VPN-Cubed 2.x Datacenter Connect ElasticHosts

Transcription

1 VPN-Cubed 2.x Datacenter Connect ElasticHosts v

2 Requirements You have an ElasticHosts account. You have an ElasticServer.com account (free Community Edition required) you can use to upload a VPN-Cubed Elastic Server to your ElasticHosts account. Ability to configure a client (whether desktop based or cloud based) to use OpenVPN client software. We will provide pointers and support for the major distributions. You have a compliant IPsec firewall/router networking device: - Preferred: Cisco ASA - Validated: Cisco 1800, Cisco PIX, Juniper JunOS Models, Fortigate (3 years old or less), Watchguard Firebox (3 years old or less) - Best Effort: Any IPsec device that supports: IKE1 or IKE2, AES256 or AES 128 or 3DES, SHA1 or MD5, AND NAT-Traversal - Will Not Work: Checkpoint (contact support@cohesiveft.com for more information) 2

3 Getting Help with VPN-Cubed This guide uses Cisco s Adaptive Security Device Manager UI. Setting up your IPsec Extranet device may have a different user experience than what is shown here. All the information entered in this guide will be same regardless of your UI or cmd line setup. Please send all support inquiries to: support@cohesiveft.com 3

4 Your Configuration Begins Here! 4

5 Firewall Considerations VPN-Cubed Manager instance uses the following TCP and UDP ports. - UDP 1194 For client VPN connections; must be accessible from all servers that will join VPN-Cubed topology as clients. - UDP For tunnels between manager peers; must be accessible from all peers in a given topology. - TCP 8000 HTTPS admin interface; must be accessible from hosts where you will want to obtain runtime status or configure peering, also needs to be open to and from the managers at least for the peering process, and needs to be accessible when downloading credentials for installation on overlay network clients. - UDP 500 and 4500 These ports are used for IPsec NAT-TRAVERSAL and need to be configured in your IPsec device. 5

6 Remote Support Note that TCP 22 (ssh) is not required for normal operations. Each VPN-Cubed Manager is running a restricted SSH daemon, with access limited only to CohesiveFT for debugging purposes controlled by the user via the Remote Support toggle and key exchange generation. In the event CohesiveFT needs to observe runtime state of a VPN-Cubed Manager in response to a tech support request, we will ask you to open Security Group access to SSH from our support IP range and Enable Remote Support via the Web UI. CohesiveFT will send you an encrypted passphrase to generate a private key used by CohesiveFT Support staff to access your Manager. Access to the restricted SSH daemon is completely controlled by the user. Once the support ticket has been closed you can disable remote support access. 6

7 ElasticHosts Internet Traffic Consideration All traffic transferred via an ElasticHosts Image s public IP address is charged data transfer fees as detailed on the ElasticHosts Cloud Computing Pricing Page. This is the default configuration detailed in this document. VPN-Cubed can be configured to use an ElasticHosts VLAN where traffic transferred between IP addresses on private network VLANs are not charged. If you are interested in configuring your VPN-Cubed topology to use the ElasticHosts VLAN, contact us at support@cohesiveft.com. VLAN configuration will require CohesiveFT to log into your VPN- Cubed Manager and assign the Manager a VLAN address of your choice. 7

8 Signup for an Elastic Server Community Edition Account VPN-Cubed Manager Images for use in the ElasticHosts cloud environment are built individually and deployed to your ElasticHosts account endpoint via Elastic Server Image Factory. In order to build and deploy a VPN-Cubed Manager appliance to the ElasticHosts cloud you will need to signup for a free Community Edition account on ElasticServer.com. Navigate to elasticserver.com/signup. Enter an address, username, password and optionally a signup code if you have been provided one by CohesiveFT. Read and Accept the Terms of Service. Click Sign up. 8

9 Setup your ElasticHosts Credentials in the Elastic Server Cloud Manager Elastic Server factory allows users to include cloud account access information so Elastic Server builds can be deployed directly to user accounts in ElasticHosts, AWS EC2, Private Eucalyptus, Flexiant Extility, Cloud Sigma and many vcloud Express environments. Click Clouds in the secondary top menu bar. Click Add cloud credentials. Enter a name for the credentials. Enter the UUID that corresponds to your EH account (found on the profile page at ElasticHosts). Enter the Secret API Key that corresponds to your EH account (found on the profile page at ElasticHosts). Select the Endpoint that corresponds to your EH account. Click Save Credentials. 9

