Jump to:navigation, search
Wiki

SSL-VPN Site-to-Site

From Securepoint Wiki





notempty
Dieser Artikel bezieht sich auf eine nicht mehr aktuelle Version!

notempty
Der Artikel für die neueste Version steht hier

notempty
Zu diesem Artikel gibt es bereits eine neuere Version, die sich allerdings auf eine Beta-Version bezieht
 

























































}}











































































Configuration of SSL-VPN site-to-site connections

Last adaptation to the version: 12.4.1

New:
notempty
This article refers to a Beta version
Access: UTM-IP:Port or UTM-URL:Port
Port as configured at Network / Appliance Settings / Webserver
Default-Port: 11115
i.e.: https://utm.ttt-point.de:11115
Default: https://192.168.175.1:11115 → VPN →SSL-VPN


Introduction

SSL-VPN can also be used to establish site-to-site connections. Since this requires the corresponding instance of the service to run explicitly in client or server mode, it is possible to create multiple instances of the SSL-VPN service.

Site-to-Site Server

Site-to-Site Server
S2S Server
This method is used when the remote terminal is the initiator of the connection. For this, the service must explicitly start in server mode.

Site-to-Site Client

Site-to-Site Client
S2S Client
This method is used when the UTM itself is the initiator of the connection. For this, the service must explicitly start in client mode.


Site-to-Site Server Configuration

notempty
For the S2S server setup, a CA, a server certificate and a client certificate are required.


SSL-VPN Connection

Set up the connection under → VPN →SSL-VPN Button Add SSL-VPN connection menu.

Installation wizard

Step 1
Step 1 S2S Server

Installation step 1

In installation step 1 the connection type is selected, the following connections are available:

  • Roadwarrior Server
  • Site-to-Site Server
  • Site-to-Site Client

For the configuration of the Site-to-Site server this is selected.



Step 2
Step 2 S2S Server

Installation step 2

If a local IPv6 network is to be connected, the option Use IPv6 over IPv4: must be enabled Yes.



Step 3
Step 3 S2S Server
Caption Value Description
Installation step 3
Name: S2S-server Unique name
Protocol: UDP Desired protocol
Server certificate: cs-ttt-point Selection of the certificate with which the server authenticates itself
If a server certificate does not yet exist, it can be created (and if necessary also a CA) in the certificate management. Open with
  • Create a CA in the CA tab using the Add CA button
  • Create a server certificate in the Certificates tab using the Add certificate button.
    Please note: Server certificate: enable
  • Create the client certificate with the Add certificate button

Both certificates must be created with the same CA! The Client certificate and the associated CA are also needed to configure the remote terminal (client). They must be exported with the button. For use with a UTM as client, the PEM-format is required.
Further notes in the Wiki article on the use of certificates.

Share server networks: » 192.168.175.0/24 Network located at this appliance (VPN server) that is to be accessible via SSL-VPN.


Step 4
Step 4 S2S Server

In installation step 4, the transfer network for the site-to-site server is entered.

Caption Value Description
Installation step 4
Transfer network: 192.168.190.0/24 A network address must be specified that is not used in any network of the involved appliances.
Server tunnel address: 192.168.190.1/32 The server and client tunnel address is determined automatically.
IPv4 client tunnel address: 192.168.190.2/24


Step 5
Step 5 S2S Server
Caption Value Description
Installation step 5
Name: S2S-client Is automatically generated from the name defined in step 3
Client certificate: *.ttt-point.de Certificate of the client network
Share client networks: »192.168.174.0/24 Networks of the remote terminal that are to be released. (Input by clicking in the click box and then using the keyboard).
notempty
The selected certificate should not be used with any other client / network.


