VPN-Cubed 2.1 UL for Terremark Datacenter Connect or Cloud Only

Transcription

1 VPN-Cubed 2.1 UL for Terremark Datacenter Connect or Cloud Only

2 Requirements You have a Terremark account. You have agreed to the terms of service provided for the VPN-Cubed Manager Server Templates. Ability to configure a client (whether desktop based or cloud based) to use OpenVPN client software. We will provide pointers and support for the major distributions. Basic familiarity with the Terremark vcloud Express Environment. For Datacenter Connect - You have a compliant IPsec firewall/router networking device which you can configure. CohesiveFT has successfully connected most popular IPsec firewalls to the VPN- Cubed IPsec to Terremark Gateway. 2

3 Getting Help with VPN-Cubed You can either send private requests for help to: or use our community forums at: For Datacenter Connect - This guide uses Cisco s Adaptive Security Device Manager UI. Setting up your IPsec Extranet device may have a different user experience than what is shown here. All the information entered in this guide will be same regardless of your UI or cmd line setup. 3

4 Your Configuration Begins Here! 4

5 VPN-Cubed IPsec to Terremark allows you to build an overlay network controlled by a VPN-Cubed Manager in Terremark A VPN-Cubed topology is built from one or many VPN-Cubed Manager(s) in Terremark s vcloud Express Environment which provides a secure and controllable overlay network for your cloudbased servers. The Datacenter Connect version of VPN-Cubed offers additional connectivity between your cloud-based overlay network and your data center extranet solution (Cisco ASA, Cisco Pix, Juniper Netscreen). Multiple topologies can be connected to provide a redundant, geographically distributed network. This Guide provides instructions for all the Cloud Only and Datacenter Connect Editions. If you are setting up a Cloud Only topology, disregard the Datacenter Connect sections. 5

6 Access Considerations VPN-Cubed Manager uses the following TCP and UDP ports and they are open on the Manager s software firewall. If you are interested in locking down these ports to a specific endpoint once you have finished configuration, contact us at support@cohesiveft.com. - UDP 1194 For client VPN connections; must be accessible from all servers that will join VPN-Cubed topology as clients. - UDP For tunnels between manager peers; must be accessible from all peers in a given topology. - TCP 8000 HTTPS admin interface; must be accessible from hosts where you will want to obtain runtime status or configure peering, also needs to be open to and from the managers at least for the peering process, and needs to be accessible when downloading credentials for installation on overlay network clients. - UDP 500 and 4500 FOR DATACENTER CONNECT ONLY - These ports are used for IPsec NAT-TRAVERSAL and need to be configured in your IPsec device. If you would like the Terremark IPsec Gateway to be able to initiate a connection (for example in the event of a broken connection) then you need to allow the public IP address of the gateway to connect to your IPsec device over these ports. - TCP 22 Support and Debugging purposes. 6

7 Access Considerations Note that TCP 22 (ssh) is not required for normal operations. Each VPN-Cubed Manager is running a restricted SSH daemon, with access limited only to CohesiveFT for debugging purposes - if remote support from CohesiveFT is enabled by the end user. In the event CohesiveFT needs to observe runtime state of a VPN-Cubed Manager in response to a tech support request, we will ask you to open access to SSH via an Internet Service on the Network page. In this scenario CohesiveFT has credentials to log in, while you control whether network access to the VPN-Cubed manager is available to CohesiveFT. 7

8 Organize your vcloud Express Environment Terremark s vcloud Express Environment lets you organize your deployments using visual tools like rows and groups. It is helpful in setup and maintenance to appropriately organize your servers. Create a Row called Overlay Network 1. This will include the VPN-Cubed Manager and Clients in a single Overlay Network Topology. Create a Group called Manager. This will contain the VPN-Cubed Manager server for this topology. Create a Group call Clients. This will contain the Client servers joining the Overlay Network. 8

9 Launching the Managers from the vcloud Express Environment: Select the Template To launch the VPN-Cubed Manager click Create Server... Choose Linux Operating System (VPN-Cubed Managers are run on Ubuntu Linux). Choose VPN-Cubed v2.1 UL from the Available Templates drop-down menu. The information in the description section includes information like: - Manager UI URL Manager UI Username - vpncubed - Manager UI Password - vpncubed - Download URL of this Document Click Next. 9

