VMware AirWatch Certificate Authentication for Cisco IPSec VPN

Transcription

1 VMware AirWatch Certificate Authenticatin fr Cisc IPSec VPN Fr VMware AirWatch Have dcumentatin feedback? Submit a Dcumentatin Feedback supprt ticket using the Supprt Wizard n supprt.air-watch.cm. This prduct is prtected by cpyright and intellectual prperty laws in the United States and ther cuntries as well as by internatinal treaties. VMware prducts are cvered by ne r mre patents listed at VMware is a registered trademark r trademark f VMware, Inc. in the United States and ther jurisdictins. All ther marks and names mentined herein may be trademarks f their respective cmpanies. 1

2 Table f Cntents Chapter 1: Wrkspace ONE UEM Certificate Authenticatin fr Cisc IPSec VPN 3 System Requirements fr Cisc IPSec VPN 3 High Level Design fr Cisc IPSec VPN 3 Implementatin Apprach fr Cisc IPSec VPN 4 Chapter 2: Install, Set Up, Cnfigure Certificate 6 Disable the Lcal CA n the ASA Firewall fr Cisc IPSec VPN 6 Cnfigure IPsec VPN 7 Integrate Wrkspace ONE UEM with the External CA fr Cisc IPSec VPN 8 Deply an IPSec VPN and Certificate Prfile t Devices 9 Chapter 3: Trubleshting fr Cisc IPSec VPN 11 Chapter 4: Trubleshting Checks 11 2

3 Chapter 1: Wrkspace ONE UEM Certificate Authenticatin fr Cisc IPSec VPN Wrkspace ONE UEM may be cnfigured s that Apple and select Andrid devices can cnnect t an enterprise netwrk thrugh Cisc IPsec using a certificate fr authenticatin. Fr thse wh are using ther Secure Sckets Layer (SSL) Virtual Private Netwrks (VPN) hardware (e.g., Juniper, F5, etc.) r methds fr certificate authenticatin, there is an explanatin f the methdlgy s that yu can understand the cncepts and implement VPN within yur enterprise. Regardless f the methd yu chse, Wrkspace ONE UEM can prvide yur enterprise with MDM slutins fr VPN. Wrkspace ONE UEM has many VPN features, including n-demand authenticatin. This means yu can chse which dmains yur mbile device users have access t. Every time a device user accesses the desired resurces n yur prtected netwrk, the device, withut the user s knwledge, autmatically handles the lgin and certificate authenticatin prcess making their VPN lgin experience very simple and seamless. System Requirements fr Cisc IPSec VPN The fllwing tasks must be cmpleted befre cnfiguring certificate integratin. An external CA server must be set up and cnfigured. If yu want guidance as t the methdlgy f setting up an external CA, refer t Selecting Micrsft CA Deplyment Mdels Overview, which is available n dcs.vmware.cm. The CA must be an external Enterprise CA as ppsed t a standalne CA since standalne des nt allw fr the cnfiguratin and custmizatin f templates. Fr IPSec, yu must have a Cisc Adaptive Security Appliance (ASA) cnnected t yur netwrk. High Level Design fr Cisc IPSec VPN This diagram shws hw certificate authenticatin is handled frm the pint where the user s device enrlls int Wrkspace ONE UEM t when the user has VPN access t the prtected enterprise netwrk. 3

4 Chapter 1: Wrkspace ONE UEM Certificate Authenticatin fr Cisc IPSec VPN Implementatin Apprach fr Cisc IPSec VPN Befre yur enterprise netwrk server can securely pass crprate infrmatin t the user s device ver IPSec VPN, yu need t perfrm sme steps s that yur Adaptive Security Appliances (ASA) firewall recgnizes the user s device and trusts it belngs t an authrized user. This is accmplished by authenticating the user and their device with an Identity Certificate prvided frm an external certificate authrity (CA). Regardless f the ASA firewall equipment r prprietary IPSec VPN being cnfigured, the methdlgy is basically the same. If yu understand the methdlgy, have the technical expertise, and have a strng understanding f the hardware and sftware needed t perfrm this, then it becmes much easier t cnfigure and it ensures the user having a seamless experience using Remte Access VPN. Integrate the Firewall with an External CA First, yur firewall must be integrated with an external CA s that it can trust that incming Identity Certificates riginated frm a valid, trusted surce that can be leveraged fr authenticatin. Specifically, when cnfiguring IPSec VPN fr certificate authenticatin, the prcess includes: 4

