Jump to:navigation, search
Wiki

IPSec Site-to-Site

From Securepoint Wiki



































































































De.png
En.png
Fr.png









IPSec connections Site-to-Site

Last adaptation to the version: 14.0.0

New:
notempty
This article refers to a Resellerpreview
Access: VPN IPSec  Area Connections


Introduction

A Site-to-Site connection links two networks together.
For example, the local network of a main office with the local network of a branch office / secondary office.

Public IP addresses, as well as dynamic DNS entries, can be used to connect the two remote gateways.


Preparation

If there is a router (e.g. Fritz!Box or Speedport) in front of the Securepoint appliance, it must be ensured that ESP and UDP 500/ 4500 are active there. See Example configuration with a Fritz!Box.


Configuration of an IPSec Site-to-Site connection

After logging in to the administration interface of the firewall (in the delivery state: https://192.168.175.1:11115), an IPSec connection can be added in the menu VPN IPSec}  Button + Add IPSec connection.


Setup Wizard

Step 1 - Connection type
Caption Value Description Add IPSec Connection UTMuser@firewall.name.fqdnVPNIPSec UTM v12.8.0 IPSec S2S Schritt1-en.pngSetup step 1
Selection of the connection type: The following connections are available.
  • Roadwarrior
  • Site to Site
 For the configuration of a
Site to Site
 connection, this one is selected.
Step 2 - General
Name: IPSec S2S Name for the connection UTM v12.8.0 IPSec S2S Schritt2-en.png
Setup step 2
IKE Version: IKE v1 (deprecated)IKE v2 Default Selection of the IKE version.
notempty
IKE v1 is considered deprecated and should no longer be used
Subnetzkombinationen gruppieren:
notempty
New in the setup wizard
Nur bei IKE v2		 On Bei Verwendung von IKE v2 ist es mithilfe dieser Konfiguration möglich, mehrere Subnetze unter einer SA zusammenzufassen.
  • Sollte die Gegenstelle ein Problem mit der Gruppierung der Subnetzkombinationen haben, sollte diese Option deaktiviert werden.
    • Step 3 - Local
    Local Gateway ID: Any interface Any string.
    The gateway ID flows into the authentication. This can be an IP address, a host name or an interface. On the remote gateway, this value must be configured exactly the same way.
  • If an email address should be used as Gateway ID, it is necessary to insert a double @@ in front of the ID (mail@... becomes @@mail@...). Otherwise the ID will be treated as FQDN
  • Automatically filled in for certificate authentication method after certificate selection.
    		•  UTM v12.6 IPSec S2S Schritt3-en.png
    Setup step 3
    Authentication method: Pre-Shared Key A pre-shared key is in use
    Certificate A certificate is in use
    Pre-Shared Key
    For authentication method pre-shared key.    		     An arbitrary PSK
    Creates a very strong key
    Copies the PSK to the clipboard
    X.509 Certificate:

    For authentication method certificate.    		 Server certificate Selection of a certificate
    This certificate must be created beforehand under Authentication Certificates .
    Share networks: »192.168.122.0/24 Lokale Netzwerke der UTM
    , auf die Zugriff gewährt werden soll.
    Step 4 - Remote Gateway
    Remote Gateway: 192.0.2.192 Public IP address (or hostname that can be resolved via DNS) of the remote gateway. UTM v12.6 IPSec S2S Schritt4-en.png
    Setup step 4
    Remote Gateway ID: 192.0.2.192 ID configured as local ID on the remote gateway (any character string).
    Share networks: »192.168.192.0/24 The local network of the remote gateway to be accessed
    Exit the setup wizard with Finish
  • For S2S connections, it should be checked whether several subnets can be combined via MULTI_TRAFFIC_SELECTOR. This significantly reduces the number of SAs and increases the stability of the connection.
    To do this, the option Group subnet combinations is activated in phase 2.

    • More settings

    In addition to the settings that have already been defined in the wizard, further parameters can be configured:


    IKEv1

    notempty
    IKE v1 is considered deprecated and should no longer be used

    Step-by-step.png



    IKEv2

    Step-by-step.png



    Rulebook

    To grant access to the internal network, the connection must be allowed.

    It is possible, but not recommended to do this with implied rules under Firewall Implied Rules section VPN to configure this.
     However, these Implied Rules release the ports used for IPSec connections on all interfaces.
    notempty
    As a general rule:
    Only what is needed and only for the one who needs it is released!

    Create network object

    A network object must be created for the remote network.
    Firewall Network Objects  Button Add Object

  • If several subnets exist on the remote gateway, a network object must be created for each subnet.
    If the corresponding authorizations are to be assigned, these can be combined into network groups.
    • Name: IPSec-S2S Name for the IPSec S2S network object Add network Object UTMuser@firewall.name.fqdnFirewallNetwork Objects UTM v12.6 Netzwerkobjekt IPSec-en.png
    Type: VPN network Type to be selected
    Address: 192.168.192.0/24 The IP address of the local network of the opposite side, as entered in the Installation Wizard in Step 4 - Remote Gateway in the line Share networks.
    So in this example the network 192.168.192.0/24.
    Zone: vpn-ipsec Zone to be selected
    Group:     Optional: One or more groups to which the network object belongs.

