VPN(Virtual Private Networking) - Revision history

Igor: /* VPN Setups */

2019-05-31T10:06:28Z

VPN Setups

← Older revision		Revision as of 10:06, 31 May 2019
Line 3:		Line 3:
	=== VPN Setups ===		=== VPN Setups ===
	We have two typical configuration possibilities: site to site and remote access. Site to site is more suited when persistent connectivity is needed. For instance from RTU to Network Control Center(NCC). Remote access is provided for cases when non persistent access is needed or when persistent tunnel is not needed. For example remote management(configuration changes or etc) from different locations with dynamic IP address. Figure 1 illustrates this general concept.		We have two typical configuration possibilities: site to site and remote access. Site to site is more suited when persistent connectivity is needed. For instance from RTU to Network Control Center(NCC). Remote access is provided for cases when non persistent access is needed or when persistent tunnel is not needed. For example remote management(configuration changes or etc) from different locations with dynamic IP address. Figure 1 illustrates this general concept.
	[[~~Pilt~~:vpn.png\|629px\|thumb\|center\|Figure 1: General Model for VPN Deploiments]]		[[File:vpn.png\|629px\|thumb\|center\|Figure 1: General Model for VPN Deploiments]]

	=== Site to Site With OpenVPN ===		=== Site to Site With OpenVPN ===

Igor: /* Site to Site With OpenVPN */

2019-05-31T10:06:17Z

Site to Site With OpenVPN

← Older revision		Revision as of 10:06, 31 May 2019
Line 8:		Line 8:

	In order to configure site to site VPN with OpenVPN open Common → OpenVPN. From opened dialog box click on Add. “Server address” and “Server port” are the WAN address and UDP port of the server. That means that we support OpenVPN's mode tls-client over UDP. Click on buttons “CA cert”, “Cert” and “Key” in order to select certificates for client. By default routes are pulled from server. This is needed in order the device knows what to send to VPN tunnels and what IP address to use for tunnel interface. “Fragment” 0 means that default setting for OpenVPN is used.		In order to configure site to site VPN with OpenVPN open Common → OpenVPN. From opened dialog box click on Add. “Server address” and “Server port” are the WAN address and UDP port of the server. That means that we support OpenVPN's mode tls-client over UDP. Click on buttons “CA cert”, “Cert” and “Key” in order to select certificates for client. By default routes are pulled from server. This is needed in order the device knows what to send to VPN tunnels and what IP address to use for tunnel interface. “Fragment” 0 means that default setting for OpenVPN is used.
	[[~~Pilt~~:OpenVPN-Default.png\|342px\|thumb\|center\|Figure 2: Default OpenVPN Client Configuration Dialog]]		[[File:OpenVPN-Default.png\|342px\|thumb\|center\|Figure 2: Default OpenVPN Client Configuration Dialog]]
	Figure 2 shows default configuration dialog box. Note that pink fields are mandatory and that default “Server address”, “Local IP” and “Remote IP ” are probably not suitable for your needs. Figure 3 shows production configuration where WAN IP and port and certificates are selected and configured.		Figure 2 shows default configuration dialog box. Note that pink fields are mandatory and that default “Server address”, “Local IP” and “Remote IP ” are probably not suitable for your needs. Figure 3 shows production configuration where WAN IP and port and certificates are selected and configured.
	[[~~Pilt~~:OpenVPN-NonDefault.png\|342px\|thumb\|center\|Figure 3: Configuration for interface tun0]]		[[File:OpenVPN-NonDefault.png\|342px\|thumb\|center\|Figure 3: Configuration for interface tun0]]

	More info OpenVPN can be found here [http://openvpn.net/index.php/open-source/documentation/howto.html]		More info OpenVPN can be found here [http://openvpn.net/index.php/open-source/documentation/howto.html]

Igor: /* Site to Site With IPsec */

2019-05-31T10:06:02Z

Site to Site With IPsec

← Older revision		Revision as of 10:06, 31 May 2019
Line 23:		Line 23:
	</pre>		</pre>

	[[~~Pilt~~:IPSec-Default.png\|395px\|thumb\|center\|Figure 4: Default IPsec Tunnel Configuration Dialog]]		[[File:IPSec-Default.png\|395px\|thumb\|center\|Figure 4: Default IPsec Tunnel Configuration Dialog]]
	[[~~Pilt~~:IPSec-NonDefault.png\|420px\|thumb\|center\|Figure 5: IPSec Minimum Configuration]]		[[File:IPSec-NonDefault.png\|420px\|thumb\|center\|Figure 5: IPSec Minimum Configuration]]