Tab General
Tab General S2S Server
Caption Value Description
Tab General
Name: S2S-server Name of the ssl connection
Interface: tun0 Used interface
Modus: SERVER Depending on connection type
Protocol: UDP (Default)
TCP		 Select preferred protocol (UDP and TCP can each be limited to IPv4 or IPv6).
Port: 1194 Default port for the first SSL VPN connection. May not be used for any other purpose. For further connections, the next free port is selected.
Authentication: NONE (Default)
LOCAL
RADIUS		 Select the appropriate authentication method
Certificate: cs-ttt-point The certificate used can be changed here
Data Connection Cipher: Default Default settings of OpenSSL are used.
notempty
The remote terminal must use the same cipher!
BF-CBC DES-EDE-CBC DES-EDE3-CBC CAST5-CBC AES-128-CBC AES-192-CBC AES-256-CBC AES-128-GCM AES-192-GCM AES-256-GCM
Data Connection Hash: Default Default settings of OpenSSL are used.
notempty
The remote terminal must use the same hash!
SHA1 SHA224 SHA256 SHA384 SHA512 whirlpool
Allowed ciphers for auto-negotiation (NCP):     Individual ciphers can be selected from a list.
IPv4 Transfer network: 192.168.190.0/24 Enter pool address
IPv6 Transfer network:       /64 Enter pool address
Share server networks globally:     Network IP for networks behind the UTM that are supposed to be accessible via the SSL VPN connection can be edited.
Search Domain:     notempty
It only makes sense to specify a search domain for a Roadwarrior connection!
Renegotiation: never
1 hour (Default)
2 hours
4 Stunden
8 Stunden
12 Stunden		 Period of time from which the connection is rebrokered
Save Saves the settings


Tab Advanced
Tab Advanced S2S Server
Caption Value Description
Tab Advanced
MTU: 1500 Maximum transmission unit of the largest packet (byte)
Max Clients: 1024 Maximum number of clients.
If no value is set, the default value of 1024 applies.
Push DNS: No Allows DNS transmission
Push WINS: No Allows WINS transmission
Multihome: On Allows the use of multiple default routes

Allow configured certificates only:		 On Only allocated certificates can still be accepted
LZO: Off LZO compression
After changing this option, the corresponding client counterparts must adjust their configuration!
Disabled: No
Pass TOS: Off Allows forwarding of TOS packets
Ping interval: 10 seconds Interval of ping requests
Ping timeout: 120 seconds Timeout of ping requests
Outgoing buffer size: 65536 Bytes Steuert die Größe des Puffers für den Socket
  • Je größer, desto mehr kann zwischen gespeichert werden. Das kann aber auch die Latenz erhöhen.
    • Incoming buffer size: 65536 Bytes s.o.
    Replay window sequence size: 64 Anzahl der Pakete innerhalb derer noch ältere Sequenznummern akzeptiert werden.
    Replay window waiting time: 15 seconds Zeitfenster in dem die Sequenzgröße maximal angewendet wird
    Save Saves the settings


    Other client remote terminals
    Other client remote terminals S2S Server

    Overview of SSL-VPN connections

    Additional remote sites that are to be connected via this site-to-site server can be added via the button.
    Display of remote sites by clicking on the folder icon


    Other remote terminals of the S2S-SSL-.VPNs



    Rulebook

    Implied rules
    Implied rules
    S2S Server

    Implied rules

    Under → Firewall →Implied Rules section VPN the protocol used for the connection can be enabled. Here On SSL-VPN UDP. This implicit rule frees the ports used for SSL-VPN connections on the WAN interface.



    Network objects
    Network objects
    S2S Server

    A TUN interface was created when the connection was set up. It automatically receives the first IP from the transfer network configured in the connection and a zone "vpn-ssl-<servername>". To be able to reach the client network of the remote terminal, a network object must be created for this purpose.
    The TUN interface of the site-to-site client also receives an IP from this network. This serves as a gateway to the subnet of the site-to-site client. The subnet of the client must be created as a network object and is located in the zone on the associated TUN interface.


    Caption Value Description
    Network object for the tunnel network
    Name: sslvpn-S2S-Client-Network Unique name
    Type: VPN-Netzwerk If only a single host is to be shared in the client network, VPN host can also be selected here.
    Address:   192.168.174.0/24 The network address that was shared as the client network in step 5
    If multiple client networks have been shared, a separate network object must be created for each of these networks. Subsequently, the network objects can then be combined into a group.
    Zone: vpn-ssl-S2S-Server The zone on the S2S server through which the S2S client network is accessed.
    Group:     Optional
    Save Saves the settings


    Portfilter rules
    Portfilter rules
    S2S Server

    Portfilter rules

    Menu → Firewall →Portfilter tab Portfilter Button Add Rule

    Two rules allow access to or from the S2S client network:


    # Source Destination Service NAT Action Activ
    4 sslvpn-S2S-client-network internal-network default-internet Accept On
    5 internal-network sslvpn-S2S-client-network default-internet Accept On


    Routen
    Routen
    S2S Server

    The routes are set automatically.
    However, when using VoIP through the tunnel, routes should be set to ensure that the phones connect correctly to the PBX.
    Menu → Network →Network configurationTab Routing Button Add route
    A route should be set so that the network of the remote terminal can be found reliably.