5 Chapter 1: Wrkspace ONE UEM Certificate Authenticatin fr Cisc IPSec VPN Disabling the Lcal CA n the ASA firewall Generating a Certificate Signing Request (CSR) n the ASA firewall Installing the external CA s certificate n the ASA firewall Installing the Identity Certificate n the ASA firewall Cnfigure the Firewall fr IPSec VPN Using Certificate Authenticatin Once yur firewall has been cnfigured with an external CA and bth the CA s certificate and a crrespnding firewall Identity Certificate have been added t the firewall, the remaining IPSec VPN settings can be cnfigured. Fr IPSec VPN, the prcess includes: Cnfiguring Internet Key Exchange (IKE) plicies Selecting the mde f encryptin Cnfiguring the tunnel prperties and plicies Creating a new grup plicy Defining IP addresses (pl) available VPN clients Creating user accunts and grup assignments Assciating all attributes t create an IPSec prfile Cnfigure Wrkspace ONE UEM t Deply an Identity Certificate and IPSec VPN Prfile t Devices At this pint, IPSec VPN has been prperly cnfigured t allw devices t cnnect with certificates frm an external CA. Hwever, it wuld require a manual prcess fr generating and deplying Identity Certificates t all devices, and als cnfiguring the apprpriate VPN settings n each. Autmating this prcess with Wrkspace ONE UEM wuld entail: Integrating Wrkspace ONE UEM with the external CA Deplying an IPSec VPN and certificate prfile t devices 5

6 Chapter 2: Install, Set Up, Cnfigure Certificate This sectin prvides instructins t cnfigure the certificate authrity (CA) f yur chice t wrk with the Wrkspace ONE UEM cnsle. Take the fllwing steps and prcedures t integrate the certificate. Disable the Lcal CA n the ASA Firewall fr Cisc IPSec VPN Befre cnfiguring the ASA firewall fr IPSec using an external certificate authrity, yu must disable the lcal CA n the ASA firewall t ensure that certificates are authenticated against the external CA. 1. Lg int the Cisc Adaptive Security Device Manager (ASDM) t cnfigure yur ASA firewall. 2. Navigate t Cnfiguratin > Remte Access VPN > Certificate Management > Lcal Certificate Authrity > CA Server. 3. select Disable. 6

7 Chapter 2: Install, Set Up, Cnfigure Certificate 4. Select OK. Next, yu must Cnfigure IPSec VPN. Cnfigure IPsec VPN Once yu have disabled the lcal CA n the ASA firewall, yu are nw free t cnfigure the IPSec VPN. 1. Create a CSR n the ASA firewall and send it t the external CA. This is because the ASA needs an Identity Certificate signed by the external CA. Fr assistance, fllw Cisc s instructins fr Generating a CSR n the ASA firewall. After yu have cmpleted all the steps, a *.cer file (e.g., cert_client_id.cer) dwnladed t yur lcal machine that was btained frm the external CA. 2. Dwnlad the certificate frm the external CA and install it n the ASA firewall t authenticate that the external CA is a trusted surce. Fr assistance, fllw Cisc s instructins n hw t install the external CA s certificate. 3. Install the Identity Certificate that yu previusly dwnladed frm the external CA. This is used t verify that the Identity Certificate users authenticate with the same parameters and are cming frm the same external CA as the Identity Certificate n the ASA firewall. Fr assistance, fllw Cisc s instructins n hw t install ASA s Identity Certificate. After cmpleting these steps, the Identity Certificate that was created by the external CA is nw installed n yur ASA firewall as shwn belw: 4. Cnfigure the IKE plicies, tunnel prperties and plicies, grup plicies, available VPN client IP addresses (pl), user accunts and grup assignments, and assciate these cnfiguratins t create an IPSec prfile used by the VPN clients. Visit the Cisc website fr instructins n creating a remte access cnnectin prfile and tunnel grup n the ASA fr IPSec VPN clients. Cmplete the steps necessary t cnfigure the external CA and ASA firewall t create a trust using certificates and cnfigure a remte access cnnectin prfile and tunnel grup s that IPSec VPN certificate authenticatin can be used by yur VPN clients t gain access int yur enterprise netwrk. At this time, yu shuld be able t cnnect a device t yur netwrk using IPSec VPN. The last step is t cnfigure Wrkspace ONE UEM t manage devices. Cntinue t the fllwing steps t integrate Wrkspace ONE UEM. Next, yu must Integrate Wrkspace ONE UEM with the External CA. 7