10 Launching the Managers from the vcloud Express Environment: Configure Server Settings When configuring the Manager we recommend that you spec at least 1 GB of memory. Click Next. Name your server Manager1. This will help when peering managers in more complex topologies. The Peering utility will refer to Managers by number. Select a private IP on your vcloud Express Environment VLAN. Click Next. 10

11 Launching the Managers from the vcloud Express Environment: Organzing and Reviewing Select the Row and Group you created for the Manager. Click Next. Review the deployment information for your Manager. Click Deploy. If you are deploying a multi-manager topology repeat steps on pages 9 and 10 to launch additional Managers. Multi-Manager topologies provide additional load balancing, high availability and are restricted by license. See for more information on VPN-Cubed versions and editions. 11

12 Manager Access: Step 1 Create an Internet Service Access to servers is controlled via Internet Services on the Network Tab in the vcloud Express Environment. Setting up the Network Services in order to access the Manager UI on Port 8000 takes two wizard driven steps. Create a Internet Service on the load balancers. Click Create Service. On the resulting Pop-up select/fill in the fields with the information below: - Public IP: Retrieve a new IP - Protocol: TCP - Port: Service Name: Manager UI Access - State: Enabled Click Save then click Create Node on the resulting Internet Service listing. 12

13 Manager Access: Step 2 Create a Node for the newly created Internet Service Add a Node to that Service that connect it to the Server of your choice. Creating a node to connects the newly created tcp port 8000 Internet Service on the load balancers to your server and allows access via the internet. After clicking Create Note - On the resulting Pop-up select/fill in the fields with the information below: - Server: Select the Manager Server - Server IP Address: this will auto fill with the server s private IP - Port: Service Name: Manager Access - State: Enabled Click Save. Repeat steps on pages 12 and 13 for each Manager. 13

14 Datacenter Connect Access: Repeat the steps on pages 12 and 13 FOR DATACENTER CONNECT ONLY - As mentioned earlier UDP Ports 500 and 4500 are used for IPsec/NAT-TRAVERSAL and need to be configured in your IPsec device. If you would like the Terremark IPsec Gateway to be able to initiate a connection (for example in the event of a broken connection) then you need to allow the public IP address of the gateway to connect to your IPsec device over these ports. Repeat the steps on pages 12 and 13 to setup Internet Services and associated Nodes for the UDP Port 500 and UDP Port 4500 access. 14

15 Logging in and Configuring the Manager Login to the VPN-Cubed Web UI - IP>:8000 In order to have an encrypted connection to the VPN-Cubed Manager, the web UI uses HTTPS with a self-signed certificate generated on each manager individually on boot. You may need to add a security exception in your browser. Log in with a username/password of vpncubed. Three Configuration Options: - Upload License (choose this when launching the first Manager of a Customer Cloudlet) - Contact sales@cohesiveft.com for a VPN-Cubed activation license. - Upload runtime snapshot (choose this when recovering from a Manager failure) - Launch a copy of an old manager using a locally stored snapshot to retain old client packs. - Fetch remote configuration (choose this when launching a second Manager of a Customer Cloudlet) - Launch a copy of an existing manager by grabbing configuration live. 15

16 Logging in and Configuring the Manager Option 1: Upload License Paste the encrypted VPN-Cubed license received from CohesiveFT in the first field. This license will configure the generic Manager. Enter a security token in the second field. This can be anything but must be the same for all Managers in the same topology. Click Submit and Reboot. If you are using a paid Edition (Lite, SME or Enterprise), you will be able to choose between the subnet range that comes preconfigured with the license or a customer subnet defined by your specific topo needs. Free Editions will use the default range of /24. Click the Custom Radio button to specify a custom subnet range. In this example we use /24 for our custom subnet range. The Manager IPs are and the Overlay Connected Device IPs are Your specific license might allow for more or less OLNDs. Once you complete this step, the manager instance will reboot itself and will come up with your specified topology enabled and running. Click Submit and reboot. Skip to Generate Keys on VPN-Cubed Manager. 16

17 Logging in and Configuring the Manager Option 2: Upload runtime snapshot If this manager is a replacement for another manager in an existing topology and you have a recent runtime snapshot from the old manager, you can instantiate the manager by uploading the snapshot. Uploading a snapshot will configure the new Manager the same as the old including using the same Client Packs for the connected Overlay Network Devices. Once you have selected a locally stored snapshot, click Submit and reboot. Skip to Generate Keys on VPN-Cubed Manager. 17

