Jump to:navigation, search
Wiki

IPSec - End to Site / Roadwarrior

From Securepoint Wiki





notempty
Dieser Artikel bezieht sich auf eine nicht mehr aktuelle Version!

notempty
Der Artikel für die neueste Version steht hier

notempty
Zu diesem Artikel gibt es bereits eine neuere Version, die sich allerdings auf eine Reseller-Preview bezieht

































































































De.png
En.png
Fr.png






Configuration of an End-to-Site-connection with IPSec for Roadwarrior
Last adaption: 12.4
New:
notempty
This article refers to a Resellerpreview

12.2.5 12.2.3 11.8 11.7 11.6.12

Access: UTM-IP:Port or UTM-URL:Port
Port as configured at Network / Appliance Settings / Webserver
Default-Port: 11115
i.e.: https://utm.ttt-point.de:11115
Default: https://192.168.175.1:11115 → VPN →IPSecTab Connections


Introduction

A Roadwarrior connection connects individual hosts to the local network. This allows, for example, a field service employee to connect to the network of the headquarters.
This step-by-step guide shows how to configure an end-to-site connection. The selected connection type is native IPSec with IKEv1.
For native IPSec connections with IKEv1 the client needs a separate program.



Configuration of a native IPSec connection

New connections can be added in the menu → VPN →IPSecTab Connections with Button Add IPSec Connection

Wizard

Connection Type
Step 1 - Connection Type
Caption Value Description UTMv11.8.8 IPSEC Assitent1-en.png
Wizard step 1
Selection of the connection type The following connections are available:
  • Roadwarrior
  • Site to Site
 For the configuration of an E2S / End-to-Site-connection Roadwarrior is to be selected.

General
Step 2 - General
Name: IPSec Roadwarrior Name for the connection UTMv12.2.4 IPSEC S2E ikev2 Assitent2-en.png
Wizard step 2
Connection Type: IKEv1 - Native Possible connection types:
IKEv1 - XAuth
IKEv1 - Native
IKEv2 - Native
IKEv1 - L2TP

notempty
New as of: 12.4

The connection type IKEv1 - L2TP can only be selected if L2TP is set to Autostart or explicitly enabled in the admin interface.
Enable L2TP under: → Extras →Advanced settingsTab Hidden functions Enable L2TP: Ja Activate hidden menu buttons: Ctrl + Alt + A

Please note which type is supported by the operating system
notempty
In setup step 2, two fundamentally different connection types are available for selection. Depending on whether a connection type of IKEv1, or IKEv2 is selected, the upcoming setup steps 3 and 4 differ:

Local – IKEv1
Step 3 - Local - IKEv1
Local Gateway ID:     The gateway ID is included in the authentication. This can be an IP address, a host name or an interface.
Automatically filled in when an X.509 certificate is selected 		UTMv12.2.4 IPSEC IKEv1 Assitent3-en.png
Wizard step 3 - IKEv1
Authentication method: Pre-Shared Key A pre-shared key is in use
Certificate An existing certificate is being used
RSA An existing private RSA key is in use
Pre-Shared Key:     An arbitrary PSK
X.509 Certificate:
Only for authentication method
  • Certificate and
  • EAP-TLS
 Server Certificate Selection of a certificate
Private RSA key: IPSec Key Selecting an RSA key
Share networks:
Only for IKEv1 - Native		 192.168.250.0/24 Enable networks for the IPSec connection

Local – IKEv2
Step 3 - Local - IKEv2
Local Gateway ID:     The gateway ID is included in the authentication. This can be an IP address, a host name or an interface.
Automatically filled in when an X.509 certificate is selected 		UTMv12.2.4 IPSEC Assitent3-en.png
Wizard step 3 - IKEv2
Authentication method: Pre-Shared Key A pre-shared key is in use
Certificate An existing certificate is being used
RSA An existing private RSA key is in use
EAP-TLS Only with IKEv2 EAP-TLS is used. Required for MSCHAPv2.
Pre-Shared Key:     An arbitrary PSK
Creates a very strong key
Copies the PSK to the clipboard
X.509 Certificate:
Only for authentication method
  • Certificate and
  • EAP-TLS
 Server Certificate Selection of a certificate
Private RSA key: IPSec Key Selecting an RSA key
Share networks: 192.168.250.0/24 Enable networks for the IPSec connection