    Caption Value Description
    Route for remote terminal
    Gateway interface: tun0 A TUN interface was created when the connection was set up and must be specified here.
    Target network: 192.168.174.0/24 The network of the remote terminal (S2S Client)


    Site-to-site client configuration

    SSL-VPN Connection

    Installation wizard
    notempty
    For the S2S server setup, a CA, a server certificate and a client certificate are required.


    Step 1
    Step 1 S2S Client

    Installation step 1

    In installation step 1 the connection type is selected, the following connections are available:

    • Roadwarrior Server
    • Site-to-Site Server
    • Site-to-Site Client

    For the configuration of the Site-to-Site Client this is selected.



    Step 2
    Step 2 S2S Client

    Installation step 2

    If a local IPv6 network is to be connected, the option Use IPv6 over IPv4: must be enabled Yes.



    Step 3
    Step 3 S2S Client

    Local settings for the Site-to-Site Client can be made in step 3. Here you can enter a name for the connection, select protocol, choose a server certificate - by clicking the button with the window you can import a CA and a certificate.

    Caption Value Description
    Installation step 3
    Name: S2S-client Unique name
    Protocol: UDP Desired protocol
  • It is necessary to select the same protocol as for the site-to-site server.
    • Client certificate: CC-S2S-Client-Network1 Selection of the certificate with which the client authenticates itself.
    The same certificate must be used here that was selected as the certificate of the remote terminal (client) for the site-to-site server in step 5.

    Open with

    • Tab CA Button Import CA Import CA from
      S2S server
    • Tab Certificates Button Import certificate Import the client certificate created on the
      S2S server
      .


    Step 4
    Step 4 S2S Client

    This installation step is omitted for the site-to-site client.


    Step 5
    Step 5 S2S Client

    Installation step 5
    In step 5, the public remote gateway IP address or SPDyn address of the site-to-site server is entered as the remote site.
    notempty
    The port address must be set with a colon after the IP address.

    If port 1194 is used, this specification can be omitted.


    Tab General
    Tab General S2S Client
    Caption Value Description
    Tab General
    Name: S2S-client Name of the ssl connection
    Interface: tun0 Used interface
    Modus: Client
    Protocol: UDP (Default)
    TCP    		 Desired protocol
    Certificate: CC-S2S-Client-Network1 Das verwendete Zertifikat kann hier geändert werden
    Data Connection Cipher: Default Default settings of OpenSSL are used.
    notempty
    The remote terminal must use the same cipher!
    BF-CBC DES-EDE-CBC DES-EDE3-CBC CAST5-CBC AES-128-CBC AES-192-CBC AES-256-CBC AES-128-GCM AES-192-GCM AES-256-GCM
    Data Connection Hash: Default Default settings of OpenSSL are used.
    notempty
    The remote terminal must use the same hash!
    SHA1 SHA224 SHA256 SHA384 SHA512 whirlpool
    Allowed ciphers for auto-negotiation (NCP):     Individual ciphers can be selected from a list.
    Renegotiation: never
    1 hour (Default)
    2 hours
    4 hours
    8 hours
    12 hours    		 Period of time from which the connection is rebrokered
    Save Saves the settings


    Tab Advanced
    Tab Advanced S2S Client
    Caption Value Description
    Tab Advanced
    MTU: 1500 Maximum transmission unit of the largest packet (byte)
    LZO: Off LZO compression
    After changing this option, the corresponding client counterparts must adjust their configuration!
    Disabled: No
    Pass TOS: Off Allows forwarding of TOS packets
    Ping interval: 10 seconds Interval of ping requests
    Ping timeout: 120 seconds Timeout of ping requests
    Outgoing buffer size: 65536 Bytes
    Incoming buffer size: 65536 Bytes
    Replay window sequence size: 64
    Replay window waiting time: 15 seconds
    Save Saves the settings


    S2S Client Rulebook

    S2S Client Implied rules

    Since the site-to-site client establishes the connection to the S2S server and outgoing connections from the firewall itself are always allowed by default, no implicit rules are necessary.

