IPSec - Fritz!Box with UTM

Alternatively, the entry "all/all/all" is also possible. Then the connection setup may take a little longer.

---

Creating an IPSec connection with a Fritz!Box

Last adaptation to the version: 12.7.0

New:

• Updated to Redesign of the webinterface

notempty

This article refers to a Resellerpreview

v12.5 v11

Access: Admin Interface of the UTMUTM-IP:Port or UTM-URL:Port
Port as configured at Network / Appliance Settings / Webserver
Default-Port: 11115
i.e.: https://utm.ttt-point.de:11115
Default: https://192.168.175.1:11115 VPN IPSec Admin Interface of the Fritz!BoxEither under https://fritz.box
or via the IP address of the Fritz!Box
Default: http://192.168.178.1 Internet → Freigaben→ Tab VPN (IPSec)

Note
This article includes descriptions of third-party software and is based on the status at the time this page was created.
Changes to the user interface on the part of the manufacturer are possible at any time and must be taken into account accordingly in the implementation.
All information without warranty.

---

Preliminary note

• An AVM Fritz!Box is required

It is irrelevant whether the Securepoint appliance or the Fritz!Box is configured first.

• The remote station equipped with a Securepoint appliance must have a static IP address

If the remote station should use dynamic IP addresses, the Fritz!Box VPN function selects "Aggressive Mode" as the transport mode. notempty

The Aggressive Mode is not supported by the Securepoint Appliances for security reasons.

‍

The authentication of the remote station is not encrypted.
The hash values of the preshared key are transmitted unencrypted.
Thus, the security depends on the strength of the preshared key and the hashing method used.
However, since most shared keys only meet the minimum requirements, this mode is not supported.

If there is a router (e.g. Fritz!Box or Speedport) in front of the Securepoint appliance, it must be ensured that ESP and UDP 500/ 4500 are active there. See Example configuration with a Fritz!Box.

---

Configuration of the Fritz!Box

Importing a new firmware version

The manufacturer's homepage can be used to check whether new firmware is available for the Fritz!Box.

notempty

With older Fritz!Box firmware versions, not all encryption algorithms for IKEv1 are supported. Therefore, it is recommended to keep the firmware up to date.
For more information, see the section Adjust the configuration file.

Firmware Update: Show details

Installing a new Fritz!Box firmware version

Before downloading the new firmware version from AVM's website, make sure that only firmware approved for the existing product can be used.

• The interface of the Fritz!Box is opened in the browser
  Factory setting: https://192.168.178.1
• Click on System ➊ → Update ➋ notempty
  If the Fritz!Box comes from a cable provider, this function is not available!
• In the dialog Fritz!OS-Version ➌ click on Search for new Fritz!OS ➍ to search online for an update, or in the dialog Fritz!OS-File ➎ import the downloaded firmware file.

Enable DynDNS

To be able to use a DynDNS in the VPN configuration, this function must be set up beforehand. This requires that an account with a DynDNS service provider is available (Use Securepoint Dynamic DNS Host ).

Activation of DynDNS in the Fritz!Box

• In the interface of the Fritz!Box open Internet ➊ Permit Access ➋
• Go to the DynDNS ➌ dialog
• Activation of the checkbox  Use DynDNS ➍
• Enter the login data of the DynDNS provider used:

Caption	Value	Description
Update-URL	https://update.spdyn.de/nic/update?...	The update-URL of the DynDNS provider
Domainname	d-vpn.spdns.de	The domain name for the Fritz!Box with the DynDNS provider
Username	d-vpn.spdns.org	The username of the account For spDyn with reseller account also the hostname
Password	****	The password of the account For spDyn with reseller account the token

• With the button Apply made changes are saved.

Change internal network

notempty

The following changes must be made when using the Fritz!Remote Access Setup programme. See the following section Create VPN configuration.

The UTM and the Fritz!Box must not use the same IP network.
According to the default settings of the Fritz!Box VPN Assistant, the factory-set internal network 192.168.178.0/24 may not be used for VPN.
Therefore, the internal network must be changed.

‍

The following wiki article describes the modification of the IP network of the UTM.