8 Chapter 2: Install, Set Up, Cnfigure Certificate Integrate Wrkspace ONE UEM with the External CA fr Cisc IPSec VPN After cnfiguring the ASA firewall fr IPSec VPN with external CA authenticatin, Wrkspace ONE UEM can be used t autmate the deplyment prcess f Identity Certificates and VPN settings t each device. Yu can nw integrate Wrkspace ONE UEM with the external CA s that Wrkspace ONE UEM can request and deply Identity Certificates. First, yu must prvide Wrkspace ONE UEM with infrmatin abut the external CA. 1. Lg in t the Wrkspace ONE UEM cnsle as a user with Wrkspace ONE UEM Administratr privileges, at minimum. 2. Navigate t Devices > Certificates > Certificate Authrities. 3. Select Add. 4. Select frm the Micrsft ADCS frm the Authrity Type drp-dwn menu prir t cmpleting any ther cnfiguratin settings fr the certificate authrity. 5. Enter the infrmatin abut the Certificate Authrity. Enter a name fr the new Certificate Authrity. Enter a brief Descriptin fr the new certificate authrity. Micrsft ADCS shuld already be selected fr the Authrity Type as described previusly. Select ADCS radi buttn fr the Prtcl. Enter the URL f the server in the Server Hstname field. The server hstname must be entered in the fllwing frmat: The site can be http r https depending n hw the site is set up. The URL must include the trailing /. Enter the Authrity Name. This is the name f the certificate authrity that the ADCS endpint is cnnected t. This can be fund by launching the Certificatin Authrity applicatin n the certificate authrity server. Verify the Service Accunt radi buttn is selected fr Authenticatin. Enter the Username and Passwrd. This is the username and passwrd f the ADCS Admin Accunt with sufficient access t allw Wrkspace ONE UEM t request and issue certificates. 6. Select Save. 7. Select the Request Templates tab at the tp f the page and then select Add. 8. Cmplete the certificate template infrmatin. Enter a name fr the new Request Template. Enter a brief Descriptin fr the new certificate template. Select the certificate authrity that was just created frm the Certificate Authrity drp-dwn menu. Enter the Subject Name r Distinguished Name (DN) fr the template. The text entered in this field is the Subject f the certificate, which can be used by the netwrk administratr t determine wh r what device received the certificate. 8

9 Chapter 2: Install, Set Up, Cnfigure Certificate A typical entry in this field is CN=WrkspaceONEUEM.{EnrllmentUser} r CN={DeviceUid} where the {} fields are Wrkspace ONE UEM lkup values. Select the private key length frm the Private Key Length drp-dwn bx. This is typically 2048 and shuld match the setting n the certificate template that is being used by ADCS. Select the private key type frm the Private Key Type drp-dwn bx. This is typically Signing & Encryptin and shuld match the certificate template that is being used by ADCS. Fr use with Exchange Active Sync it shuld be Signing & Encryptin. Select Add t the right f SAN Type t include ne r mre Subject Alternate Names with the template. This is used fr additinal unique certificate identificatin. In mst cases, this needs t match the certificate template n the server. Use the drp-dwn menu t select the SAN Type and enter the subject alternate name in the crrespnding data entry field. Each field supprts lkup values. Select the Autmatic Certificate Renewal checkbx t have certificates using this template autmatically renewed prir t their expiratin date. If enabled, specify the Aut Renewal Perid in days. The aut-renewal perid is the amunt f time (in days) befre the current certificate expires that the certificate will be renewed and pushed t devices. Select the Enable Certificate Revcatin checkbx t have certificates autmatically revked when applicable devices are unenrlled r deleted, r if the applicable prfile is remved. Select the Publish Private Key checkbx t publish the private key t the specified web service endpint (directry services r custm web service). 9. Select Save. Nw yu can prceed t the final step, Deply an IPSec VPN and Certificate Prfile t Devices. Deply an IPSec VPN and Certificate Prfile t Devices After cnfiguring the certificate authrity and certificate template settings in Wrkspace ONE UEM, deply an Identity Certificate and IPSec VPN settings t be autmatically cnfigured n all f yur devices. 1. Navigate t Devices > Prfiles > List View. 2. Select Add. 3. Select the applicable device platfrm t launch the Add a New Prfile screen. 4. Cnfigure the General settings fr the prfile. The General settings determine hw the prfile is deplyed and wh receives it as well as ther verall settings. 5. Select Credentials frm the prfile ptins at left and then select Cnfigure. 6. Select Define Certificate Authrity frm the Credential Surce drp-dwn menu. 7. Select the Certificate Authrity yu created previusly frm the Certificate Authrity drp-dwn menu. 8. Select the Certificate Template yu created previusly frm the Certificate Template drp-dwn menu. 9. Select VPN frm the prfile ptins at left. 9