	In order to view if tunnel is up issue “setkey -D” or use racoonctl. For instance "racoonctl -l show-sa isakmp" for phase 1 and "racoonctl -l show-sa ipsec" for phase 2. Here is an example output form “setkey -D”, which shows an open tunnel between 10.0.0.111(Telem-GWM) and 10.0.0.86:		In order to view if tunnel is up issue “setkey -D” or use racoonctl. For instance "racoonctl -l show-sa isakmp" for phase 1 and "racoonctl -l show-sa ipsec" for phase 2. Here is an example output form “setkey -D”, which shows an open tunnel between 10.0.0.111(Telem-GWM) and 10.0.0.86:

Igor: /* Remote Access with L2TP/IPSec */

2019-05-31T10:05:47Z

Remote Access with L2TP/IPSec

← Older revision		Revision as of 10:05, 31 May 2019
Line 127:		Line 127:
	=== Remote Access with L2TP/IPSec ===		=== Remote Access with L2TP/IPSec ===
	In order to configure L2TP/IPSec open Common → L2TP, check “LNS Enable” check box and turn on IPSec protection for L2TP by checking the IPSec check box.		In order to configure L2TP/IPSec open Common → L2TP, check “LNS Enable” check box and turn on IPSec protection for L2TP by checking the IPSec check box.
	[[~~Pilt~~:L2TP-IPSec-Default.png\|497px\|thumb\|center\|Figure 6: L2TP/IPSec Default Settings]]		[[File:L2TP-IPSec-Default.png\|497px\|thumb\|center\|Figure 6: L2TP/IPSec Default Settings]]
	[[~~Pilt~~:L2TP-IPSec-NonDefault.png\|494px\|thumb\|center\|Figure 7: Minimal L2TP/IPSec Settings]]		[[File:L2TP-IPSec-NonDefault.png\|494px\|thumb\|center\|Figure 7: Minimal L2TP/IPSec Settings]]
	Figure 6 shows default settings and figure 7 minimal settings. Note the IP column and selection under Users. This is needed in order to limit access with firewall. If IP is not selected then device assigns an IP from pool that starts with “Remote Start IP” and ends with “Remote Stop IP”. As this assignment is dynamic it is not possible to configure firewall by username. This means that users without assigned IP cannot access the TELEM-GWM but can probably access other resources on the local LAN. Needless to say that systems on production networks should not have an account with “Password” pass and “IPSec pre-shared key” pass.		Figure 6 shows default settings and figure 7 minimal settings. Note the IP column and selection under Users. This is needed in order to limit access with firewall. If IP is not selected then device assigns an IP from pool that starts with “Remote Start IP” and ends with “Remote Stop IP”. As this assignment is dynamic it is not possible to configure firewall by username. This means that users without assigned IP cannot access the TELEM-GWM but can probably access other resources on the local LAN. Needless to say that systems on production networks should not have an account with “Password” pass and “IPSec pre-shared key” pass.

Igor: /* Set up Remote Access with L2TP/IPSec in Windows. */

2019-05-31T10:05:23Z

Set up Remote Access with L2TP/IPSec in Windows.

MarkTomm: /* Site to Site With IPsec */

2017-09-12T08:53:13Z

Site to Site With IPsec

← Older revision		Revision as of 08:53, 12 September 2017
Line 16:		Line 16:
	=== Site to Site With IPsec ===		=== Site to Site With IPsec ===
	In order to configure site to site VPN with IPSec open Common → IPSec and click on Add. From drop down menus select Encryption, Authentication and other parameters for phase 1 and 2 to suit your needs. Parameter Local select which local networks to tunnel over IPSec. “Remote networks” selects “Remote Peers” local networks to tunnel over IPSec. Figure 4 shows default configuration dialog for IPsec and figure 5 setup used in testing.		In order to configure site to site VPN with IPSec open Common → IPSec and click on Add. From drop down menus select Encryption, Authentication and other parameters for phase 1 and 2 to suit your needs. Parameter Local select which local networks to tunnel over IPSec. “Remote networks” selects “Remote Peers” local networks to tunnel over IPSec. Figure 4 shows default configuration dialog for IPsec and figure 5 setup used in testing.