Remote terminal – IKEv1
Step 4 - Remote terminal - IKEv1
Public RSA key:
Only for authentication method RSA		 IPSec Key The required public RSA key of the remote terminal UTMv12.2.4 IPSEC S2E ikev1 Assitent4-en.png
Wizard step 4 - IKEv1
IP address / pool:
Only for IKEv1 - XAuth		 192.168.22.35/24 IP address, or pool for establishing the IPSec connections
Open user dialog after completion:
Only with
  • IKEv1 - L2TP and
  • IKEv1 - XAuth
 Yes Opens the user dialog of the UTM after the wizard is done.
For the establishment of this connection the input of user data is necessary. The user needs the necessary rights.
Remote Gateway ID:
Only for IKEv1 - Native		 192.0.2.192
or
My_Roadwarrior		 If more than one IPSec connection is established, a unique ID should be entered here. The password of incoming connections is validated against the ID of the IPSec connection.
If no IP address is specified as ID, further settings must be made for site-to-site connections.
  
IP Address(es):
Only for IKEv1 - Native		 192.168.222.35 Additional IP address for the Roadwarrior with which the IPSec connection is established.

  • For this example, after the wizard has finished, the ip-address just dedicated is edited and for the Remote network the value 192.168.222.0/24 is entered.

    • Remote terminal – IKEv2
    Step 4 - Remote terminal - IKEv2
    Public RSA key:
    Only for authentication method RSA    		 IPSec Key The required public RSA key of the remote terminal UTMv12.2.4 IPSEC S2E ikev2 Assitent4-en.png
    Wizard step 4 - IKEv2
    IP address / pool: 192.168.22.35/24 IP address, or pool for establishing the IPSec connections
    Authentication method:
    Only for authentication method
    • Certificate or
    • EAP-TLS
         		Certificate An existing certificate is being used
    EAP-MSCHAPV2 EAP-MSCHAPV2 is in use
    EAP-TLS EAP-TLS is used. Required for MSCHAPv2.
    X.509 Certificate:
    Only for authentication method
    • Certificate or
    • EAP-TLS
         		IPSec Cert The certificate for the remote terminal
    Two different certificates must be selected for the local and remote side.
    User groups:
    Only for EAP-MSCHAPv2    		 IPSec User groups Selection of the authorized user group. This must be created beforehand.
    Exit the setup wizard with Finish


    Set of rules

    To grant access to the internal network, the connection must be allowed.

    Implied rules

    notempty
    It is possible but not recommended to do this with implied rules in → Firewall →Implied Rules section VPN and section IPSec Traffic. However, these implied rules enable the ports used for IPSec connections on all interfaces.
    UTM v11.8.8 Implizite-Regeln IPSec-en.png
    Implied rules, VPN section
    UTM v11.8.8 Implizite-Regeln IPSec-Traffic-en.png
    Implied rules, section IPSec Traffic
    Creating a network object

    → Firewall →PortfilterTab Network objects Button Add object

    Caption Value Description UTM v11.8.8 Netzwerkobjekt IPSec-native-en.png
    Network objects
    Name: ngrp-IPSec-Roadwarrior Name for the IPSec network object
    Type VPN network type to be selected
    Address: 192.168.222.0/24 Roadwarrior IP address or the Roadwarrior pool entered in the Installation Wizard in step 4 (or subsequently adjusted in phase 2).
    In this example the network 192.168.222.0/24.
    Zone vpn-ipsec Zone to be selected
    Group:     Optional: Group
    Portfilter rules
    		 UTM v11.8.8 Portfilter-Regel IPSec-ikev1-en.png
    Portfilter rule
    Add portfilter rule at → Firewall →PortfilterTab Portfilter Button Add Rule
    The first rule allows the IPSec tunnel to be built at all.
    Source World.svg internet Source from which access to the internal network is to be made.
    Destination Interface.svg external-interface Interface on which the connection is received.
    Service Service-group.svg ipsec Predefined service group for IPSec
    Service / Protocol, Port isakmp / udp 500 nat-traversal / udp 4500 Protocol esp
      

    A second rule allows the Roadwarrior to access the desired network, host or network group.
    Source Vpn-network.svg IPSec Roadwarrior Roadwarrior host or network
    Destination Network.svg dmz1-network Network to be accessed.
    Service Service-group.svg xyz Desired service or service group

    Now a connection with a Roadwarrior can be established.
    A client may have to be used for this. It must be ensured that the parameters on both sides are identical in all phases of the connection.

