TopGlobal MB8000 VPN Solution

Transcription

1 TopGlobal Solution Top Global MobileBridge connects 3G and Ethernet network, as well as WiFi network. MB8000 is a product of MobileBridge serials. MB8000 provides a gateway service for its LAN (including wired LAN and wireless LAN) users. There is a NAT (Network Address Translator) service resident inside, which is a method of connecting a number of computers in a LAN to the Internet using a single one public IP address. MB8000 provides kinds of VPN solution for end user. VPN pass through and VPN endpoint functions are fully supported in MB8000. In this application note, those application scenarios and configuration options will be described in detail. Application scenario 1: VPN Client pass through MB8000 can support VPN pass through very well. When you are using a VPN client via MB8000 to connect with a VPN concentrator in the Internet and the VPN protocol supports NAT-T (UDP encapsulation VPN), it can be passed by MB8000 without any problem. No configuration is needed because it is default in MB8000. See below scenario: VPN client normally is running in a PC or laptop, this laptop (or PC) is connected into MB8000 private network via WiFi or Ethernet cable. MB8000 brings the VPN client into the Internet via 3G networks so that it can build VPN tunnel with the VPN concentrator which locates in the Internet. The VPN tunnel was built over 3G wireless networks and the Internet through MB8000. The VPN tunnel is oriented from the VPN client and terminated

2 in the VPN concentrator. MB8000 works as a transparent bridge here. Configurations for VPN pass through VPN client: Enable NAT-T. MB8000: No special configuration is needed. VPN pass through is default configuration. Application scenario 2: VPN Router pass through VPN tunnel built by VPN Router behind MB8000 can also pass through MB8000 very well. If the VPN protocol supports NAT-T (UDP encapsulation VPN), it can be passed by MB8000 without any problem. No configuration is needed because it is default in MB8000. See below scenario: VPN router is connected into MB8000 private network via Ethernet cable. MB8000 brings the VPN Router into the Internet via 3G networks so that it can build VPN tunnel with the VPN concentrator which locates in the Internet. The VPN tunnel was built over 3G wireless networks and the Internet through MB8000. The VPN tunnel is oriented from the VPN Router and terminated in the VPN concentrator. MB8000 works as a transparent bridge here.

3 Configurations for VPN pass through VPN Router: Enable NAT-T. MB8000: No special configuration is needed. VPN pass through is default configuration. Application scenario 3: Bridge Mode It is known that the NAT will do something harmful to the VPN Service. The NAT could not make VPN protocol pass-through smoothly because of the IP address replacement. NAT-T protocol uses UDP encapsulation to walk around this problem. If the VPN you are using doesn t support NAT-T or you don t like NAT-T, you might want a transparent connection to the Internet for your VPN Server, without the NAT. MB8000 also provide a good solution for that requirement. That is what Bridge Mode function in MB8000 does. When bridge mode is enabled, MB8000 works as a transparent modem. MB8000 forwards incoming and outgoing packets, doesn t modify anything about them. With this deployment, your VPN Server will have a public IP address, as if it connects to the Internet directly. See below scenario: VPN router connected with MB8000 via Ethernet cable. MB8000 works in Bridge Mode. MB8000 passes the Public IP address it gets from the 3G networks to the VPN Router. The VPN Router uses this IP address to set up the VPN tunnel with the VPN concentrator directly. The VPN Router works as it is in the Internet directly and doesn t sense the presentation of MB8000. The VPN tunnel is oriented from the VPN router and terminated

4 in the VPN concentrator. Application Notes Configurations for Bridge Mode: VPN Router: You MUST set your device to obtain the IP address from a DHCP server. MB8000: It is simple to configure MB8000 to support Bridge Mode. Power up and login to the WEB management page and go to the Advanced-> IP Port Forwarding page. In the Bridge Mode domain, configure the Bridge Mode item and MAC Address item according to your application. Save the changes. Bridge Mode: Indicates users which bridge mode will be used. When Enable with Static MAC is selected, users should assign a device s MAC address to MB8000. When Enable with Dynamic MAC is selected, MB8000 gets the device s physical address automatically. MAC Address: the device s physical address. Second, in the Web GUI-> Basic-> Local IP Configuration page, set the Default Lease Time to 30 or less. Save the changes.

5 Save your configuration and then reboot MB8000. After get this done, Attach you device such as VPN Server to the RJ45 in MB8000. The device that you attached will be able to get a public IP address from MB8000, the default gateway IP address will be one up the public IP address, the subnet mask is and it can connect to the internet without NAT. The MB8000 looks transparent to that device. You need to record the private IP address of MB8000 so that you can manage it. The default Address is You need to manually assign the laptop which you want to use for the MB8000 management with the IP address of x for example: Use this laptop to connect MB8000 via WiFi or Ethernet through a Hub since the Ethernet port is used for Bridge Made. Then you can manage MB8000 with Application scenario 4: VPN End Point In the above applications, the VPN is orientated by VPN client or VPN router. MB8000 can orientate the VPN tunnel itself. This feature is very useful in the enterprise application for example: remote branch office Internet accession, back up link and all the security accession. MB8000 builds VPN tunnel with the enterprise VPN concentrator so that all the security links from MB8000 private network are protected by the VPN. See below scenario:

6 Configurations for VPN End Point: VPN Router: Use Cisco 3000 as an example. Below is the IKE proposal for phase 1: Below is the IKE proposal for phase 2:

7 And IPSec step 3:

8 And IPSec step 4: Application Notes. MB8000: Correspondingly, MB8000 also needs to be configured as below:

9 It has been verified that End Point can work very well with Cisco 3000, Cisco 1811, Sonicwall T79, Linksys VPN gateway and so on. ADDR:21072 Bake Parkway, Suite 106, Lake Forest, CA 92630, USA TEL: TOP Global USA, Inc. FAX: