VNS3 IPsec Configuration. Connecting VNS3 Side by Side via IPsec

Transcription

1 VNS3 IPsec Configuration Connecting VNS3 Side by Side via IPsec

2 Requirements and Restrictions You have access to two or more VNS3 controller instances The VNS3 controller instances are running in non-overlapping VLANs (e.g. VPC Subnets, Google Networks, etc.) and non-overlapping VNS3 Overlay Subnets Side-by-side IPsec connections can connect two VNS3 topologies using the Overlay Network in all clouds Connecting underlying unencrypted VLANs is restricted to Cloud environments that provided both packet forwarding features and route table controls to enable VNS3 controller instances as the router/switch for packets being sent to a connected environment 2

3 Topology Setup For the purpose of this example the IPsec tunnel connection will be made between VNS3 Controller Instance A (VNS3-A) and VNS3 Controller Instance B (VNS3-B). Note the topology name in the screenshots. Both VNS3 controller instances are configured with a different/nonoverlapping Overlay Subnet and are running in a different/nonoverlapping VLAN. Our example setup is: VNS3-A Overlay Subnet: /24 VLAN: /24 VNS3-B Overlay Subnet: /24 VLAN: /24 NOTE: NAT-Traversal IPsec requires UDP 500 and 4500 access between the two VNS3 Controller instances. NOTE: Native IPsec requires UDP 500 and Protocol 50 (ESP) access between the two VNS3 Controller instances. 3

4 NAT-Traversal vs. Native IPsec Encapsulation If you are using NAT-Traversal IPsec, you must have 2 unique local private IP addresses for your Endpoint definitions. The default value must be changed on one of the VNS3 controller instances as the overlap will preview the tunnel from fully negotiating. For a NAT-T connection, change the Local private IP address on VNS3-B to Click IPsec under the Connections left menu. Click Change next the the Local private IP address. On the resulting page enter in the New local IP address field. Click Save changes. For Native IPsec, keep the Local private IP addresses and leave the Remote endpoint's Peer ID field blank. 4

5 VNS3-A: Create a New Endpoint On VNS3-A click Define new remote endpoint. Enter a name for the connection to VNS3-B. Enter the VNS3-B controller instance's Public IP address in the IP address for this endpoint field. NAT-T: Check the NAT-T box and enter the Remote endpoint's Peer ID (listed on the IPsec page on VNS3). Native IPsec: Do NOT check the NAT-T box and leave the Remote endpoint's Peer ID field blank. Enter a PSK in the Preshared Key fields. Click the Enable PFS checkbox (optional but recommended). Enter any IPsec parameters needed in the Extra configuration parameters field. Leave blank to allow VNS3 to auto negotiate. These parameters need to match both sides to allow the tunnel to negotiate. Click Create. 5

6 VNS3-A: Create a New Tunnel On VNS3-A, click New tunnel next to the newly created endpoint definition. Enter the VNS3-A Overlay Subnet in the Local subnet field. Enter the VNS3-B Overlay Subnet in the Remote subnet field. Enter a descriptive name in the Name field. Click Create. On the resulting IPsec page, the tunnel should show (Not Connected) 6

7 VNS3-B: Create a New Endpoint On VNS3-B click Define new remote endpoint. Enter a name for the connection to VNS3-A. Enter the VNS3-A controller instance's Public IP address in the IP address for this endpoint field. NAT-T: Check the NAT-T box and enter the Remote endpoint's Peer ID (listed on the IPsec page on VNS3). Native IPsec: Do NOT check the NAT-T box and leave the Remote endpoint's Peer ID field blank. Enter a PSK in the Preshared Key fields. Click the Enable PFS checkbox (optional but recommended). Enter any IPsec parameters needed in the Extra configuration parameters field. Leave blank to allow VNS3 to auto negotiate. These parameters need to match both sides to allow the tunnel to negotiate. Click Create. 7

8 VNS3-B: Create a New Tunnel On VNS3-B, click New tunnel next to the newly created endpoint definition. Enter the VNS3-B Overlay Subnet in the Local subnet field. Enter the VNS3-A Overlay Subnet in the Remote subnet field. Enter a descriptive name in the Name field. Click Create. On the resulting IPsec page, the tunnel should show (Connected) 8

9 Connected 9

10 VNS3 Document Links VNS3 Product Resources - Documentation Add-ons VNS3 Configuration Instructions (Free & Lite Editions BYOL) Instructions and screenshots for configuring a VNS3 Controller in a single or multiple Controller topology. Specific steps include, initializing a new Controller, generating clientpack keys, setting up peering, building IPsec tunnels, and connecting client servers to the Overlay Network. VNS3 Administration Document Covers the administration and operation of a configured VNS3 Controller. Additional detail is provided around the VNS3 Firewall, all administration menu items, upgrade licenses, other routes and SNMP traps. VNS3 Troubleshooting Troubleshooting document that provides explanation issues that are more commonly experienced with VNS3. 10