    S2S Client Network objects
    Caption Value Description
    Network object for the tunnel network
    Name: sslvpn-S2S-Server-Network Unique name
    Type: VPN network If only a single host is to be shared in the server network, VPN host can also be selected here.
    Address: 192.168.175.0/24
    If several server networks have been shared, a separate network object must be created for each of these networks. The network objects can then be combined into a group.
    Zone: vpn-ssl-S2S-client the zone on the S2S client through which the S2S server network is accessed.
    Group:     Optional


    S2S Client Portfilter rules
    S2S Client Portfilter rules
    S2S Client

    Portfilter rules in the S2S Client

    Menu → Firewall →PortfilterTab Add rule Button +.
    Two rules allow access to or from the S2S server network or from the network:

    # Source Destination Service NAT Action Activ
    5 internal-network sslvpn-S2S-server-network default-internet Accept On
    4 sslvpn-S2S-server-network internal-network default-internet Accept On


    S2S Client Routen
    S2S Client Routen
    S2S Client

    The routes are set automatically.
    However, when using VoIP through the tunnel, routes should be set to ensure that the phones connect correctly to the PBX.
    Menu → Network →Network configurationTab Routing Button Add route
    A route should be set so that the network of the remote terminal can be found reliably.

    Caption Value Description
    Route for remote terminal
    Gateway interface: tun0 A TUN interface was created when the connection was set up and must be specified here.
    Target network: 192.168.175.0/24 The network of the remote terminal (S2S Server)


    Note

    Encryption

    By default, an AES128-CBC method is used. The encryption method can be customized in the server or/and client profile.

    notempty
    The parameters must be identical on the server and client side. Otherwise data transfer is not possible


    Hash method

    By default, a SHA256 hash method is used. The hash method can be customized in the server or/and client profile.

    notempty
    The parameters must be identical on the server and client side. Otherwise data transfer is not possible


    QoS

    For the VPN connection, the TOS fields for automatic QoS can be set in the package.
    This setting can be changed in the VPN connection settings in the Advanced tab under Pass TOS: On must be enabled.


    Multipath

    Multipath
    S2S Client

    For multipath on the client side, the VPN connection in the client must be bound to an interface.
    To bind a client connection to an interface, the CLI command must be used openvpn get to locate the ID of the connection.
    The command openvpn set id $ID_DES_TUNNELS local_addr $IP_DES_INTERFACES can then be used to set the outgoing IP.
    In addition, a rule route via the corresponding tunX interface is required in the outgoing rule (internal-network → VPN network → $DIENST).


    Search Domain

    Search Domain
    S2S Server


    Transmit DNS/WINS

    The DNS and WINS can be transmitted automatically. This setting can be enabled in the VPN connection settings under the Advanced tab:

    • Transmit DNS: On
    • Transmit WINS: On
      The IP addresses from DNS and WINS are set in the menu → VPN →Global VPN settingsTab Domain Name System.


    IPv6 for inbound connections

    In the settings of the site-to-site server, the protocol UDP6 or TCP6 for IPv6 can be activated under General -> Protocol.


    The transparent HTTP proxy

    When accessing a server behind the site-to-site connection from the internal network via HTTP, the transparent HTTP proxy may filter the packets. This can lead to errors in the accesses to the target.
    To prevent this from happening a rule must be added in the → Applications →HTTP ProxyTab Transparent Mode Button Add transparent rule menu:

    Caption Value
    Protocol: HTTP
    Type: Exclude
    Source: internal-network
    Destination: name-vpn-netzwerk-objekt


    If SSL interception is used, this should be done additionally for the HTTPS protocol.

    Retrieved from "https://wiki.securepoint.de/index.php?title=UTM/VPN/SSL_VPN-S2S_v12.4.1&oldid=91683"