    Necessary changes, when using an NCP client:

    • UTM
      • Diffie-Hellman Group (Phase 1)
      • DH-Group (PFS) (Phase 2)
        or
    • NCP- or Greenbow-Client:
      • IKE-DH-Group
    Additionally when using IKEv1:
    • NCP- or Greenbow-Client:
      • Exchange mode: Main Mode (IKEv1)
      • Activate Config_mode


    Additional settings

    In addition to the settings that have already been set in the wizard, further parameters can be configured:


    IKEv1

    Step-by-step.png






























































    {{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS): {{var | keine | keine | none




























    De.png
    En.png
    Fr.png


    Phase 1
    → VPN →IPSecTab Connections Button Phase 1
    General

    Tab General

    Caption Value Description UTMv12.2.4 IPSec RW IKEv1 Phase1-en.png
    Allow any remote addresses: On
    Default    		 Disable this option for site-to-site connections with DynDNS hosts if multiple IPsec connections with a priori unknown addresses (DynDNS S2S, Roadwarrior) are configured.
    Initiate Connection:
    		Outgoing The tunnel is initiated by the UTM even if no packets are sent.
    Incoming requests are accepted.
    Incoming Default if Remote Host is any The UTM accepts incoming tunnel requests.
    No outgoing connection is created.
    Route Default if Remote Host known The tunnel is initiated by the UTM only when packets are to be sent.
    Only set as default value if Any remote station is not selected as Remote Host / Gateway.
    Route Default if Remote Host known The tunnel is initiated by the UTM only when packets are to be sent.
    Only set as default value if Any remote station is not selected as Remote Host / Gateway.
    Ignore Deactivates the tunnel
    Generate traffic:
    New as of v12.4

    For Initiate Connection Route    		 On Prevents unwanted disconnections when no data traffic is taking place
    Dead Peer Detection: On Checks at a set interval whether the tunnel still exists.
    If the tunnel was terminated unexpectedly, the SAs are dismantled.
    (Only then it is also possible to reestablish a new tunnel).
  • When Off deactivated, the option Restart after abort in phase 2 is also automatically deactivated.
    • DPD Timeout: 30Link= seconds Period before the state under Startup behavior is restored.
  • Under IKEv2 this parameter is not available.
    The same values are used here as for regular packets.
    • DPD Interval: 10Link= seconds Testing interval
    Compression: Off Compression is not supported by all remote stations
    Enable MOBIKE:
    New as of 12.2.4
    		 Yes
    Default    		 Used to deactivate the MOBIKE option
    Deactivation prevents encrypted data from a remote station from being additionally encapsulated in 4500udp, which leads to problems in communication.
    Tab IKE Settings that must be identical in the UTM and in the client:
    IKE
    Caption Default-Werte UTM Default-Werte NCP-Client UTM v12.4 IPSec IKEv1 Phase1 IKE-en.png
    Encryption: aes128 AES 128 Bit
    Authentication: sha2_256 Hash: SHA2 256 Bit
    Diffie-Hellman Group: modp2048 IKE DH-Grupe: DH2 (modp1024)
  • We recommend elliptical curves, e.g. ecp521.
    • Tab IKE More settings:
    Caption Value Description
    Strict: Off The configured parameters (authentication and encryption algorithms) are preferred for connections
    On No further proposals are accepted. A connection is only possible with the configured parameters.
    IKE Life time: Out
    Neue Option. Default : Aus

    3Link= hours

    		 Validity period of the Security Association: Agreement between two communicating entities in computer networks. It describes how the two parties apply security services to communicate securely with each other. When using multiple services, multiple security connections must also be established. (Source: Wikipedia 2022) in phase 1
    Can be activated Vorlage:ButtonOn in addition to IKE Rekeytime. Automatically activated when IKE Rekeytime is deactivated.
    IKE Life time: 1 hour Validity period of the Security Association: Agreement between two communicating entities in computer networks. It describes how the two parties apply security services to communicate securely with each other. When using multiple services, multiple security connections must also be established. (Source: Wikipedia 2022) in phase 1
    IKE Rekeytime:
    New as of: v12.4
    		 On 2Link= hours The validity period in which the connection is established (initial or after termination)
    Rekeying: unlimited (recommended) Number of attempts to establish the connection (initial or after abort).
    For E2S connections (Roadwarrior), the setting 3 times can avoid endless attempts to connect to devices that are not correctly logged out.
      

