Jump to:navigation, search
Wiki

IPSec - End to Site / Roadwarrior

From Securepoint Wiki





notempty
Dieser Artikel bezieht sich auf eine nicht mehr aktuelle Version!

notempty
Der Artikel für die neueste Version steht hier

notempty
Zu diesem Artikel gibt es bereits eine neuere Version, die sich allerdings auf eine Reseller-Preview bezieht




















































































IKE




De.png
En.png
Fr.png






Configuration of an End-to-Site-connection with IPSec for roadwarrior
Last adaptation to the version: 12.2.3
New:
notempty
This article refers to a Resellerpreview

11.8 11.6.12

Access: UTM-IP:Port or UTM-URL:Port
Port as configured at Network / Appliance Settings / Webserver
Default-Port: 11115
i.e.: https://utm.ttt-point.de:11115
Default: https://192.168.175.1:11115 / Menü → VPN →IPSecTab Verbindungen



Introduction

A roadwarrior connection connects individual hosts to the local network. This allows, for example, a field service employee to connect to the network of the headquarters.
This step-by-step guide shows how to configure an end-to-site connection. The selected connection type is native IPSec with IKEv1.
For native IPSec connections with IKEv1 the client needs a separate program.

Configuration of a native IPSec connection

New connections can be added in the menu → VPN →IPSecTab Connections with Button Add IPSec Connection

Wizard

Connection Type
Step 1 - Connection Type
Caption Value Description UTMv11.8.8 IPSEC Assitent1-en.png
Wizard step 1
Selection of the connection type The following connections are available:
  • Roadwarrior
  • Site to Site
 For the configuration of an E2S / End-to-Site-connection roadwarrior is to be selected.

General
Step 2 - General
Name: IPSec Roadwarrior Name for the connection UTMv11.8.8 IPSEC S2E ikev1 Assitent2-en.png
Wizard step 2
Connection Type: IKEv1 - Native
Possible connection types:

IKEv1 - L2TP
IKEv1 - XAuth
IKEv1 - Native
IKEv2 - Native

Please note which type is supported by the operating system

Authentication method: PSK Alternatively:
  • X.509 Certificate
  • RSA (Not with IKEv2 !)
Pre-Shared Key: 12345 Any PSK. With the button a very strong key is generated.
X.509 Certificate: Server Certificate Selection of a certificate

Local
Step 3 - Local
Local Gateway ID: eth0 The gateway ID is included in the authentication. This can be an IP address, a host name or an interface. UTMv11.8.8 IPSEC Assitent3-en.png
Wizard step 3
Share networks: 192.168.122.0/24 The local network to be connected via the VPN connection

Remote
Step 4 - Remote
Remote Gateway ID: 192.0.2.192
or
My_Roadwarrior		 If more than one IPSec connection is established, a unique ID should be entered here. The password of incoming connections is validated against the ID of the IPSec connection.
If no IP address is specified as ID, further settings must be made for site-to-site connections.
  		 UTMv11.8.8 IPSEC S2E ikev1 Assitent4-en.png
Wizard step 4
IP Address(es): 192.168.222.35 Additional IP address for the roadwarrior with which the IPSec connection is established.
  • If many Roadwarriors should use the same tunnel, a network address can be configured later in Phase 2 / Subnets.
    For this example, after the wizard has finished, the ip-address just dedicated is edited and for the Remote network the value 192.168.222.0/24 is entered.
    • Exit the setup wizard with Finish

    Set of rules

    To grant access to the internal network, the connection must be allowed.