    Packet filter rule

    First rule
    Source: internal-network Host or network (-pool), which should get access to the internal network Packetfilter UTMuser@firewall.name.fqdnFirewall Regeln aktualisieren UTM v12.6.5 Firewall Regel-IPSEC-en.pngPacket filter rules
    Destination: IPSec network Host, network or network group to which access is to be granted. Here, for example, a group of rdp servers.
    Service: benötigter Dienst Service or service group that is needed
    NAT: Hidenat Exclude
    Network Objects: external-interface
    Second rule
    Source: IPSec network Host or network (-pool), which should get access to the internal network
    Destination: internal-network Destination
    Service: benötigter Dienst Service or service group that is needed
    NAT: No NAT


    Configuration of the second gateway

    notempty
    It should be noted that the IKE version is identical on both sides.


    Use of a Securepoint UTM

    On the remote gateway, the settings must be made in a similar way

    • A new IPSec VPN connection is created using the IPSec wizard
    • A network object for the IPSec network is created
    • Port filter rules are created


    Remote Gateway step 2
    • The same authentication method must be selected
    • The same authentication key (PSK, certificate, RSA key) must be available
    • The same IKE version must be used


    Remote Gateway step 3
    • As Local Gateway ID the Remote Gateway ID from step 4 of the first UTM must now be used
    • Under Share Networks the (there remote) network from step 4 of the first UTM must also be used


    Remote Gateway step 4
    • The public IP address (or a hostname that can be resolved via DNS) of the first UTM must be entered as Remote Gateway.
      (This address was not required in the wizard of the first UTM).
    • The Local Gateway ID from step 3 of the first UTM must be used as Remote Gateway ID
    • Under Share networks the (there local) network from step 3 of the first UTM must also be used.


    Create network object of the remote gateway
    • The network object of the remote gateway represents the network of the first UTM.
      Correspondingly, the network address of the local network of the first UTM must be entered under Address.
      In the example 192.168.218.0/24


    Notes

    Add Transparent rule UTMuser@firewall.name.fqdnApplicationsHTTP-Proxy UTM v12.6 IPSec S2S HNE bei transparentem Proxy-en.png Transparent rule


    The transparent HTTP proxy

    If a server behind the Site-to-Site connection is to be accessed from the internal network via HTTP, the transparent HTTP proxy may filter the packets.
    This can lead to errors while accessing the target.
    To prevent this from happening, a rule Exclude must be created in the Applications HTTP Proxy  Area Transparent mode Button Add transparent rule menu with source internal-network to target name-vpn-network-object and protocol HTTP.



    Troubleshooting

    Detailed Troubleshooting instructions can be found in the Troubleshooting Guide.
    If an email address should be used as gateway ID, it is necessary to insert a double @@ in front of the ID (mail@... becomes @@mail@...). Otherwise the ID will be treated as FQDN.


















































    Connection Rate Limit

    Throttling of access from certain source IPs to recurring ports

    notempty

    The function is still in the testing phase and will be further expanded.
    The function can initially only be configured via the CLI

    The function aims to protect against attacks.
    SSL-VPN accesses can be protected against aggressive scans or login attempts, for example.

    Connection Rate Limit.png
    Connection Rate Limit Access.png

    From v12.6.2, the UTM can limit the number of TCP and/or UDP connections from an external IP address to one port.
    The following conditions apply:

    • Only incoming connections for which a default route exists are monitored
    • The connections from an IP address to a port of the UTM are counted within one minute
    • When activated, 5 connections / connection attempts per minute are permitted.
      The connections are then limited:
      • The additionally permitted connections are distributed evenly within 60 seconds of the first connection.
      • With a CONNECTION_RATE_LIMIT value of 20, an additional connection is added every 3 seconds.
      • 10 seconds after the first login, 3 further connections could be established (each from the same IP address to the same destination port)
    • Blocking an IP address only affects access to the port that has been used too often.


    Other ports can still be accessed.

    • The function is activated by default for new installations on 20 UDP connections / minute on all ports
    • For Updates the function must be manually activated
    extc-Variable Default Description
    CONNECTION_RATE_LIMIT_TCP 0 Number of permitted TCP connections of an IP address per port
    0 = Function deactivated, no blocking is performed
    CONNECTION_RATE_LIMIT_TCP_PORTS Ports to be monitored. Empty by default=all ports would be monitored (if activated).
    Individual ports are separated by spaces: [ 1194 1195 ]
    CONNECTION_RATE_LIMIT_UDP 20 / 0
    		Number of permitted UDP connections of an IP address per port
    CONNECTION_RATE_LIMIT_UDP_PORTS Ports to be monitored. Empty by default=all ports are monitored (only for new installations!).
    Individual ports are separated by spaces: [ 1194 1195 ]

    Configuration with CLI commands

    Retrieved from "https://wiki.securepoint.de/index.php?title=UTM/VPN/IPSec-S2S&oldid=93813"