    Phase 2
    → VPN →IPSecTab Connections Button Phase 2
    General

    Tab General : Settings that must be identical in the UTM and in the client:

    Caption Default-Werte UTM Default-Werte NCP-Client UTMv12.2.4 IPSec RW IKEv1 Phase2-en.png
    Encryption: aes128 AES 128 Bit
    Authentication: sha2_256 SHA2 256 Bit
    Diffie-Hellman Group: modp2048 IKE DH-Grupe: DH2 (modp1024)
    As of UTM version 12.2.4, there may currently be difficulties with key exchange in phase 2 for DH groups from modp6144.

  • We recommend elliptical curves, e.g. ecp521.
    • Schlüssel-Lebensdauer: 8 hours Validity period of the key in phase 2
    Austausch-Modus Main Mode (nicht konfigurierbar) Aggressive Mode (IKEv1)
  • Must be changed to Main Mode in the NCP client!
    The UTM does not support Aggressive Mode for security reasons.

    • Tab General: More settings

    Restart on abort: No If the connection was terminated unexpectedly, activating will restore the state configured under Startup behavior in phase 1.
  • The Dead Peer Detection is automatically activated in phase 1.
    • Group subnet combinations: Yes

  • If grouping is not supported by the remote station, only the first subnet is connected despite the status display in the overview to the contrary.

    		•  If more than one network is configured on the local side or at the remote gateway, a separate SA is negotiated for each subnet combination when it is deactivated.
    This results in numerous subnet combinations and thus many SAs, especially with multiple subnets, and leads to limitations and losses in the stability of the connections due to the design of the IPSec protocol.
    DHCP:
    New as of 12.2.4
    		 Out When enabled (On), clients receive IP addresses from a local network.
  • This requires further configurations, see wiki article on DHCP for IPSec.
    • Address-Pool

    Tab Address-Pool
    Caption Value Description UTM v12.2.4 IPSec S2S Phase2 4Adress-Pool-en.png
    Local network: 192.168.250.0/24 The local network to be accessed via the VPN connection (as configured in the wizard in step 3).
    Address-Pool:
    Not with IPSec DHCP    		 192.168.22.35/24 The IP address (e.g.: 192.168.22.35/32), or pool in the form of a subnet (e.g.: 192.168.22.35/26 for the pool of 192.168.22.0 -192.168.22.63) which is used under IPSec.
    Subnets

    Tab Subnets
    Scenario: All subnets have access to each other

  • The wizard automatically connects each local network to each remote network.

    • With an SSH login as root, the behavior can be understood particularly well.
    Example with two subnets each.
    Group subnet combinations Enabled

    root@firewall:~# swanctl --list-conns 

    IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
 local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24


    Group subnet combinations Disabled
    root@firewall:~# swanctl --list-conns 

     IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
   local:  %any
   remote: 192.0.2.192
   local pre-shared key authentication:
     id: 192.168.175.218
   remote pre-shared key authentication:
     id: 192.0.2.192
   IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.193.0/24
   IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.193.0/24

    		UTM v12.2 IPSec S2S Phase2 4Subnetze-en.png
    All subnets have access to each other
    Scenario: Not all subnets may access every network of the remote gateway

    If in phase two a local network is not connected to all remote networks (or a remote network is not connected to all local ones), this will not be taken into account if the option Group subnet combinations is active!

    The Group subnet combinations option will connect all local networks to all remote networks!
    Port filter rules make it possible to control access.

    With an SSH login as root, the behavior can be understood particularly well.
    Example with two subnets each.
    Group subnet combinations Enabled root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24


    Group subnet combinations Disabled
    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.192.0/24
 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.193.0/24
 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.219.0/24
   remote: 192.168.192.0/24

    		UTM v12.2 IPSec S2S Phase2 3Subnetze-en.png
    The second local subnet is connected only to one remote subnet
    Troubleshooting

    Detailed Troubleshooting instructions can be found in the Troubleshooting Guide If an email address should be used as gateway ID, it is necessary to insert a double @@ in front of the ID (mail@... becomes @@mail@...). Otherwise the ID will be treated as FQDN


    IKEv2

    Step-by-step.png






























































    {{var | DH-Gruppe (PFS) | DH-Gruppe (PFS): | DH-Group (PFS): {{var | keine | keine | none




























    De.png
    En.png
    Fr.png


    Phase 1
    → VPN →IPSecTab Connections Button Phase 1
    General

    Tab General

    Caption Value Description UTMv12.2.4 IPSec IKEv2 Phase1 Allgemein-en.png
    Allow any remote addresses: On
    Default    		 Disable this option for site-to-site connections with DynDNS hosts if multiple IPsec connections with a priori unknown addresses (DynDNS S2S, Roadwarrior) are configured.
    Initiate Connection:
    		Outgoing The tunnel is initiated by the UTM even if no packets are sent.
    Incoming requests are accepted.
    Incoming Default if Remote Host is any The UTM accepts incoming tunnel requests.
    No outgoing connection is created.
    Route Default if Remote Host known The tunnel is initiated by the UTM only when packets are to be sent.
    Only set as default value if Any remote station is not selected as Remote Host / Gateway.
    Route Default if Remote Host known The tunnel is initiated by the UTM only when packets are to be sent.
    Only set as default value if Any remote station is not selected as Remote Host / Gateway.
    Ignore Deactivates the tunnel
    Generate traffic:
    New as of v12.4

    For Initiate Connection Route    		 On Prevents unwanted disconnections when no data traffic is taking place
    Dead Peer Detection: On Checks at a set interval whether the tunnel still exists.
    If the tunnel was terminated unexpectedly, the SAs are dismantled.
    (Only then it is also possible to reestablish a new tunnel).
  • When Off deactivated, the option Restart after abort in phase 2 is also automatically deactivated.
    • DPD Timeout: 30Link= seconds Period before the state under Startup behavior is restored.
  • Under IKEv2 this parameter is not available.
    The same values are used here as for regular packets.
    • DPD Interval: 10Link= seconds Testing interval
    Compression: Off Compression is not supported by all remote stations
    Enable MOBIKE:
    New as of 12.2.4
    		 Yes
    Default    		 Used to deactivate the MOBIKE option
    Deactivation prevents encrypted data from a remote station from being additionally encapsulated in 4500udp, which leads to problems in communication.
    Tab IKE Settings that must be identical in the UTM and in the client:
    IKE
    Caption Default-Werte UTM Default-Werte NCP-Client UTM v12.4 IPSec IKEv2 Phase1 IKE-en.png
    Encryption: aes128 AES 128 Bit
    Authentication: sha2_256 Hash: SHA2 256 Bit
    Diffie-Hellman Group: modp2048 IKE DH-Grupe: DH2 (modp1024)
  • We recommend elliptical curves, e.g. ecp521.
    • Tab IKE More settings:
    Caption Value Description
    Strict: Off The configured parameters (authentication and encryption algorithms) are preferred for connections
    On No further proposals are accepted. A connection is only possible with the configured parameters.
    IKE Life time: Out
    Neue Option. Default : Aus

    3Link= hours

    		 Validity period of the Security Association: Agreement between two communicating entities in computer networks. It describes how the two parties apply security services to communicate securely with each other. When using multiple services, multiple security connections must also be established. (Source: Wikipedia 2022) in phase 1
    Can be activated Vorlage:ButtonOn in addition to IKE Rekeytime. Automatically activated when IKE Rekeytime is deactivated.
    IKE Life time: 1 hour Validity period of the Security Association: Agreement between two communicating entities in computer networks. It describes how the two parties apply security services to communicate securely with each other. When using multiple services, multiple security connections must also be established. (Source: Wikipedia 2022) in phase 1
    IKE Rekeytime:
    New as of: v12.4
    		 On 2Link= hours The validity period in which the connection is established (initial or after termination)
    Rekeying: unlimited (recommended) Number of attempts to establish the connection (initial or after abort).
    For E2S connections (Roadwarrior), the setting 3 times can avoid endless attempts to connect to devices that are not correctly logged out.
      

    Phase 2
    → VPN →IPSecTab Connections Button Phase 2
    General

    Tab General : Settings that must be identical in the UTM and in the client:

    Caption Default-Werte UTM Default-Werte NCP-Client UTMv12.2.4 IPSec RW IKEv2 Phase2-en.png
    Encryption: aes128 AES 128 Bit
    Authentication: sha2_256 SHA2 256 Bit
    Diffie-Hellman Group: modp2048 IKE DH-Grupe: DH2 (modp1024)
    As of UTM version 12.2.4, there may currently be difficulties with key exchange in phase 2 for DH groups from modp6144.

  • We recommend elliptical curves, e.g. ecp521.
    • Schlüssel-Lebensdauer: 8 hours Validity period of the key in phase 2
    Austausch-Modus Main Mode (nicht konfigurierbar) Aggressive Mode (IKEv1)
  • Must be changed to Main Mode in the NCP client!
    The UTM does not support Aggressive Mode for security reasons.

    • Tab General: More settings

    Restart on abort: No If the connection was terminated unexpectedly, activating will restore the state configured under Startup behavior in phase 1.
  • The Dead Peer Detection is automatically activated in phase 1.
    • Group subnet combinations: Yes

  • If grouping is not supported by the remote station, only the first subnet is connected despite the status display in the overview to the contrary.

    		•  If more than one network is configured on the local side or at the remote gateway, a separate SA is negotiated for each subnet combination when it is deactivated.
    This results in numerous subnet combinations and thus many SAs, especially with multiple subnets, and leads to limitations and losses in the stability of the connections due to the design of the IPSec protocol.
    DHCP:
    New as of 12.2.4
    		 Out When enabled (On), clients receive IP addresses from a local network.
  • This requires further configurations, see wiki article on DHCP for IPSec.
    • Address-Pool

    Tab Address-Pool
    Caption Value Description UTM v12.2.4 IPSec S2S Phase2 4Adress-Pool-en.png
    Local network: 192.168.250.0/24 The local network to be accessed via the VPN connection (as configured in the wizard in step 3).
    Address-Pool:
    Not with IPSec DHCP    		 192.168.22.35/24 The IP address (e.g.: 192.168.22.35/32), or pool in the form of a subnet (e.g.: 192.168.22.35/26 for the pool of 192.168.22.0 -192.168.22.63) which is used under IPSec.
    Subnets

    Tab Subnets
    Scenario: All subnets have access to each other

  • The wizard automatically connects each local network to each remote network.

    • With an SSH login as root, the behavior can be understood particularly well.
    Example with two subnets each.
    Group subnet combinations Enabled

    root@firewall:~# swanctl --list-conns 

    IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
 local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24


    Group subnet combinations Disabled
    root@firewall:~# swanctl --list-conns 

     IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s
   local:  %any
   remote: 192.0.2.192
   local pre-shared key authentication:
     id: 192.168.175.218
   remote pre-shared key authentication:
     id: 192.0.2.192
   IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.218.0/24
     remote: 192.168.193.0/24
   IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.192.0/24
   IPSec$20S2S_7: TUNNEL, rekeying every 28260s, dpd action is restart
     local:  192.168.219.0/24
     remote: 192.168.193.0/24

    		UTM v12.2 IPSec S2S Phase2 4Subnetze-en.png
    All subnets have access to each other
    Scenario: Not all subnets may access every network of the remote gateway

    If in phase two a local network is not connected to all remote networks (or a remote network is not connected to all local ones), this will not be taken into account if the option Group subnet combinations is active!

    The Group subnet combinations option will connect all local networks to all remote networks!
    Port filter rules make it possible to control access.

    With an SSH login as root, the behavior can be understood particularly well.
    Example with two subnets each.
    Group subnet combinations Enabled root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24 192.168.219.0/24
   remote: 192.168.192.0/24 192.168.193.0/24


    Group subnet combinations Disabled
    root@firewall:~# swanctl --list-conns IPSec$20S2S: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 10s 

     local:  %any
 remote: 192.0.2.192
 local pre-shared key authentication:
   id: 192.168.175.218
 remote pre-shared key authentication:
   id: 192.0.2.192
 IPSec$20S2S_4: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.192.0/24
 IPSec$20S2S_5: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.218.0/24
   remote: 192.168.193.0/24
 IPSec$20S2S_6: TUNNEL, rekeying every 28260s, dpd action is restart
   local:  192.168.219.0/24
   remote: 192.168.192.0/24

    		UTM v12.2 IPSec S2S Phase2 3Subnetze-en.png
    The second local subnet is connected only to one remote subnet
    Troubleshooting

    Detailed Troubleshooting instructions can be found in the Troubleshooting Guide If an email address should be used as gateway ID, it is necessary to insert a double @@ in front of the ID (mail@... becomes @@mail@...). Otherwise the ID will be treated as FQDN

    Retrieved from "https://wiki.securepoint.de/index.php?title=UTM/VPN/IPSec-S2E_v12.4&oldid=90850"