    Implied rules

    It is possible, but not recommended to do this with implied rules in → Firewall →Implied Rules section VPN and section IPSec Traffic. However, these implied rules enable the ports used for IPSec connections on all interfaces.
    UTM v11.8.8 Implizite-Regeln IPSec-en.png
    Implied rules, VPN section
    UTM v11.8.8 Implizite-Regeln IPSec-Traffic-en.png
    Implied rules, section IPSec Traffic
    Creating a network object

    → Firewall →PortfilterTab Network objects Button Add object

    Name: ngrp-IPSec-Roadwarrior Name for the IPSec network object UTM v11.8.8 Netzwerkobjekt IPSec-native-en.png
    Network object
    Type: VPN network type to be selected
    Address: 192.168.222.0/24 roadwarrior IP address or the roadwarrior pool entered in the Installation Wizard in step 4 (or subsequently adjusted in phase 2).
    In this example the network 192.168.222.0/24.
    Zone: vpn-ipsec zone to be selected
    Group:     Optional: Group
    Port filter rules
    		 UTM v11.8.8 Portfilter-Regel IPSec-ikev1-en.png
    Port filter rule
    Add portfilter rule at → Firewall →PortfilterTab Portfilter Button Add Rule
    The first rule allows the IPSec tunnel to be built at all.
    Source World.svg internet Source from which access to the internal network is to be made.
    Destination Interface.svg external-interface Interface on which the connection is received.
    Service Service-group.svg ipsec Predefined service group for IPSec
    Service / Protocol, Port isakmp / udp 500 nat-traversal / udp 4500 Protocol esp
      

    A second rule allows the roadwarrior to access the desired network, host or network group.
    Source Vpn-network.svg IPSec Roadwarrior Roadwarrior host or network
    Destination Network.svg dmz1-network Network to be accessed.
    Service Service-group.svg xyz Desired service or service group

    Now a connection with a roadwarrior can be established.
    A client may have to be used for this. Care must be taken to ensure that the parameters on both sides are identical in all phases of the connection.

    Necessary changes, when using an NCP client:

    • UTM
      • Diffie-Hellman Group (Phase 1)
      • DH-Group (PFS) (Phase 2)
        oder
    • NCP-Client:
      • IKE-DH-Group
    Addtionally when using IKEv1:
    • NCP-Client:
      • Exchange mode: Main Mode (IKEv1)


    Weitere Einstellungen

    Neben den Einstellungen, die auch schon im Assistenten festgelegt wurden, lassen sich weitere Parameter konfigurieren:





    notempty
    This article refers to a version that is no longer current!

    notempty
    The article for the latest version is here

    notempty
    There is already a newer version of this article, but it refers to a Reseller-Preview







































































    De.png
    En.png
    Fr.png

    Phase 1

    → VPN →IPSecTab Connections Button Phase 1
    General

    Tab General

    Caption Value Description UTM v12.2.3 IPSec v1 Phase1 Allgemein-en.png
    Allow any remote addresses: On
    Default    		 Disable this option for site-to-site connections with DynDNS hosts if multiple IPsec connections with a priori unknown addresses (DynDNS S2S, Roadwarrior) are configured.
    Initiate Connection: Outgoing The tunnel is initiated by the UTM even if no packets are sent.
    Incoming requests are accepted.
    Incoming The UTM accepts incoming tunnel requests.
    No outgoing connection is created.
    Route The tunnel is initiated by the UTM only when packets are to be sent.
    Ignore Deactivates the tunnel
    Dead Peer Detection: On Checks at a set interval whether the tunnel still exists.
    If the tunnel was terminated unexpectedly, the SAs are dismantled.
    (Only then it is also possible to reestablish a new tunnel).
  • When Off deactivated, the option Restart after abort in phase 2 is also automatically deactivated.
    • DPD Timeout:
    Only with IKEv1
    New as of 12.2.3
    		 30Link= seconds Period before the state under Startup behavior is restored.
  • Under IKEv2 this parameter is not available.
    The same values are used here as for regular packets.
    • DPD Interval:
    New as of 12.2.3
    		 10Link= seconds Testing interval
    Compression: Off Compression is not supported by all remote stations
    Tab IKE Settings that must be identical in the UTM and in the client:
    IKE
    Caption Default values UTM Default values NCP client UTM v12.2.3 IPSec IKEv1 Phase1 IKE-en.png
    Encryption: aes128 AES 128 Bit
    Authentication: sha2_256 Hash: SHA2 256 Bit
    Diffie-Hellman Group: modp2048 IKE DH-Grupe: DH2 (modp1024)
    Tab IKE More settings:
    Caption Value Description
    Strict: Off The configured parameters (authentication and encryption algorithms) are preferred for connections
    On No further proposals are accepted. A connection is only possible with the configured parameters.
    IKE Life time: 1 Stunde Validity period of the Security Association: Agreement between two communicating entities in computer networks. It describes how the two parties apply security services to communicate securely with each other. When using multiple services, multiple security connections must also be established. (Source: Wikipedia 2022) in phase 1
    Rekeying: unlimited (recommended) Number of attempts to establish the connection (initial or after abort).
    For E2S connections (Roadwarrior), the setting 3 times can avoid endless attempts to connect to devices that are not correctly logged out.
      