18 Logging in and Configuring the Manager Option 3: Fetch remote configuration Fetching remote configurations can speed the configuration of Managers you wish to Peer to an existing topology. Specify the IP address of the Manager from where you would like to fetch configuration. The security token is used for negotiation between Manager peers and must be the same for all Managers you intend to Peer with one another. Click Submit and reboot. Skip to Generate Keys on VPN-Cubed Manager. 18

19 Generate Keys on VPN-Cubed Manager The Manager is now configured to the License specs (how many managers it can peer with, how many clientpacks are available, and how many ipsec links are available). Click Generate New under SSL Certs and Keys in the left column. During key generation you can specify a Topology name to be displayed in the Manager UI for a given set of peered Managers. This can be changed at anytime by clicking on the Topology Name left column menu item. Click Generate keys link. Key generator will be started in the background, and you can refresh screen to observe progress. This process will generate the client credentials that will be loaded onto the devices you wish to connect to the VPN-Cubed overlay network. NOTE: The Client Packs generated will depend on your license and if you selected to a custom subnet. 19

20 Peering the Managers: Peering Manager 1 Click Setup Manager Peering. Managers connect to each other in a process called Peering. Peered Managers create a redundant, highly available and secure overlay network and share traffic load from the overlay network connected servers. The Peering Setup Page will display the number of Managers allowed to peer together in your topology as defined by the license file used to configure the Manager. For Manager #1 select "this instance" from drop down, instead of specifying its IP. To be valid, your form must have "this instance" value in one and only one drop-down. If your topology has unused Managers, leave the extra fields set to "not set. Enter the Public DNS address of the second Manager for Manager #2. Repeat this for each additional Manager in your topology. When done select Save Changes. You should then get a status page showing that this manager was able to reach the other launched manager instance. 20

21 Peering the Managers: Peering Manager 2, fetch the keyset from Manager 1 (do NOT regenerate) Skip this step if you have a single Manager topology. Log in to VPN-Cubed Manager UI on the second manager. Click Fetch Keyset. Remember that keys must be generated only once per topology! Type in private IP address of Manager1 (where keys were generated) and keys will be copied from Manager1 and set up locally. 21

22 Peering the Managers: Peering Manager 2 Skip this step if you have a single Manager topology. For Manager #1 enter the IP address of MGR1 For Manager #2 select "this instance" from drop down, instead of specifying its IP. To be valid, your form must have "this instance" value in one and only one dropdown. When done select Save Changes. You should then get a status page showing that this manager was able to reach the other launched manager instances. Verify that topology checksum on Manager1 corresponds to that of Manager2. 22

23 VPN-Cubed Manager Status The VPN-Cubed Manager is ready to setup an IPsec Tunnel. You should see all your peered Managers listed under the Links to Other Managers section on each Manager Runtime Status Page. Single Manager topologies will have no links to other Managers. Cloud Only users skip to page 38. For Datacenter Connect Only - Click IPsec under Peering left menu heading. On the resulting IPsec page note the Configuration Settings needed for configuration. Click Define new remote endpoint. 23

24 VPN-Cubed Manager Setup: Define a New Remote Enpoint Enter descriptive name for the Endpoint configuration, this can be anything. Occasionally there is another router between the IPsec firewall and the Internet. Enter the public facing IP address of either the IPsec device or router between Terremark and the IPsec device (see picture below). Enter a Pre-shared Key and keep a record of that key to be entered into the IPsec device. In this example we use VPNCubedRocks for obvious reasons. If your IPsec device is behind a router, enter the external IP interface of the IPsec device (see picture below). Click Create. One the resulting page click New subnet. Exta Config Parameters: We recommend connecting to the Manager with tunnels using AES256 encryption and SHA authentication for both IKE and ESP. Add the lines shown to the right - ike=aes256-sha1 and esp=aes256- sha1. Extra Parameters can be found on the following page. Please contact support@cohesiveft.com for assistance. 24

