) Add DNS Server
    • DNS servers in the network of the core UTM can be selected here so that the name resolution works for the Roadwarrior clients
    • Rules are automatically created in the Roadwarrior pools
      Dialog box for adding a DNS server
    Core as DNS
    • The Core UTM is used as a DNS server
    • It then displays Core
      notempty
      If the Core UTM is set as the DNS server, DNS queries are automatically resolved through the UTM's name server.
    Network object
    Not with Core as DNS    		 Please select a Network object Selection of a network object that is assigned to a DNS server.

    If no suitable network object is available, a new one can be created using the Add button .

    Name Name Name to be given to the network object.
    Host Type of the network object. '‘'Host’ is selected by default, alternatively ‘'Network’' is possible.
    Address IP address IPv4 or IPv6 address that the network object is to use as the transfer network.
    Zone Select a zone Zone in which the network object should be located. If no suitable zone exists, one must be created in the UTM.
    Network Group Select Network Group Adds this network object to an existing network group.
    Service
    Not with Core as DNS    		 dns Selection of the service or service group that makes DNS possible.

    If no suitable service is available, a new one can be created using the Add button .

    Name Name of the Service Name of the Service.
    Service group name Service group name Adds the service to an existing service group.
    Protocol Select protocol Protocol that the service should have.
    Enable Split DNS for iOS profiles
    Only appears when a DNS server has been selected
    notempty
    New as of: 2.8
    		   
    • When enabled   , Split DNS can be used for iOS profiles
    • A distinction is made between internal and external domains to be resolved
    Split DNS configuration
    This will only be displayed if Split DNS for iOS Profiles is enabled   
    notempty
    New as of: 2.8
    		 Add domains
    • Only the domains entered here will be resolved via the specified DNS servers
    • External domains, where used, are resolved via Cloud Shield
    • This allows a VPN configuration to be used in conjunction with Cloud Shield
    • At least one domain must be entered; otherwise, the settings cannot be saved
    • If Enable Split DNS for iOS profiles is disabled   , any domains that have been entered will be retained but will no longer be active
    This configuration must then be made usable with the  Publish button.

    Configuration of the satellite UTMs


    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden






































    Add Satellite-UTM

    To add a UTM as a Satellite UTM, click on the  Satellite / Roadwarrior button for an active, connected Core UTM.
    A dialog window opens in which the new Satellite UTM is configured.
    Caption Value Description
    Dialog box for adding a Satellite UTM to the UNC
    Type Satellite (UTM) Satellite is selected as the type
    UTM TTT-Point AG V Selection of the UTM that is to connect to the core UTM via VPN. The configurations are assigned to the UTMs as soon as this is published.
    Only UTMs that are connected to the portal and online are available for selection. UTMs that are connected to the portal but are offline or whose version is not compatible are listed in the Not available list section.
    Alias
    Mandatory field    		 LG2 Alias for the Satellite UTM to make it easier to assign generated objects to this UTM.
    The  Add button only becomes active once all entries have been completed and this UTM is then added above them.
    This configuration must then be transferred using the  Publish button.


    Edit Satellite-UTM

    An active, connected Satellite UTM can be edited using the button.
    Caption Value Description
    Dialog box for editing a Satellite UTM
    Type Satellite (UTM) The type cannot be +changed with a Satellite UTM.
    UTM TTT-Point AG II The UTM used as the satellite UTM cannot be changed.
    Alias
    Mandatory field    		 LG2 Assign an alias for the Satellite UTM to make it easier to assign generated objects on this UTM.
    This configuration must then be transferred using the  Publish button.

    Configuration of the Roadwarrior


    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden












































    Add Roadwarrior

    To add a Roadwarrior, click the  Satellit / Roadwarrior button on an active, connected core UTM.
    A dialog window will open where the new Roadwarrior can be configured
    Caption Value Description
    Dialog window for adding a Roadwarrior
    Type Roadwarrior Select Roadwarrior as the type
    Name RW_General The name to be used for this Roadwarrior
    Transfer network 10.0.2.0/24 Enter a private IPv4 or IPv6 address to be used as the transfer network.
    Profile
    		 Android RW  iOS RW  Windows VPN RW Profile selection.
    Possible options are
    notempty
    New as of: 2.19
    notempty
    Generated profiles can no longer be selected
    • iOS device profiles
      • iOS profiles with active Cloud Shield
      • notempty
        New as of: 2.12
        For iOS profiles, the system checks whether a VPP license is available for the VPN client app. If no license is available, a message is displayed
        To add this profile as a road warrior, you need a VPP license for the Securepoint VPN client from Apple Business Manager
    • Windows profiles

    Devices from these profiles can be connected to this network after the configuration is published.
    Multiple profiles can be selected.

    Only when all fields are filled in does the  Add button become active, and the Roadwarrior can then be added using it.
    Finally, this configuration must be applied using the  Publish button.

    Edit Roadwarrior

    A Roadwarrior can be edited via the button
    Caption Value Description
    Dialog window for editing a Roadwarrior
    Type Roadwarrior The type of a Roadwarrior cannot be changed
    Name RW-Smartphones The Name used for this Roadwarrior.
    Transfer network 10.0.2.0/24 IPv4- or IPv6 address, to be used as the transfer network
    Profile
    		 Android RW  iOS RW  Windows VPN RW Profile selection.
    Possible options are
    notempty
    New as of: 2.19
    notempty
    Generated profiles can no longer be selected
    • iOS device profiles
      • iOS profiles with active Cloud Shield
      • notempty
        New as of: 2.12
        For iOS profiles, the system checks whether a VPP license is available for the VPN client app. If no license is available, the following message is displayed To add this profile as a road warrior, you need a VPP license for the Securepoint VPN client from Apple Business Manager
    • Windows profiles

    Devices from these profiles can be connected to this network after the configuration is published.
    Multiple profiles can be selected.

    Finally, this configuration must be applied using the  Publish button.

    Display on the UTM

    General rules

    In general, several rules are automatically generated on the relevant UTMs. These rules are marked in the ‘'Models’' column, the rules overview on the UTM, so that it is clear where they come from. In addition, these rules can only be edited, deleted or copied using the portal and not on the UTM itself.

    Outgoing data traffic is automatically permitted. Incoming packets on the core UTM that do not correspond to the configured service/port are discarded.

    It should also be noted that services are always newly created in order to avoid possible interference with existing services, which may then be changed.

    Presentation of the satellite rules

    Pos. # Source Destination Service NAT Logging Action Cloud Active
    Generated rules of the Core-UTM for an example rule from a satellite UTM to the core UTM:
    LG2-rules
    -
    		 2 On
    LG2-internal-networks vpn-netzwerk default-internet
    -
    		 ACCEPT On
    vpn-netzwerk LG2-internal-networks LG2-auto-service
    -
    		 ACCEPT On
    Generated rules of the Satellite-UTM for an example rule from a satellite UTM to the core UTM:
    LG1-rules
    -
    		 1 On
    internal-networks LG1-auto-network LG1-auto-service
    -
    		 ACCEPT On
    When generating a rule between a satellite UTM and the core UTM, a total of three packet filter rules are generated. Two on the destination UTM and one on the source UTM.

    On the target UTM (here Core-UTM), this includes an inbound rule with the selected service and an Any rule for outbound data to the source UTM (here Satellite-UTM).
    An outbound rule, i.e. an Any rule, is created on the source UTM.

    Presentation of the Roadwarrior rules

    Generated rules on the Core-UTM for a Roadwarrior rule:
    RW-Smartphones-rules-2
    -
    		 2 On
    RW-Smartphones-address_pool rw-network default-internet
    -
    		 ACCEPT On
    rw-network RW-Smartphones-auto-network RW-Smartphones-auto-service
    -
    		 ACCEPT On
    When creating a rule between a Roadwarrior network and the Core-UTM, two packet filter rules are generated on the Core-UTM.

    These include an inbound rule with the corresponding service and an outbound rule, i.e. an ‘'Any’' rule.

    Display of network objects

    There are two different types of network objects that are created by the VPN configuration. On the one hand, there are those that refer to another object in the configuration and are generated completely automatically when a rule is created (here, for example, LG2-any-network-v4). On the other hand, there are those that are created on the UTM itself by the user using the button (here, for example, vpn-network). Network objects UTMuser@firewall.name.fqdn Firewall Update rules
    Generated network objects on the Core-UTM
    Retrieved from "https://wiki.securepoint.de/index.php?title=USC/VPN/Konfiguration&oldid=112792"