AlliedWareTM OS How To | Create a VPN between an Allied Telesis Router and a Microsoft Windows 20001 Client, Without Using NAT-T Introduction This document describes how to provide secure remote access through IP security (IPSec) Virtual Private Networks (VPN). This VPN solution is suitable for any business deployment and provides your office with secure internet access and firewall protection, plus remote encrypted VPN access for staff who work from home.
Which products and releases does it apply to? > This document describes how to configure the Windows system to use IPSec VPN to connect to your office through the AR415S router. When your staff want to connect to the office they simply use the VPN icon on their desktop to initiate the IPSec VPN connection.
Security issue > Security issue Since this Windows VPN solution is usually used to allow remote access into corporate networks, a common security concern is “what happens if the remote laptop or PC is stolen or falls into unauthorised hands?” This is particularly a concern because the VPN connection is enabled through the standard dial-up networking window that allows username and passwords to be saved.
Configuring the router > Perform initial security configuration on the router Configuring the router This section contains a script file for running IPSec encapsulating L2TP on a Head Office AR400 series router, configured to support IPSec remote PC clients. Using this script involves the following steps: 1. "Perform initial security configuration on the router", on this page. 2. Make a copy the script, which starts on page 5. Name it (for example) vpn.cfg. 3.
Configuring the router > The configuration script The configuration script Note: Comments are indicated in the script below using the # symbol. Placeholders for IP addresses, passwords, etc are indicated by text within < > set system name=”IPSec Gateway” # The command below shows the Security Officer inactive timeout delay. # The default is 60 seconds. During setup you can instead use 600 # seconds if desired. set user securedelay=600 # The incoming L2TP calls will be CHAP authenticated.
Configuring the router > The configuration script # Firewall enable fire create fire poli=main create fire poli=main dy=dynamic add fire poli=main dy=dynamic user=ANY add fire poli=main int=vlan1 type=private # Dynamic private interfaces are accepted from L2TP, which are from # IPSec only. add fire poli=main int=dyn-dynamic type=private add fire poli=main int=eth0 type=public # The firewall allows for internally generated access to the Internet # through the following NAT definition.
Configuring the router > Set the router to use the configuration Set the router to use the configuration After loading the configuration onto the switch, set the router to use the script after a reboot. If you named the script vpn.cfg, enter the command: set conf=vpn.cfg If you entered the configuration directly into the command line instead of loading the script, save the configuration by entering the commands: create conf=vpn.cfg set conf=vpn.
Configuring the VPN client > Add a new registry entry Configuring the VPN client Configuring the Windows 2000 VPN client involves the following stages: z "Add a new registry entry", on this page z "Add the IP Security Policy Management snap-in" on page 9 z "Create an IP Security Policy" on page 11 z "Create an IP Security Rule" on page 13 z "Create an IP Filter" on page 16 z "Configure the connection" on page 23 Add a new registry entry To ensure compatibility, you need to make a change to the
Configuring the VPN client > Add the IP Security Policy Management snap-in Add the IP Security Policy Management snap-in Note: You need to know the public IP address for the router from your Internet Service Provider (ISP) for this configuration. This example assumes that you have already set up your internet connection. 1. On your desktop, select Start > Run and enter the following command: mmc This opens the Console window, as shown in the following figure. 2.
Configuring the VPN client > Add the IP Security Policy Management snap-in 3. Click Add. This opens the Add Standalone Snap-In window. Scroll down the list of Available Standalone Snap-ins and select IP Security Policy Management, as shown in the following figure. 4. Click Add. This opens the Select Computer window, which lets you select the computer or domain that the snap-in will manage. Select Local computer, as shown in the following figure. 5.
Configuring the VPN client > Create an IP Security Policy Create an IP Security Policy 1. On the Console window, click, then right-click IP Security Policies on Local Machine. 2. Select Create IP Security Policy. This opens the IP Security Policy Wizard, as shown in the following figure.
Configuring the VPN client > Create an IP Security Policy 3. Click Next, then enter a name for your security policy (e.g. “To Head Office”), as shown in the following figure. 4. Click Next. This opens the Requests for Secure Communication window. Clear the Activate the default response rule checkbox, as shown in the following figure.
Configuring the VPN client > Create an IP Security Rule 5. Click Next. You have now completed the IP Security Policy Wizard, as shown in the following figure. 6. Leave the Edit properties checkbox checked. Click Finish. Create an IP Security Rule 1. Clicking Finish in the previous step opens the IP Security Policy Properties window, as shown in the following figure.
Configuring the VPN client > Create an IP Security Rule 2. Click Add. This opens the Security Rule Wizard, as shown in the following figure. 3. Click Next. The next window lets you specify the tunnel endpoint for the IP Security rule, if required. A tunnel endpoint is not required for this example. Therefore, make sure This rule does not specify a tunnel is selected, as shown in the following figure.
Configuring the VPN client > Create an IP Security Rule 4. Click Next. The next window lets you specify the network type the IP Security rule applies to. Make sure the All network connections option is selected, as shown in the following figure. 5. Click Next. The next window lets you specify the authentication method for the IP Security rule. Select the Use this string to protect the key exchange (preshared key) option, as shown in the following figure.
