Collax VPN. Howto. Requirements Collax Security Gateway Collax Business Server Collax Platform Server including Collax Gatekeeper module

Transcription

1 Collax VPN Howto This howto demonstrates the setup of a VPN connection between two locations using a Collax Business Server (CBS) and a Collax Security Gateway (CSG). Requirements Collax Security Gateway Collax Business Server Collax Platform Server including Collax Gatekeeper module The objective is to connect the local networks (LAN) of two locations to each other. The VPN connection is to be encrypted with certificates based on the common X.509 standard. Non-Collax Remote Parties Non-Collax products can also establish a VPN connection to a Collax server. For this purpose, the settings of the two servers must be adjusted to each other as shown in the example configuration. For the connection to be established, the third-party product must comply with the IPsec standard. General To connect two Collax servers via VPN, the LAN on this side must be different from that on the other side. Connecting two LANs with identical address ranges is only possible with complicated tricks. Make sure that both Collax servers can be reached on the Internet either via static IP address or via host name/dyndns address. Example Configuration This is our example configuration: Collax Business Server (CBS): Host name: cbs.collax.com LocalNet: /24 Certificate: VPN_CBS Location: Ismaning Collax Security Gateway (CSG): Host name: csg.collax.com LocalNet: /24 Certificate: VPN_CSG Location: Freiburg Certificates For a connection between two Collax servers, it is sufficient to create a local server certificate on both systems. If you want to set up several VPN connections, it may be good to create a certificate authority (CA) on one of the systems and then use it to sign a local and a non-local server certificate. In line with the second example, we generate certificates signed by the CA Collax GmbH Status: Final Version: 5.8 Date: November 18, 2014

2 CBS Configuration Generating the CA First, create a CA on the CBS. You can generate the CA under "System Usage Policy Certificates X.509 Certificates". The CA will be used to generate a local server certificate for the CBS and a non-local server certificate for the CSG. Always select a unique "Name". It is not permitted to create another certificate with the same common name. The "Valid for (days)" of the CA certificate should be long enough, as all certificates signed with the CA become invalid upon expiry of the CA. As it is not possible to extend the validity, you would have to generate new certificates. Collax VPN Howto 2/10

3 Generating a Local Server Certificate Next, generate a certificate for the "Local server" and sign it with the CA. Collax VPN Howto 3/10

4 Generating a Non-Local Server Certificate The procedure for the non-local server certificate is identical. This time, select "Non-local server" as the "Purpose". Do not set any "Passphrase". Exporting the Certificates Export the two certificates. Subsequently, import them on the other side (CSG). Collax VPN Howto 4/10

5 Right-click the certificates in the overview to export them. Be sure to export the non-local certificate (VPN_CSG) with private key. After the files are exported and saved, they will bear the names "VPN_CBS.crt" and "VPN_CSG.crt". Defining the VPN Network Before you generate a VPN link, the remote LAN must be defined. You can do this under "System Networking Links Networks". For this purpose, set up the VPN_remote_network /24 on the CBS. Routing To reach the remote network, the routing must be configured in the firewall matrix. You can find the settings under "System Networking Firewall Matrix". For the first test run, you should open the connection entirely in both directions. Firewall To enable client access from the VPN_remote_network to services of the CBS, generate a new group under "System Usage Policy Policies Groups". Select the "VPN_remote_network" as "Network" of the group, as the client requests will come from this network. Set the group permissions to enable access to the services. Collax VPN Howto 5/10

6 NAT Traversal If one or both of the servers are located behind a router, NAT traversal must be enabled on the Collax servers. This dialog is located under "System Networking Links General". The UDP ports 500 and 4500 must be opened on the routers between the IPsec terminals. The option is often referred to as "VPN passthrough". IPsec Proposals To establish VPN/IPsec connections, various parameters must be defined for the exchange of keys and data. To facilitate the handling and to improve the stability of VPN connections, these parameters are combined in the form "System Networking Links IPsec Proposals" and can then be selected from a selection box in the VPN links. Additionally, a predefined IPsec proposal can be set as default under "System Networking Links General". Only the default proposal can be selected for links of the type "Wait for dial-in". Collax VPN Howto 6/10

7 Configuring the VPN Link On the CBS, define a VPN link under "System Networking Links Links". Set the value of "Connection method" to "Always". After configuring the CBS, switch to the CSG. CSG Configuration Importing Certificates Import the exported certificates under "System Usage Policy Certificates X.509 Certificates". Collax VPN Howto 7/10

8 Defining the VPN Network Subsequently, define the remote LAN. You can do this under "System Networking Links Networks". For this purpose, set up the VPN_remote_network /24 on the CSG. Routing To reach the remote network, the routing must be configured in the firewall matrix. You can find the settings under "System Networking Firewall Matrix". For the first test run, you should open the connection entirely in both directions. Collax VPN Howto 8/10

9 Firewall To enable client access from the VPN_remote_network to services of the CSG, generate a new group under "System Usage Policy Policies Groups". Select the "VPN_remote_network" as "Network" of the group, as the client requests will come from this network. Set the group permissions to enable access to the services. NAT Traversal If one of the Collax servers is located behind another router, NAT traversal must be enabled on both Collax servers. You can access this setting under "System Networking Links General". The router located downstream of the Collax server must allow the UDP ports 500 and 4500 to pass through. On most routers, this option is called "VPN passthrough". IPsec Proposals To establish VPN/IPsec connections, various parameters must be defined for the exchange of keys and data. To facilitate the handling and to improve the stability of VPN connections, these parameters are combined in the form "System Networking Links IPsec Proposals" and can then be selected from a selection box in the VPN links. Additionally, a predefined IPsec proposal can be set as default under "System Networking Links General". Only the default proposal can be selected for links of the type "Wait for dial-in". Collax VPN Howto 9/10

10 Configuring the VPN Link On the CSG, define a VPN link under "System Networking Links Links". Set the value of "Connection method" to "Always". The configuration is finished, and the VPN connection should be established automatically after activating the two configurations. Collax VPN Howto 10/10