Configuring the internal network of the Fritz!Box

• In the interface of the Fritz!Box go to Home network → Network and switch to the dialog Network Settings
• In the IP Addresses section, click the IPv4 Settings button.
• Enter the following under Home network:

Caption	Value	Description
IPv4 address	192.168.100.1	The new IPv4 address for the Fritz!Box
Subnet mask	255.255.255.0	The subnet mask for the new IPv4 address of the Fritz!Box
Enable DHCP server and enter the following:
from	192.168.100.20	The beginning of the span of DHCP IPv4 addresses
to	192.168.100.200	The end of the span of DHCP IPv4 addresses.
Validity	10Days	The validity of the DHCP IPv4 addresses

• With the button Apply made changes are saved. A new login to the new IP address of the Fritz!Box is then necessary

Create VPN configuration

Start screen of the Set up Fritz!Remote access software

The configuration of the VPN connection is not done via the configuration interface in the browser, but is imported to the Fritz!Box as a file. The configuration file is created with an application software, which is downloaded from the website of the manufacturer AVM. The application software is called Configure Fritz!Box VPN Connection.

Show instructions to create VPN configuration

• Download and install the Configure Fritz!Box VPN Connection software
• Click on the icon New in the toolbar to create a new configuration file. Two files are always created, of which the fritzbox_fritz_lokal.spdyn.de.cfg file is required
  ‍

  The required configuration file always starts with fritzbox_ and in addition the entered DynDNS name of the Fritz!Box from the 2nd setup step in the application software.

A wizard guides you through the creation of the configuration file:

Step 1

Select type of connection

• In the first step, select which devices are to be connected to each other
• Two devices should connect with each other. Activating  Configure a connection between two FRITZ!Box networks
• Next

Step 2

Enter spDyn domain (or other dynamic DNS service)

• First, the data of the local Fritz!Box are queried
• Specify the established spDyn URL of the local router

In this example: fritz_lokal.spdyn.de

• Next

Step 3

Enter internal network

• Enter the internal network of the local Fritz!Box and the corresponding subnet mask

The internal network of the Fritz!Box that is to be accessed via the VPN connection is set up.

‍

The network that was set up under Change Internal Network

• Click on Next

Step 4

Static IP address of the Securepoint appliance

• Afterwards the data of the remote station are queried
• Specify the fixed IP address of the Securepoint appliance

In this example: 192.0.2.192

• Next

Step 5

Internal network of the Securepoint appliance

• Enter the internal network of the Securepoint appliance and the corresponding subnet mask
• Next

Step 6

Show directory of files

• The data entry is finished
• In the next step decide whether to display or export the configuration files

Select the first point here

• Finish

The location of the files is displayed.

Two files are created by the wizard, only one is imported into the Fritz!Box. In this example, this is the file: fritzbox_fritz_lokal.spdyn.de.cfg.

‍

The required configuration file always starts with fritzbox_ and in addition the entered DynDNS name of the Fritz!Box from the 2nd setup step in the application software.

notempty

This configuration file still has to be adapted so that a connection to the Securepoint appliance can be established.

• Open this file in any editor

---

Adjust the configuration file

The configuration file created above will be adjusted.
Entries marked in green are individual configurations.
Necessary manual changes are additionally marked with .

vpncfg {
    connections {
        enabled = yes;
        conn_type = conntype_lan;
        name =  "Securepoint";              //  Name of the connection in the configuration interface
        always_renew = yes;
        reject_not_encrypted = no;
        dont_filter_netbios = yes;
        localip = 0.0.0.0;
        local_virtualip = 0.0.0.0;
        remoteip = 192.0.2.192;               // static IP address of the Securepoint appliance
        remote_virtualip = 0.0.0.0;
        localid {
            fqdn = "fritz_lokal.spdyn.de";    // spdyn DNS name of the Fritz!Box
            //ipaddr = xxx.xxx.xxx.xxx;       // static IP address of the Fritz!Box, if available
        }
        remoteid {
            ipaddr = 192.0.2.192;             // static IP address of the Securepoint appliance
        } 
        mode = phase1_mode_idp;               //  Main-Mode
        phase1ss = "dh15/aes/sha";            //  Proposals for Phase 1 (DH15, AES, SHA).
        keytype = connkeytype_pre_shared;
        key = "secret";                       //  VPN Password (Preshared Key)
        cert_do_server_auth = no;
        use_nat_t = no; / yes;                //  Is a site behind a NAT router yes = yes; no = no; 
        use_xauth = no;
        use_cfgmode = no;
        phase2localid {
            ipnet {
                ipaddr =  192.168.100.0;      // internal network of the Fritz!Box
                mask = 255.255.255.0;
            }
        }
        phase2remoteid {
            ipnet {
                ipaddr = 192.168.175.0;       //  internal network of the Securepoint appliance
                mask = 255.255.255.0;
            }
        }
        phase2ss =  "esp-all-all/ah-none/comp-all/pfs";              //  with compression
        accesslist = "permit ip any 192.168.175.0 255.255.255.0";    //  internal network of the Securepoint appliance
    } 
    ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",
                        "udp 0.0.0.0:4500 0.0.0.0:4500";
}
// EOF

Explanation of changes and settings

Caption	Value	Description
name =	"Securepoint";	// Name of the connection in the configuration interface The name of the connection has been renamed to a unique term. This is displayed in the Fritz!Box configuration interface when the file has been imported.
remoteip =	192.0.2.192;	// static IP address of the Securepoint appliance This is the static IP address of the Securepoint appliance. Has already been configured in the wizard.
localid{    fqdn =	"fritz_lokal.spdyn.de";	// spdyn DNS name of the Fritz!Box Has already been configured in the wizard.
//ipaddr = }	xxx.xxx.xxx.xxx;	// static IP address of the Fritz!Box, if available An IP address can also be entered here if the Fritz!Box has a static IP address. These entries are also set by the wizard.
remoteid {    ipaddr = }	192.0.2.192;	// static IP address of the Securepoint appliance Re-entering the static IP address of the Securepoint appliance. Has already been configured in the wizard.
mode =	phase1_mode_idp;	// Main-Mode The transport mode must be changed from "aggressive" to "main", because only this mode is supported by the Securepoint software.
phase1ss =	"dh15/aes/sha";	// Proposals for Phase 1 (DH15, AES, SHA). The encryption parameters for IKE phase 1 must be adjusted. notempty Older Fritz!Box firmware versions only support AES 128 bits, SHA1 and DHA2.
key =	"secret";	// VPN Password (Preshared Key) Enter the preshared key.The preshared key generated by the wizard can also be used. This must then also be stored on the Securepoint appliance.
phase2localid {    ipnet {      ipaddr =      mask =   } }	192.168.100.0; 255.255.255.0;	// internal network of the Fritz!Box // Subnet mask Under phase2localid, the internal network of the Fritz!Box that is to be connected to the remote network must be specified.
phase2remoteid {    ipnet {      ipaddr =      mask =   } }	192.168.175.0; 255.255.255.0;	// internal network of the Securepoint appliance The internal network of the Securepoint appliance must be listed under phase2remoteid.
phase2ss =	"esp-all-all/ah-none/comp-all/pfs"	// with compression The encryption parameters for IKE phase 2 must be identical to those for phase 1. notempty Older Fritz!Box firmware versions only support AES 128 bits, SHA1 and DH2. If "all/all/all" is entered in phase 1, "esp-all-all" can then be entered accordingly. With "ah-none" no authentication header is expected and with "comp-all" compression is supported.
accesslist =	"permit ip any 192.168.175.0 255.255.255.0";	// internal network of the Securepoint appliance

The so modified configuration file is saved again as fritzbox_fritz_lokal.spdyn.de.cfg.

Add additional networks

If further networks are to be added to the Securepoint appliance, the parameter accesslist in the configuration file is adjusted accordingly.

Example 1

Example 1

The networks 192.168.82.0/24 to 192.168.92.0/24 should be accessible via VPN.
This means that only the specified network mask is adjusted in the accesslist parameter:

accesslist = "permit ip any 192.168.82.0 255.255.240.0";

‍

This enables the networks 192.168.80.0/24 to 192.168.95.0/24.

Example 2

Example 2

In addition to the network 192.168.175.0/24, the network 192.168.82.0/24 should also be accessible via VPN.
This additional network is added in the accesslist parameter:

accesslist = "permit ip any 192.168.175.0 255.255.255.0", "permit ip any 192.168.82.0 255.255.255.0";

‍

Separate these entries with a comma and end with a semicolon.

Upload configuration file

Adding a VPN connection in the Fritz!Box

In the logged-in Interace of the Fritz!Box, Internet ➊ → Permit Access ➋ → VPN (IPSec) ➌ on the Add VPN Connection ➍ is clicked.

Selecting the type of VPN configuration in the Fritz!Box

In the VPN Connection window,  Import a VPN configuration from a VPN settings file ➎ is selected from the four setup options.
Continue with Next ➏.

Upload the configuration file in the Fritz!Box

Via the Browse... button ➐ the configuration file that was created is selected.
If the file is encrypted, this setting will be enabled. Under Password the password is then entered.
Finally, click on Apply ➑.

Under System → Event Log the connection establishment is logged.

---

Set up Securepoint Appliance

Subsequently, the settings on the Securepoint appliance must be configured:

The UTM must have a static public IP address

• A site-to-site IPSec connection is established. notempty
  Use IKE version 1 and the same preshared key as in the configuration file of the Fritz!Box
• If necessary, create a network object for the IPSec VPN network of the remote station and create the corresponding firewall rules, if they are not created automatically by the wizard
• Adjust the settings of the phases of the IPSec connection. notempty
  Use Phase 2 PFS

Unfortunately, there are different experiences as to which side should initiate the connection. Therefore, we can not give a recommendation on this. More detailed information on setting up the Securepoint appliance can be found in the wiki article IPSec Site-to-Site.

Establish IPSec S2S connection

Step 1 - Connection type Step 1 - Connection type
In step 1, the Site to Site - connection type is selected.			Add IPSec connection UTMuser@firewall.name.fqdnVPNIPSec Setup step 1
Step 2 - General Step 2 - General
Caption	Value	Description	Setup step 2
Name:	IPSec Fritz!Box S2S	A suitable name for this connection
IKE Version:	IKE v1IKE v2	For the IKE version select IKE version 1 At the time of this documentation, AVM only supports IKEv1
Step 3 - Local Step 3 - Local
Local Gateway ID:	LAN1	The IP address or the interface of the Securepoint appliance that is to establish the VPN connection to the Fritz!Box.	Setup step 3
Authentication method	Pre-Shared Key	Select Pre-Shared Key
Pre-Shared Key:	**********	Enter the pre-shared key from the configuration file of the Fritz!Box
Share networks:	»192.168.175.0/24	The internally accessible network of the Securepoint appliance, as specified in the configuration file.
Step 4 - Remote station Step 4 - Remote station
Remote Gateway:	fritz_lokal.spdyn.de	Public IP address (or hostname that can be resolved via DNS) of the Fritz!Box	Setup step 4
Remote Gateway ID:	fritz_lokal.spdyn.de	ID configured on the Fritz!Box as the local ID (freely selectable string).
Share networks:	»192.168.100.0/24	The local network of the Fritz!Box to be accessed via the VPN, as specified in the configuration file.

Configure IKEv1 phases

Phase 1 and Phase 2 of IKEv1 should be reviewed and adapted if necessary.
notempty

The settings must be identical to those in the configuration file created above.

notempty

If phase1ss = "all/all/all"; or phase2ss = "esp-all-all/[...]"; was entered in the configuration file, the default values are set in the Securepoint appliance for IKEv1 phase 1 or phase 2.

These default values are not supported by the Fritz!Box.

The manufacturer AVM informs which encryption methods and algorithms are supported by the Fritz!Box.