25 IPsec Configuration: Extra Parameters VPN-Cubed's IPSec subsystem is good at autodiscovery on IKE and ESP choices with a wide range of boxes. We recommend being as specific as possible when entering tunnel parameters. Match the algorithm, hash and DiffieH group for your gateway settings by specifying them in the "Extra Params" text field. We support combinations algorithms 3DES, AES128, or AES256; hashes SHA1 or MD5; and DH groups 2 or 5 (which are represented by the software we use as "modp1024" and "modp1536" respectively). Example entries for IKE (Phase 1) and ESP (Phase 2) in the extra params box: ike=aes128-sha1 ike=aes256-sha1 ike=3des-md5-modp1024 ike=aes256-sha1-modp1536 phase2alg=aes256-sha1 phase2alg=3des-sha1; modp1536 (the "modpxxxx" value can only be added to phase2alg={value of esp} with a semi-colon as show above.) PFS Group Extra params entry for PFS Group is technically required only when it must be diff from pfs group in phase1. If that is the case, then use phase2algo={value of esp};modpxxxx IKE and ESP Lifetimes ikelifetime=3600s (default setting on VPN-Cubed) salifetime=28800s (default setting on VPN-Cubed) Dead Peer Detection - Disabled by default, to enable DPD to attempt to re-connect during periods of no response use the following: dpdaction=restart dpddelay=30 dpdtimeout=90 25

26 VPN-Cubed Manager Setup: Setup a Subnet Enter the subnet this is or will be configured behind the datacenter IPsec Extranet Device. In this example we used /24. Provide a name for the Subnet to allow for easy identification in more complex topologies. External Ping is an optional feature. It provides a pinging functionality over the IPsec tunnel that can be used in addition to IPsec DPD and Keep Alive settings to ensure the tunnel remains up during low traffic periods Enter an IP address of a pingable server located on the Subnet specified. Set the time interval (in seconds) for the ping. Click Create. Your VPN-Cubed Manager IPsec setup is complete. The next steps will detail setting the IPsec connection from your extranet device. Once the IPsec connection is live, this guide will detail how to add clients to the created overlay network. Note the Configuration Settings values, you will need these to correctly configure your extranet device. 26

27 Configuring the IPsec Extranet Device: Adding Network Objects Note: As mentioned earlier these screenshots are from a Cisco ASA extranet device. Your setup user experience may differ slightly. The first step in configuring any IPsec extranet device is to add the appropriate Network Objects. You will need two network objects: - VPN-Cubed Overlay Subnet: the subnet advertised behind the VPN-Cubed Manager - Datacenter Remote Subnet: the subnet advertised behind your datacenter-based IPsec device. 27

28 Configuring the IPsec Extranet Device: VPN Wizard Create a new VPN Tunnel. The Cisco ASA used in this guide does this through a VPN Wizard. If you are using another facility to create your IPsec Tunnel, make sure to enter the same information we enter in the following slides. Choose a Site-to-Site Tunnel Type. Click Next Tunnel Configuration Considerations If you want the tunnel to be perpetual and as close to "always on" as IPSec can do, then: - Your gateway should be using its "keepalive" feature, VPN-Cubed has this enabled by default - Your gateway should be using Dead Peer Detection (DPD) with a "restart" parameter in the event it believes tunnel is dropped - Your VPN-Cubed manager has DPD disabled by default, enable it by adding "dpdaction=restart" dpddelay=30 and dpdtimeout=90 in the extra parameters box (no quotes needed). - Your gateway should allow the VPN-Cubed manager to make a connection "inbound to it", by default the VPN-Cubed manager allows inbound connections and attempts outbound 28

29 Configuring the IPsec Extranet Device: VPN Wizard Enter the VPN-Cubed Managerʼs IP address in the Peer IP Address field. Enter the same Pre-Shared Key entered from page 24 (our example used VPNCubedRocks ). Click Next 29

30 Configuring the IPsec Extranet Device: VPN Wizard Choose your Key Exchange Policy (IKE). Make sure it is the same as the one used in the VPN-Cubed Manager setup. On page 24 we used AES-256. Click Next 30

31 Configuring the IPsec Extranet Device: VPN Wizard Select the ecryption and authentication algos for the Encapsulating Security Payload (ESP). Make sure it is the same as the one used in the VPN-Cubed Manager setup. Again our recommended setup uses AES-256 from page 24. Click Next 31