			NB! Remote network & subnet has to match the real remote configuration (LAN network?), otherwise PHASE 2 fails. If you see the following error messages, then this may be the case.
			<pre>
			ERROR: failed to pre-process ph2 packet (side: 1, status: 1)
			ERROR: failed to get sainfo.
			</pre>

	[[Pilt:IPSec-Default.png\|395px\|thumb\|center\|Figure 4: Default IPsec Tunnel Configuration Dialog]]		[[Pilt:IPSec-Default.png\|395px\|thumb\|center\|Figure 4: Default IPsec Tunnel Configuration Dialog]]
	[[Pilt:IPSec-NonDefault.png\|420px\|thumb\|center\|Figure 5: IPSec Minimum Configuration]]		[[Pilt:IPSec-NonDefault.png\|420px\|thumb\|center\|Figure 5: IPSec Minimum Configuration]]

Roland: /* Known Working Client or Server Software */

2013-09-04T05:58:05Z

Known Working Client or Server Software

← Older revision		Revision as of 05:58, 4 September 2013
Line 167:		Line 167:
	IPsec:		IPsec:
	* Ubuntu 12.04 LTS with ipsec-tools, with direct configuration not using any of the GUI software. Hint: use gws.exe to get racoon and setkey configurations.		* Ubuntu 12.04 LTS with ipsec-tools, with direct configuration not using any of the GUI software. Hint: use gws.exe to get racoon and setkey configurations.
	* ~~fSense~~ 2.0.3-RELEASE [http://www.pfsense.org/]		* pfSense 2.0.3-RELEASE [http://www.pfsense.org/]
	* Cisco SR520-FE with IOS 12.4(20)T6. A good reference for racoon with third party software can be found here: [http://www.admin-magazine.com/Articles/Cross-Vendor-IPsec]		* Cisco SR520-FE with IOS 12.4(20)T6. A good reference for racoon with third party software can be found here: [http://www.admin-magazine.com/Articles/Cross-Vendor-IPsec]

Roland: /* Known Working Client or Server Software */

2013-09-04T05:57:32Z

Known Working Client or Server Software

← Older revision		Revision as of 05:57, 4 September 2013
Line 178:		Line 178:
	* Android 4.1.2 on Nexus 7(Asus tablet), Android 4.0.3 on HTC phone		* Android 4.1.2 on Nexus 7(Asus tablet), Android 4.0.3 on HTC phone
	* Ubuntu 12.04 LTS with ipsec-tools and xl2tpd with direct configuration not using any of the GUI software. Hint: use gws.exe to get racoon, setkey and xl2tpd configurations.		* Ubuntu 12.04 LTS with ipsec-tools and xl2tpd with direct configuration not using any of the GUI software. Hint: use gws.exe to get racoon, setkey and xl2tpd configurations.
	* Cisco SR520-FE with IOS 12.4(20)T6

	=== Caveats ===		=== Caveats ===

Roland at 08:11, 6 June 2013

2013-06-06T08:11:15Z

← Older revision		Revision as of 08:11, 6 June 2013
Line 11:		Line 11:
	Figure 2 shows default configuration dialog box. Note that pink fields are mandatory and that default “Server address”, “Local IP” and “Remote IP ” are probably not suitable for your needs. Figure 3 shows production configuration where WAN IP and port and certificates are selected and configured.		Figure 2 shows default configuration dialog box. Note that pink fields are mandatory and that default “Server address”, “Local IP” and “Remote IP ” are probably not suitable for your needs. Figure 3 shows production configuration where WAN IP and port and certificates are selected and configured.
	[[Pilt:OpenVPN-NonDefault.png\|342px\|thumb\|center\|Figure 3: Configuration for interface tun0]]		[[Pilt:OpenVPN-NonDefault.png\|342px\|thumb\|center\|Figure 3: Configuration for interface tun0]]

			More info OpenVPN can be found here [http://openvpn.net/index.php/open-source/documentation/howto.html]

	=== Site to Site With IPsec ===		=== Site to Site With IPsec ===
Line 113:		Line 115:
	Apr 25 11:22:58 telem-gwm daemon.info racoon: INFO: IPsec-SA established: ESP/Tunnel 10.0.0.111[500]->10.0.0.86[500] spi=20748511(0x13c98df)		Apr 25 11:22:58 telem-gwm daemon.info racoon: INFO: IPsec-SA established: ESP/Tunnel 10.0.0.111[500]->10.0.0.86[500] spi=20748511(0x13c98df)
	</pre>		</pre>

			More info about racoon, racoonctl and setkey can be found here [http://ipsec-tools.sourceforge.net/]

	=== Remote Access with L2TP/IPSec ===		=== Remote Access with L2TP/IPSec ===
Line 164:		Line 168:
	* Ubuntu 12.04 LTS with ipsec-tools, with direct configuration not using any of the GUI software. Hint: use gws.exe to get racoon and setkey configurations.		* Ubuntu 12.04 LTS with ipsec-tools, with direct configuration not using any of the GUI software. Hint: use gws.exe to get racoon and setkey configurations.
	* fSense 2.0.3-RELEASE [http://www.pfsense.org/]		* fSense 2.0.3-RELEASE [http://www.pfsense.org/]
	* Cisco SR520-FE with IOS 12.4(20)T6		* Cisco SR520-FE with IOS 12.4(20)T6. A good reference for racoon with third party software can be found here: [http://www.admin-magazine.com/Articles/Cross-Vendor-IPsec]