Configure IKEv1 phase 1
Under VPN IPSec  Area Connections, click on Phase 1 for the created IPSec S2S connection and switch to the IKE tab in the Edit Phase 1 dialog.
Caption	Value	Description	Edit phase 1 UTMuser@firewall.name.fqdnVPNIPSec Configuration of phase 1 for IKEv1
Encryption:	aes256	Set aes256 as the encryption. You can also select a different one.notempty If the Fritz!Box does not support the set encryption, select aes128.
Authentication:	sha2_512	Set sha2_512 as authentication. You can also select a different one. notempty If the Fritz!Box does not support the set authentication, select sha1.
Diffie-Hellman Group:	modp3072	Set modp3072 (DH15) as the Diffie-Hellman Group. notempty If the Fritz!Box does not support the set Diffie-Hellman Group, select modp1024 (DH2).
Display weak algorithms:	Off	Is activated if weaker algorithms are required, such as for Authentication: sha1 and Diffie-Hellman Group: modp1024.
Strict:	Off	If activated, only the configured parameters and no other proposals are used.
IKE Lifetime:	1 hour Default	The IKE Lifetime can be customized.
Rekeying:	unlimited (recommended) Default	The number of rekeying can be adjusted.
The changes made are saved with the Save button.
Configure IKEv1 phase 2
Under → VPN →IPSecTab Connections, click on Phase 2 for the created IPSec S2S connection. notempty The set parameters must be identical to those of phase 1.
Caption	Value	Description	Edit phase 2 UTMuser@firewall.name.fqdnVPNIPSec Configuration of phase 2 for IKEv1
Encryption:	aes256	Set aes256 as the encryption. You can also select a different one.notempty If the Fritz!Box does not support the set encryption, select aes128.
Authentication:	sha2_512	Set sha2_512 as authentication. You can also select a different one. notempty If the Fritz!Box does not support the set authentication, select sha1.
Diffie-Hellman Group:	modp3072	Set modp3072 (DH15) as the Diffie-Hellman Group. notempty If the Fritz!Box does not support the set Diffie-Hellman Group, select modp1024 (DH2).
Display weak algorithms:	Off	Is activated if weaker algorithms are required, such as for Authentication: sha1 and Diffie-Hellman Group: modp1024.
Key life time:	8 hours Default	The key life time can be adjusted.
Restart after abort:	Off	If activated, the connection is re-established in the event of an unexpected disconnection.
DHCP:	Off	When activated, the clients receive IP addresses from a local network. Further configurations are required for this, see wiki article on DHCP for IPSec.
The changes made are saved with the Save button.

Firewall-Rules

The packet filter rules of the firewall still need to be adjusted if they are not automatically generated by the wizard.
Implied rules
The following rules must be active via Firewall Implied rules  Area VPN
Active	Rule		Implied rules UTMuser@firewall.name.fqdnFirewall Activation of the required VPN rules
On	IPSec IKE
On	IPSec ESP
On	IPSec NAT Traversal
When the implicit rule group VPN is activated, all associated rules are activated. notempty As a general rule: Only release what is needed for the person who needs it.
Packet filter rule
Before a corresponding packet filter rule can be created, a network object must be created for the Fritz!Box network. This network object is created under Firewall Network objects  Button Add object
Caption	Value	Description	Add network object UTMuser@firewall.name.fqdnFirewallnetwork objects Creating the Fritz!Box network object
Name:	IPSec-Fritz!Box	Freely selectable name for this network object
Type:	VPN network	Select VPN network
Address:	192.168.100.0/24	The internal network of the Fritz!Box
Zone:	vpn-ipsec	Select vpn-ipsec
Groups:		The network object can be assigned to one or more groups
Two packet filter rules are created under Firewall Packetfilter  Button Add rule. A rule from the Securepoint appliance  internal-network to the internal network of the Fritz!Box  IPSec-Fritz!Box with the Service  ms-rdp The NAT type Hidenat-Exclude is selected with the network object  external-interface A second rule from the internal network of the Fritz!Box  IPSec-Fritz!Box to the Securepoint appliance  internal-network with the Service  ms-rdp

		#	Source	Destination	Service	NAT	Action	Active
			internal-network	IPSec-Fritz!Box	ms-rdp	HNE	ACCEPT	On
			IPSec-Fritz!Box	internal-network	ms-rdp		ACCEPT	On

---

Initiate IPSec connection

IPSec UTMuser@firewall.name.fqdnVPN IPSec Log Save and restart Nur für interne Prüfzwecke

Fig.1

After the Securepoint appliance and the Fritz!Box have been configured, the IPSec connection is established.
Establish the connection from the Securepoint appliance:

• Switch to VPN IPSec  Area Connections
• Click the Load ➊ button on the connection you just created to load the connection data.
• To initiate the connection, click the Initiate ➋ button

The connection to the Fritz!Box is established.

Fig.2

• To view the status of the connection on the Fritz!Box, in the interface of the Fritz!Box go to Internet ➌ → Permit Access ➍
• Switch to the dialog VPN (IPSec) ➎
• In the lower area VPN Connections you can see the created connection
• In the column Status a green circle ➏ is displayed when a connection is established

notempty

It can still happen that no IPSec connection is established, neither by the Securepoint appliance nor by the Fritz!Box, despite correct configuration of the Securepoint appliance, the Fritz!Box and the configuration file.
In this case, a downgrade of the Fritz!Box firmware version, configuration of the Fritz!Box without 2-factor authentication and a renewed update of the Fritz!Box firmware may help.
Nevertheless, the settings made should first be checked, especially for IKEv1.