IPSEC SITE2SITE CONNECTION TO A FRITZ!BOX

Transcription

1 IPSEC SITE2SITE CONNECTION TO A FRITZ!BOX

2 Table of Contents 1 Prerequisites Network Overview Hardware Used Activating the Extended View in the FRITZ!Box Editing the Network Settings on the FRITZ!Box Creating the VPN Configuration for the FRITZ!Box Creating the VPN Configuration for the FRITZ!Box with a Web Interface Creating the VPN Configuration for the FRITZ!Box Putting up the VPN IPsec Settings Troubleshooting Disclaimer Page: 1 1 / 12

3 1 Prerequisites The gateprotect firewalls since version 8.6 are able to establish an IPsec connection to a FRITZ!Box. On the end of the FRITZ!Box, please check whether the hardware you use supports VPN functions in principle. If this is the case, but no options are displayed in the web interface, there is most probably a firmware upgrade necessary. To verify this, please visit the homepage of AVM ( Furthermore, the gateprotect firewall must have a static WAN IP address. If this is not the case, the FRITZ!Box will automatically use the Aggressive Mode that is not supported by gateprotect. In addition, please make sure that, in case of a dynamic IP address, your FRITZ!Box has a DynDNS URL. 1.1 Network Overview In our example, the gateprotect Firewall has a fixed WAN IP address. The FRITZ!Box may have a fixed or a dynamic address with a DynDNS host name. The connection is established from the firewall towards the FRITZ!Box. 1.2 Hardware Used This guide has been created using a FRITZ!Box 7390 with FRITZ!OS 6.20 and a gateprotect firewall 9.5. For other devices, the menus may differ from the screenshots. However, in principle it should be possible to create a VPN tunnel between a gateprotect firewall and a FRITZ!Box. Note: FRITZ!Box is a brand of AVM GmbH, Berlin, Germany. Page: 2 2 / 12

4 1.3 Activating the Extended View in the FRITZ!Box Please switch your view to Extended. You can find this option in the footer of the administration interface. Page: 3 3 / 12

5 1.4 Editing the Network Settings on the FRITZ!Box It is recommended to change the sub-network /24, which is used by the FRITZ!Box, in order to avoid conflicts. For this purpose, select the menu item Home Network -> Network -> Network Settings in the web interface. Click on the item IPv4 Addresses and edit the value in the field IP Address. Possible addresses may be, for example, within the range from /24 to /24 or all private sub-networks. However, please make sure that the network you choose is not used on the remote station. Page: 4 4 / 12

6 2 Creating the VPN Configuration for the FRITZ!Box To be able to establish a VPN site-to-site connection with your gateprotect firewall, you have to create a tunnel on the FRITZ!Box. 2.1 Creating the VPN Configuration for the FRITZ!Box with a Web Interface The current firmware of the FRITZ!Box supports the creation of a VPN connection in the administration interface. Click on Internet -> Enable and then on the VPN tab. Via the Add VPN Connection button, you can configure a new VPN connection. Select Connect your home network to another FRITZ!Box network (LAN-LAN coupling). Now continue with chapter 2.3. If you cannot find this option in your FRITZ!Box, you need to conduct the configuration manually and load it into the FRITZ!Box. See the next chapter to find out how to do this. Page: 5 5 / 12

7 2.2 Creating the VPN Configuration for the FRITZ!Box Older versions of the FRITZ!Box do not offer any menu item for the configuration of the VPN connections over the web interface. Therefore you need to create your own configuration file. Create a file with the extension.cfg and copy the following sample configuration into this file: vpncfg { connections { enabled = yes; conn_type = conntype_lan; name = "VPN NAME"; always_renew = no; reject_not_encrypted = no; dont_filter_netbios = yes; localip = ; local_virtualip = ; remoteip = ; remote_virtualip = ; localid { fqdn = "gateprotect.no-ip.org"; //ipaddr = ; remoteid { ipaddr = ; mode = phase1_mode_idp; phase1ss = "alt/3des/sha"; keytype = connkeytype_pre_shared; key = " "; cert_do_server_auth = no; use_nat_t = yes; use_xauth = no; use_cfgmode = no; phase2localid { ipnet { ipaddr = ; mask = ; phase2remoteid { ipnet { ipaddr = ; mask = ; phase2ss = "esp-3des-sha/ah-no/comp-no/pfs"; accesslist = "permit ip any "; ike_forward_rules = "udp : :500", "udp : :4500"; Page: 6 6 / 12

8 Edit the following fields: name for the name of the connection in the web interface remoteip the static IP address of the gateprotect firewall localid { fqdn or ipaddr DynDNS URL or static IP address of the FRITZ!Box remoteid { ipaddr the static IP address of the gateprotect firewall mode phase1_mode_idp to use the main mode key the preshared key phase2localid { ipnet { ipaddr the network of the FRITZ!Box phase2remoteid { ipnet { ipaddr the network of the gateprotect firewall phase2ss deactivating the compression in the tunnel connection accesslist enable the network of the gateprotect firewall Now save the file, go to the web interface of the FRITZ!Box and open the menu item Internet -> Enable. Switch to the VPN tab and click on the button Add VPN Connection. On the following page, select Import a VPN Configuration from an Existing VPN Settings File and click on the Continue button. Select the Choose File button and load up the configuration file you have created. With a click on OK, the configuration is imported. On the VPN overview page, please make sure that the imported connection is marked as Active. If this is not the case, activate the connection and click the Accept button. Page: 7 7 / 12