32 Configuring the IPsec Extranet Device: VPN Wizard Setting up Hosts and Networks. The following information will setup a test tunnel to your VPN-Cubed Manager. After the tunnel is up and running you can return to this step and change the Source and Destination information to open up more traffic between your IPsec extranet device and the cloud. Setup a test connection using your Datacenter Remote Subnet as the Source and the VPN-Cubed Overlay Subnet as the Destination. The screenshot to the right shows how to open up your network to the overlay network at Terremark. Click Next. 32

33 Configuring the IPsec Extranet Device: VPN Wizard Double check that all the information is entered correctly. Click Finish 33

34 IPsec Extranet Device: Session Details Make sure the IPsec VPN session is up and running. Goto Monitoring > VPN Statistics > Sessions You should be able to see the session under LAN-to-LAN Click Details 34

35 IPsec Extranet Device: Session Details The Session Details will give you expanded information about your Key Exchange and IPsec status. 35

36 VPN-Cubed Manager: Check the IPsec Status To check the status of your IPsec connection from the VPN-Cubed Manager click on Runtime Status. Each Subnet will be displayed as a connected tunnel. Click the Remote Subnet for tunnel parameters and to access the IPsec log for that specific connection. If you do not see your IPsec Tunnel listed, it is not correctly configured. Double check that you have entered all the information correctly in both the VPN-Cubed Manager and your IPsec device. If you are having difficulties please support@cohesiveft.com. NOTE: If you have 2 tunnels servicing the same datacenter subnet, these tunnels should not be up both at the same time. If you have questions about setting up a second tunnel please contact us at support@cohesiveft.com. Now that the IPsec Tunnel is up and running, clients in Terremark can be added to the secure Overlay Network extension of your Datacenter. 36

37 IPsec Connection Trouble Shooting: Verbose Logging VPN-Cubed allows users to enable Verbose Logging to help with IPsec connection troubleshooting. To enable Verbose Logging click IPsec in the left column menu. Click Logging on the IPsec Page. Click the radio button next to verbose logging. Click Submit. NOTE: Verbose Logging is disabled by default and should remain disabled during normal operations. Leaving Verbose Logging enabled over a extended period of time can fill the Manager instances virtual disk drive. This causes the Manager to become inaccessible via the UI and requires our intervention to free up disk space. 37

38 Client Configuration: Install Client Credentials In the context of VPN-Cubed, client means devices which will be configured as members of the overlay network. These network members will usually be servers running in Terremark. In more advanced editions of VPN-Cubed this includes desktop based client machines. Note the Client Download username and password on Status screen on every manager (username is clientpack ). On any Manager go to Client Packs and pick a client pack. A client pack can run on a single client at a time. If you shut down or disconnect client from the topology, you can reuse its client pack. The number of client packs provided in your license depends on your purchased parameters. 38

39 Client Configuration: Security Group Exceptions Depending on what OS your cloud-based clients are running you will need to add access to the vpncubed-client security group via RDP Port 3389 (Windows) or SSH Port 22 (Linux) in order to add the clientpacks. Additionally Port 8000 access will need to be opened between the vpncubed-mgr and vpncubed-client security groups. For Linux Clients Configuration follow the steps on pages For Windows Clients Configuration follow the steps on page

40 Linux Client Configuration: Add SSH Client Access Add SSH access to a specific Linux Client by creating a new Internet Service from the Network Tab. Click Create Service and enter the following information: - Public IP: Retrieve a new IP - Protocol: TCP - Port: 22 - Service Name: SSH Access - State: Enabled Once the Internet Service is created Add a node that is associated with the Linux server(s) you are going to configure. This service is temporary and after initial configuration, access can be revoked. 40

41 Linux Client Configuration: Install Client Credentials TWO PHILOSOPHIES FOR INSTALLATION a) SSH Port 22 Exception Only - Have ssh access into a client server (if only for the duration of installation). Download credentials to your trusted admin machine via the VPN-Cubed Manager Client Packs link. SCP them into the client machines, and then SSH into the client machines to complete the configuration. b) Port 22 and Port 8000 Exception - Allow port 8000 and port 22 access as described on the previous pages to a Manager. SSH into the client machine and download the credentials from its command line using the following URL: wget --no-check-certificate Something like: wget --no-check-certificate 172_31_1_53.tar.gz NOTE: The clientpack:password combination is on the status screen of each of the VPN-Cubed Managers. 41

42 Linux Client Configuration: Install OpenVPN You can either install OpenVPN 2.1 or later on physical servers or virtual servers you already possess to connect those devices to the VPN-Cubed overlay network. For a quick test you might want to use the Elastic Server factory at You can quickly assemble a representative application stack for testing in the overlay network and easily deploy to the your Terremark account. Use the OpenVPN for VPN- Cubed 2.1 bundle in your servers for a ready-made VPN-Cubed client. You will still have to install a client pack on that device once launched locally or in the EC2 cloud, and configure the file /etc/openvpn/ vpncubed.conf. Extract clientpack contents to /etc/openvpn directory (consult OpenVPN documentation for your OS if not found). Edit the vpncubed.conf add the managers you want this client to connect to in priority at the bottom of the file: remote MANAGER_DNS_ADDRESS 1194 Use the public DNS URL of the Manager for the remote entry. In multiple Manager topologies the order of remote commands matters - client will try to connect to the first remote endpoint, if not successful - to the second, and so on. You may want to evenly distributed clients among managers by varying the order of "remote" commands on each client. 42

43 Linux Client Configuration: Launch OpenVPN Start openvpn. On Linux OSs this is done using the /etc/init.d/openvpn start command. Your client will get a virtual IP address that corresponds to the clientpack it received. WARNING: If you accidentally give the same client credentials to 2 different devices you will notice the two clients popping off and on the overlay network inside the VPN-Cubed manager Status screen. Only one device can have a set of credentials in the same topology at a time. Adjust local firewall on the client if necessary (on Linux, your tunnel device name will be tun0). Verify connectivity by pinging , (the IPs we setup for our Managers on page 15) for manager MGR1 and MGR2, respectively. Usually, the manager whose "remote" line appears first in /etc/openvpn/vpncubed.conf will be pingable first, other managers will become pingable once they learn about new client. 43

44 Windows Client Configuration: Add RDP Client Access Add RDP access to a specific Linux Client by creating a new Internet Service from the Network Tab. Click Create Service and enter the following information: - Public IP: Retrieve a new IP - Protocol: TCP - Port: Service Name: RDP Access - State: Enabled 3389 Once the Internet Service is created Add a node that is associated with the Windows server(s) you are going to configure. This service is temporary and after initial configuration, access can be revoked. 44

45 Windows Client Configuration: Install Client Credentials Allow port 8000 access as described on the previous pages to a Manager. Also, you will need RDP access to the client Windows Servers as described in previous pages. RDP into the Windows Machine using the Administrator credentials specified when launching the server. Navigate to Manager IP>:8000 in IE. Login using the default vpncubed for the password and username or the password you changed on your first login. Click Client Packs on the left menu. Download the appropriate client pack zip file to the Windows machine. 45

46 Windows Client Configuration: Install OpenVPN Install OpenVPN 2.1 or later on physical servers or virtual servers you already possess to connect those devices to the VPN-Cubed overlay network. On Vista you will need to have admin privileges to install the software. You will have to install a client pack on the Windows desktop machine and put the client pack files in \Program Files\OpenVpn\config\ RENAME vpncubed.conf to vpncubed.ovpn!!!! Edit the vpncubed.ovpn and add the managers you want this client to connect to in priority at the bottom of the file: remote MANAGER_DNS_ADDRESS 1194 Use the public DNS URL of the Manager for the remote entry. In multiple Manager topologies the order of remote commands matters - client will try to connect to the first remote endpoint, if not successful - to the second, and so on. You may want to evenly distributed clients among managers by varying the order of "remote" commands on each client. 46

47 Windows Client Configuration: Launch OpenVPN Start openvpn. On Windows XP and Vista this can be done through the Services tool or via the command line openvpn vpncubed.ovpn. On Vista if you run it from the command line you will need to know how to start a command line with administrative privileges. Details here: Alternatively, start the OpenVPN service from the Services tool. On Vista and Win2k servers OpenVPN also has a graphical tool - OpenVPN GUI. Your client will get a virtual IP address that corresponds to the clientpack it received. WARNING: If you accidentally give the same client credentials to 2 different devices you will notice the two clients popping off and on the overlay network inside the VPN-Cubed manager Status screen. Only one device can have a set of credentials in the same topology at a time. Adjust local firewall on the client if necessary. Verify connectivity by pinging or (the IPs we setup for our Managers on page 16) for manager ID1, ID2,respectively. Usually, the manager whose "remote" line appears first in /etc/openvpn/vpncubed.conf will be pingable first, other managers will become pingable once they learn about new client. 47

48 Windows Client Configuration: Launch OpenVPN 48

49 Windows Client Configuration: Windows 2008 RegEdit Consideration When setting up OpenVPN as a Service on Windows2008 there can be an issue with the machine resolving IPv6 instead of IPv4. Follow the steps below to fix the problem. 1. Go to "regedit" 2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\tcpip\parameters 3. Double-click the ArpRetryCount value, type 0, and then click OK. If it does not exist create a new REG_DWORD, rename to ArpRetryCount, and set the value to Reboot the machine 49

50 Client Configuration: Clients in the overlay network The key elements of the display to look for are the connections to that managerʼs peer, both showing the local processes are running and the link as up. You should see the clients listed in the client table at the bottom, connected to the appropriate manager. If this is not the case please check the items listed on the Troubleshooting page of this document. 50

51 VPN-Cubed Firewall Tool 51

52 VPN-Cubed Firewall VPN-Cubed Firewall is controlled using IPTables syntax. For more information - Look for PARAMETERS section and below. In general, you write a specification of a packet to match and what to do with this packet. Customer rules are applied in the middle of overall rules on the manager. If customer rules don't reject a packet, it will be allowed. Order of rules matters - rules are applied from top to bottom up to the first match. If not match is found, packet is allowed. "-j ACCEPT" allows a packet. "-j DROP" drops a packet. "-j REJECT" sends an appropriate notification to sender saying such and such packet was rejected (depends on protocol). Basic examples: * Drop all packets from to s d j DROP * Drop all traffic from /24 (entire subnet) except : -s j ACCEPT -s /24 -j DROP 52

53 Change Username and Password 53

54 Change Username and Password Username and Password can be changed via the Left Column Menu Items. 54

55 Save Manager Configuration with Runtime Snapshots 55

56 Runtime Snapshots save the Manager Configuration Once your VPN-Cubed Managers and Clients are configured and running, save the configuration with Runtime Snapshots. Snapshots can be used to reconfigure a new Manager with the same SSL Certificates and Keyset with just one file upload. Click the Runtime Snapshots link to take a new snapshot or view/ download available snapshots. Download the snapshot to your local network. In the event of a Manager failure or re-provisioning event, you can upload the snapshot file to a new VPN-Cubed Manager. The new Manager will retain all the configuration settings as your saved snapshot. If you are utilizing Elastic IPs, once the Elastic IP is transferred to the new Manager, your overlay network devices will automatically connect back with the Managers. Save time on both Manager and client configuration. 56

57 Save and Download a Snapshot Click the Take New Snapshot Now button to generate a new Snapshot. The resulting screen will have the snapshot download link. Download the Snapshot and save locally. 57

58 Upload a Snapshot To use a Snapshot to configure a Manager click the Import Runtime Snapshot link. Browse for your saved Snapshot and upload. The Manager will reboot with the updated configuration. The same client packs will be used to redistribution of the credentials to each Overlay Network Device (OLNDs) is not necessary. A slight configuration change on each OLND is necessary if you have not assigned Elastic IPs to your Manager. The OpenVPN configuration file (vpncubed.ovpn) on each OLND needs the new IP of the new Manager referenced in the remote commands section. To automate this step, you can assign an Elastic IP (see AWS billing for rates) to the Manager and reference the Elastic IP in each OLNDʼs OpenVPN configuration file. 58

59 Troubleshooting 59

60 Troubleshooting and FAQ for theec2 Managers Client appears to be hopping on and off the network. This is usually the result of the same client keys being installed on two client machines in the network. Only one client machine can use a set of credentials at a given time. Fetch Keyset appears to hang or not work. Check to see if the Internet Service setup is correct for port 8000 between the manager you are getting the keyset from and the manager you are do the fetch from. Manager IDs seem correct, EC2 security groups seem correct, but managers, especially ones launched via separate launch commands will not peer. Review your worksheet and your launch commands. Ensure that the managers were all launched with the same security token. 60

61 End 61