	<br />		<br />
	L2TP/IPSec:		L2TP/IPSec:

Roland at 07:46, 6 June 2013

2013-06-06T07:46:59Z

← Older revision		Revision as of 07:46, 6 June 2013
Line 17:		Line 17:
	[[Pilt:IPSec-NonDefault.png\|420px\|thumb\|center\|Figure 5: IPSec Minimum Configuration]]		[[Pilt:IPSec-NonDefault.png\|420px\|thumb\|center\|Figure 5: IPSec Minimum Configuration]]

	In order to view if tunnel is up issue “setkey -D”. Here is an example output, which shows an open tunnel between 10.0.0.111(Telem-GWM) and 10.0.0.86:		In order to view if tunnel is up issue “setkey -D” or use racoonctl. For instance "racoonctl -l show-sa isakmp" for phase 1 and "racoonctl -l show-sa ipsec" for phase 2. Here is an example output form “setkey -D”, which shows an open tunnel between 10.0.0.111(Telem-GWM) and 10.0.0.86:
	<pre>		<pre>
	root@telem-gwm /home/martem $ setkey -D		root@telem-gwm /home/martem $ setkey -D

← Older revision		Revision as of 10:05, 31 May 2019
Line 135:		Line 135:
	Got to "Control Panel" -> "Network and Internet" -> "Network and Sharing Center" and open "Set up a new connection or network" under "Change your networking settings"		Got to "Control Panel" -> "Network and Internet" -> "Network and Sharing Center" and open "Set up a new connection or network" under "Change your networking settings"

	[[~~Pilt~~:Nasc.jpg\|629px\|thumb\|center\|]]		[[File:Nasc.jpg\|629px\|thumb\|center\|]]

	In the "Set Up a Connection or Netwrok" window choose "Connect to a workplace" -> "Use my Interent connection (VPN)"		In the "Set Up a Connection or Netwrok" window choose "Connect to a workplace" -> "Use my Interent connection (VPN)"
Line 147:		Line 147:
	Go back to "Network and Sharing Center" and open "Change Adapter Settings"		Go back to "Network and Sharing Center" and open "Change Adapter Settings"

	[[~~Pilt~~:Nasc_adapter.jpg\|629px\|thumb\|center\|]]		[[File:Nasc_adapter.jpg\|629px\|thumb\|center\|]]

	Click on VPN connection with the right mouse button and choose "Properties" in the drop-down menu		Click on VPN connection with the right mouse button and choose "Properties" in the drop-down menu

	[[~~Pilt~~:Nasc_adapter_VPN.jpg\|629px\|thumb\|center\|]]		[[File:Nasc_adapter_VPN.jpg\|629px\|thumb\|center\|]]

	In the upcoming menu open the "Security" tab and set the "Type of VPN:" to "Layer 2 Tunneling Protocol with IPsec(L2TP/IPSec)"		In the upcoming menu open the "Security" tab and set the "Type of VPN:" to "Layer 2 Tunneling Protocol with IPsec(L2TP/IPSec)"

	[[~~Pilt~~:VPN_sectab.jpg\|300px\|thumb\|center\|]]		[[File:VPN_sectab.jpg\|300px\|thumb\|center\|]]

	Open "Advanced settings" in the same tab. Pick "Use preshared key for authentication" and enter the IPSec pre-shared key in the "Key:" field		Open "Advanced settings" in the same tab. Pick "Use preshared key for authentication" and enter the IPSec pre-shared key in the "Key:" field

	[[~~Pilt~~:WIN_VPN_secadv.jpg\|300px\|thumb\|center\|]]		[[File:WIN_VPN_secadv.jpg\|300px\|thumb\|center\|]]

	Click "OK" to save changes and close "Advanced Settings" window. Click "OK" to close the current "VPN Conection Properties" window.		Click "OK" to save changes and close "Advanced Settings" window. Click "OK" to close the current "VPN Conection Properties" window.
	Now the newly created VPN point should be visible in "Network Connections" window		Now the newly created VPN point should be visible in "Network Connections" window

	[[~~Pilt~~:Network_connections.jpg\|thumb\|center\|]]		[[File:Network_connections.jpg\|thumb\|center\|]]

	=== Known Working Client or Server Software ===		=== Known Working Client or Server Software ===