10 Chapter 2: Install, Set Up, Cnfigure Certificate 10. Select Cnfigure. Yu must cnfigure the Credentials paylad settings befre the VPN paylad settings. 11. Cnfigure the VPN settings. Enter in the Cnnectin Name field a descriptive name that identifies the VPN cnnectin n the device. Select IPSec (Cisc) frm the Cnnectin Type drp-dwn menu. Enter the VPN Endpint URL r VPN Server in the Server field. This is the URL that users cnnect t in rder t establish their VPN cnnectin. If yur VPN has been cnfigured t leverage user credentials in additin t a certificate fr authenticatin, then enter in the Accunt field the User Accunt t pass t the VPN endpint. T pass Wrkspace ONE UEM User Accunt names t the VPN endpint, leverage the {enrllmentuser} lkup value. Select Certificate as the type f Machine Authenticatin. Select the Identity Certificate credentials that yu created previusly. Verify the Include User PIN and Enable VPN On Demand checkbxes are nt checked. 12. Select Save r Save & Publish t publish this prfile t a device. 10

11 Chapter 3: Trubleshting fr Cisc IPSec VPN Yu can cnfirm that the VPN certificate is peratinal by pushing a prfile t the device and testing whether r nt the device is able t cnnect and sync t the cnfigured ASA firewall. If the device is nt cnnecting and shws a message that the certificate cannt be authenticated r the accunt cannt cnnect t the ASA firewall, then there is a prblem in the cnfiguratin. Chapter 4: Trubleshting Checks Make sure that a certificate is being issued by the external CA t the device by checking the fllwing infrmatin. G t the external CA s server, launch the certificatin authrity applicatin, and brwse t the issued certificates sectin. Find the last certificate that was issued and it shuld have a subject that matches the ne created in the certificate template sectin earlier in this dcumentatin. If there is n certificate then there is an issue with the external CA, client access server (e.g., ADCS), r with the Wrkspace ONE UEM cnnectin t the client access server. Check that the permissins f the client access server (e.g., ADCS) Admin Accunt are applied crrectly t the external CA and the template n the external CA. Check that the accunt infrmatin is entered crrectly in the Wrkspace ONE UEM cnfiguratin. If the certificate is being issued, make sure that it is in the Prfile paylad and n the device. Navigate t Devices > Prfiles > List View. In the Device Prfiles screen fr the user s device, select Actins and then, select </> View XML t view the prfile XML. There is certificate infrmatin that appears as a large sectin f text in the paylad. On the device, g t the prfiles list, select details and see if the certificate is present. 11

12 Chapter 4: Trubleshting Checks If the certificate is n the device and cntains the crrect infrmatin, then the prblem is mst likely with the security settings n the ASA firewall. Cnfirm that the address f the VPN endpint is crrect in the Wrkspace ONE UEM prfile and that all the security settings have been adjusted fr allwing certificate authenticatin n the firewall. A very gd test t run is t manually cnfigure a single device t cnnect t IPSec VPN using certificate authenticatin. This shuld wrk utside f Wrkspace ONE UEM and until this wrks prperly, Wrkspace ONE UEM will nt be able t cnfigure a device t cnnect t IPSec VPN with a certificate. 12