Configuring the VPN client > Create an IP Filter Create an IP Filter 1. Click Next. The next window, shown in the following figure, lets you specify the IP filter for the type of IP traffic the IP Security rule applies to. 2. Click Add to start creating a new filter. This opens the IP Filter List Name window. Enter a name (e.g. “L2TP Tunnel Filter”), as shown in the following figure.
Configuring the VPN client > Create an IP Filter 3. Click Add. This starts the IP Filter Wizard, as shown in the following figure. 4. Click Next. This opens the IP Traffic Source window. Select My IP Address from the Source address dropdown box, as shown in the following figure.
Configuring the VPN client > Create an IP Filter 5. Click Next. This opens the IP Traffic Destination window. Select A specific IP Address from the Destination address drop-down box, as shown in the following figure. Enter the destination IP address of your Allied Telesyn router. This must be a valid Internet address. 6. Click Next. This opens the IP Protocol Type window. Select UDP from the drop-down box, as shown in the following figure.
Configuring the VPN client > Create an IP Filter 7. Click Next. This opens the IP Protocol Port window. Select From this port and enter 1701, as shown in the following figure. 8. Click Next. This completes the IP Filter wizard. Leave the Edit properties box unchecked, as shown in the following figure.
Configuring the VPN client > Create an IP Filter 9. Click Finish, then on the IP Filter List window, click Close. This returns you to the Security Rule Wizard IP Filter List window. The filter list now includes your new L2TP Tunnel Filter filter, as shown in the following figure. 10. Select L2TP Tunnel Filter and click Next. This opens the Filter Action window. Select Require Security, as shown in the following figure. This option forces the VPN client to use strong security.
Configuring the VPN client > Create an IP Filter 11. Click Next. This completes the Rule wizard. Leave the Edit properties box unchecked, as shown in the following figure. 12. Click Finish, then on the To Head Office Properties window, click Close. This returns you to the Console Root window, as shown in the following figure. Click IP Security Policies on Local Machine.
Configuring the VPN client > Create an IP Filter 13. Click and then right-click on To Head Office, and select Assign. The policy is now assigned or enabled on your PC host, indicated by Yes in the Policy Assigned column, as shown in the following figure. 14. Select Exit from the Console menu, to close and save the console window to your local hard drive. This uses the default name of Console1, as shown in the following figure.
Configuring the VPN client > Configure the connection Configure the connection 1. On your desktop, click Start > Settings > Control Panel. 2. Double-click the Network and Dial-Up Connection folder. This opens the window shown in the following figure. Double-click the Make New Connection icon. 3. This opens the New Connection Wizard. Click Next. 4. Select Connect to a private network through the internet, as shown in the following figure.
Configuring the VPN client > Configure the connection 5. Click Next. The next window lets you assign an associated dialled call or select Do not dial the initial connection. Selecting Do not dial the initial connection is appropriate if you will have LAN access available before initiating the VPN call (for example, if you have a cable modem). 6. Click Next. Enter the name or IP address of the office router. This will be its Public Internet address, which the ISP will have allocated you.
Configuring the VPN client > Configure the connection 7. Click Next. This opens the Connection Availability window. Select Only for myself, as shown in the following figure. 8. Click Next. Enter the name for your connection (e.g. Virtual Private Connection to Head Office), as shown in the following figure. If you want to, check the Add a shortcut to this connection to my desktop check box.
Configuring the VPN client > Configure the connection 9. Click Finish. This opens the Connection Window. Enter your user name and password as shown in the following figure. These are the user name and password that are (or will be) configured on the router’s user database or RADIUS server. 10. Click Properties. This opens the Virtual Private Connection to Head Office window. Click the Networking Tab. Select Layer-2 Tunneling Protocol (L2TP) in the drop-down box, as shown in the following figure.
Configuring the VPN client > Configure the connection 11. Click OK. This completes the configuration of the L2TP client. To connect to the office, click Connect. Note that the connection will fail if the router has not yet been configured. If the connection succeeds, the following dialog box displays. Click OK.
Testing the tunnel > Checking the connection from the Windows client Testing the tunnel The simplest way to tell if traffic is passing through the tunnel is to perform a traceroute from the Windows 2000 client to a PC in the router’s LAN. To do this, use the following command at the command prompt on the Windows 2000 client: tracert If traffic goes through the tunnel, the traceroute may display IP addresses from one or both peers’ private networks and public interfaces.
Closing the connection To close your connection, right-click on your connection icon (e.g. Virtual Private Connection to Head Office) and click Disconnect. The following figure shows this. . USA Headquarters | 19800 North Creek Parkway | Suite 200 | Bothell | WA 98011 | USA | T: +1 800 424 4284 | F: +1 425 481 3895 European Headquarters | Via Motta 24 | 6830 Chiasso | Switzerland | T: +41 91 69769.00 | F: +41 91 69769.