    Phase 2

    → VPN →IPSecTab Connections Button Phase 2
    General

    Tab General : Settings that must be identical in the UTM and in the client:

    Caption Default values UTM Default values NCP client UTM v12.2 IPSec S2S Phase2-en.png
    Encryption: aes128 AES 128 Bit
    Authentication: sha2_256 SHA2 256 Bit
    DH-Gruppe (PFS): modp2048 keine
    Key lifetime: 8 hours Validity period of the key in phase 2
    Exchange mode Main Mode (not configurable) Aggressive Mode (IKEv1)
  • Must be changed to Main Mode in the NCP client!
    The UTM does not support Aggressive Mode for security reasons.

    • Tab General: More settings

    Caption Value Description
    Restart after abort: No If the connection was terminated unexpectedly, activating will restore the state configured under Startup behavior in phase 1.
  • The Dead Peer Detection is automatically activated in phase 1.
    • Group subnet combinations:
    Only with IKEv2     		Yes

  • If grouping is not supported by the remote station, only the first subnet is connected despite the status display in the overview to the contrary.

    		•  If more than one network is configured on the local side or at the remote gateway, a separate SA is negotiated for each subnet combination when it is deactivated.
    This results in numerous subnet combinations and thus many SAs, especially with multiple subnets, and leads to limitations and losses in the stability of the connections due to the design of the IPSec protocol.
    Subnets

    Tab Subnets Only with IKEv2
    Scenario: All subnets have access to each other

  • The wizard automatically connects each local network to each remote network.

    • With an SSH login as root, the behavior can be understood particularly well.
    Example with two subnets each.
    Group subnet combinations Enabled

    root@firewall:~# swanctl --list-conns 

    IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
 local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24


    Group subnet combinations Disabled
    root@firewall:~# swanctl --list-conns 

     IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
   local:  %any
   remote: 192.0.2.192
   local pre-shared key authentication:
     id: 192.168.175.218
   remote pre-shared key authentication:
     id: 192.0.2.192
   IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.193.0/24
   IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.193.0/24

    		UTM v12.2 IPSec S2S Phase2 4Subnetze-en.png
    All subnets have access to each other
    Scenario: Not all subnets may access every network of the remote gateway

    If in phase two a local network is not connected to all remote networks (or a remote network is not connected to all local ones), this will not be taken into account if the option Group subnet combinations is active!

    The Group subnet combinations option will connect all local networks to all remote networks!
    Port filter rules make it possible to control access.

    With an SSH login as root, the behavior can be understood particularly well.
    Example with two subnets each.
    Group subnet combinations Enabled root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24


    Group subnet combinations Disabled
    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.192.0/24
 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.193.0/24
 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.219.0/24
   remote: 192.168.192.0/24

    		UTM v12.2 IPSec S2S Phase2 3Subnetze-en.png
    The second local subnet is connected only to one remote subnet

    Troubleshooting

    Detailed Troubleshooting instructions can be found in the Troubleshooting Guide

    If an email address should be used as gateway ID, it is necessary to insert a double @@ in front of the ID (mail@... becomes @@mail@...). Otherwise the ID will be treated as FQDN


    Retrieved from "https://wiki.securepoint.de/index.php?title=UTM/VPN/IPSec-S2E_v12.2.3&oldid=83683"