9 2.3 Putting up the VPN IPsec Settings In the administration client, open the item VPN -> IPsec. Make sure that the module is active and then click on the + (plus) sign in order to create a new connection. Choose Site-to-Site as the connection type and select the Internet connection over which the IPsec connection shall be established. If there are several Internet connections, be aware that you have to select the connection with the public IP address that you have inserted on the FRITZ!Box. After that, name the local network of the gateprotect firewall and the local network of the FRITZ!Box as well as the public IP address or the DynDNS URL of the FRITZ!Box. Make sure that the gateprotect firewall initiates the connection. Page: 8 8 / 12

10 In the Authentication tab, please enter the PreShared Key; the Identifier fields remain empty. Page: 9 9 / 12

11 For encryption, please select the following values on the gateprotect firewall: IKEv1 with 3DES, SHA1, DH Group 2 and 3600 sec validity period For Phase 2 3DES, SHA1 and 3600 sec validity period PFS active with DH Group 2 Save your settings and quit the IPsec menu with a click on OK. The gateprotect firewall will now try to establish the connection to the FRITZ!Box. You may now follow the status via the IPsec menu or via the reports from the gateprotect firewall. Once the connection is established, all left to be done is the configuration of the firewall rules. Page: / 1 2

12 3 Troubleshooting To identify problems in establishing an IPsec connection, please take a look into your reports or log files. The following error messages may occur on the end of the gateprotect firewall: Message packet from REMOTE_IP:500: initial Main Mode message received on LOCAL_:500 but no connection has been authorized with policy=psk ignoring informational payload, type NO_PROPOSAL_CHOSEN ignoring informational payload, type INVALID_ID_INFORMATION cannot respond to IPsec SA request because no connection is known for /24=== : :4500=== /24 Cause In the local configuration, no match for the REMOTE_IP and LOCAL_IP with a preshared key could be found. Please check the IP addresses and make sure that, if dynamic IP addresses are used on the remote station, there is no second IPsec connection to a dynamic IP address. This message appears if parameters of phase 1 do not match. Please check the KEv1 settings of the gateprotect firewall. This message appears if parameters of phase 2 do not match. Please check the settings of the gateprotect firewall. There has been an error when checking the subnetworks of both ends. Please check the network addresses and network masks on both ends. Likewise, the log of the FRITZ!Box may provide you with helpful information on the status or problems when establishing an IPsec connection: Message "VPN-Verbindung zu [...] wurde getrennt. Ursache: 1" "VPN-Verbindung zu [...] wurde getrennt. Ursache: 3" "VPN-Verbindung zu [...] wurde getrennt. Ursache: 5" "VPN-Verbindung zu [...] wurde getrennt. Ursache: 8" "VPN-Verbindung zu [...] wurde getrennt. Ursache: 9" Cause Via the VPN connection, there has been no data exchange for more than one hour. The remote station has interrupted the VPN connection. The public IP address of the FRITZ!Box or the remote station has changed while the VPN connection was in place. The remote station has interrupted the VPN connection. The VPN remote station is no longer available. Page: / 1 2

13 4 Disclaimer No part of this document may be duplicated or passed to third parties for any purpose without the express written approval of gateprotect GmbH (gateprotect). This applies regardless of the manner or method, electronic or mechanical, in which this takes place. The information contained on this how-to guide is provided in good faith, and every reasonable effort is made to ensure that it is accurate and up to date. To check for the latest version, please login to Accordingly, this information is provided 'as is' without warranty of any kind. In no event shall gateprotect be liable for any damage arising, directly or indirectly, from the use of the information contained herein, nor from the use of third party tools given as examples in this guide including damages arising from inaccuracies, omissions or errors. Any third party tools have been mentioned only for example and sufficient-for-purpose at the time of writing this guide, however gateprotect does not explicitly recommended or endorse any third party tools mentioned herein, and makes no claim to have completely security tested or performance evaluated them or any other associated versions. Any person relying on any of the information contained in this guide or making any use of the information contained herein, shall do so at their own risk. gateprotect hereby disclaims any liability and shall not be held liable for any damages including, without limitation, direct, indirect or consequential damages including loss of revenue, loss of profit, loss of opportunity or other loss. The information contained in this guide and on the mygateprotect.com site may be changed or updated at any time without notice. If you have questions about this document, feel free to contact us: Any ideas and suggestions are welcome gateprotect GmbH. All rights reserved. gateprotect GmbH Valentinskamp Hamburg / Germany Page: / 1 2