10 Temporarily Share your ElasticHosts Credentials with CFT In order to get a VPN-Cubed Image deployed to your ElasticHosts account, you will need to share your credentials (view only) with CohesiveFT. From the Cloud Credentials Page click Settings & Sharing under your newly created ElasticHosts Cloud listing. Under the Sharing Section click Share with someone. Enter ElasticHostsVPN3 in the Share by username field. Setup the Permission to be view-only and cannot re-share. This will ensure we have not access to your account other than to upload the VPN-Cubed Image. Be sure to check the notify by box so CohesiveFT is alerted when you share your account. Builds and Uploads typically take between minutes. When the upload is completed CohesiveFT will contact you and remind you to revoke the sharing permissions. 10

11 Launching VPN-Cubed Manager(s) Navigate to your ElasticHosts Control Panel. The VPN-Cubed Manager Server (powered off), VPN-Cubed Manager Drive, and a Swap Drive will be available. Click Start next to the VPN-Cubed Server. Give the Server a few minutes to boot then use the IP address listed to access the GUI. 11

12 Logging in and Configuring the Manager Login to the VPN-Cubed Web UI - In order to have an encrypted connection to the VPN-Cubed Manager, the web UI uses HTTPS with a self-signed certificate generated on each manager individually on boot. You may need to add a security exception in your browser. Log in using vpncubed as both the username and password. Three Configuration Options: - Upload License (choose this when launching the first Manager of a Customer Cloudlet) - Launch a new Manager using the default subnet or use a custom subnet. - Upload runtime snapshot (choose this when recovering from a Manager failure) - Launch a copy of an old manager using a locally stored snapshot to retain old client packs. - Fetch remote configuration (choose this when launching a second Manager of a Customer Cloudlet) - Launch a copy of an existing manager by grabbing configuration live. 12

13 Logging in and Configuring the Manager Option 1: Upload License Paste the encrypted VPN-Cubed license received from CohesiveFT in the first field. This license will configure the generic Manager. Enter a security token in the second field. This can be anything but must be the same for all Managers in the same topology. Click Submit and Reboot. The resulting screen allows you to choose between the subnet range that comes preconfigured with the license or a customer subnet defined by your specific topo needs. Click the Custom Radio button to specify a custom subnet range. In addition to selecting a custom subnet range you can specify linear addressing for your Overlay Connected Devices (OLNDs). In this example we use /24 for our custom subnet range. The Manager IPs are and the Overlay Connected Device IPs are Your specific license might allow for more or less OLNDs. Once you complete this step, the manager instance will reboot itself and will come up with your specified topology enabled and running. Click Submit and reboot. Skip to page

14 Logging in and Configuring the Manager Option 2: Upload runtime snapshot If this manager is a replacement for another manager in an existing topology and you have a recent runtime snapshot from the old manager, you can instantiate the manager by uploading the snapshot. Uploading a snapshot will configure the new Manager the same as the old including using the same Client Packs for the connected Overlay Network Devices. Once you have selected a locally stored snapshot, click Submit and reboot. Skip to page

15 Logging in and Configuring the Manager Option 3: Fetch remote configuration Fetching remote configurations can speed the configuration of Managers you wish to Peer to an existing topology. Specify the IP address of the Manager from where you would like to fetch configuration. The security token is used for negotiation between Manager peers and must be the same for all Managers you intend to Peer with one another. Click Submit and reboot. 15

16 Generate Keys on VPN-Cubed Manager The Manager is now configured to the License specs (how many managers it can peer with, how many clientpacks are available, and how many ipsec links are available). Click Generate New under SSL Certs and Keys in the left column. Click Generate keys link. Key generator will be started in the background, and you can refresh screen to observe progress. This process will generate the client credentials that will be loaded onto the devices you wish to connect to the VPN-Cubed overlay network. NOTE: The Client Packs generated will depend on your license and if you selected to a custom subnet. 16

17 Peering the Managers: Peering Manager 1 Click Setup Manager Peering Managers connect to each other in a process called Peering. Peered Managers create a redundant, highly available and secure overlay network and share traffic load from the overlay network connected servers. The Peering Setup Page will display the number of Managers allowed to peer together in your topology as defined by the license file used to configure the Manager. For Manager #1 select "this instance" from drop down, instead of specifying its IP. To be valid, your form must have "this instance" value in one and only one drop-down. If your topology has unused Managers, leave the extra fields set to "not set. If you are running a single Manager topology skip to page 20. Enter the Public IP or Public DNS address of the second Manager for Manager #2. Repeat this for each additional Manager in your topology. When done select Save Changes. You should then get a status page showing that this manager was able to reach the other launched manager instance. 17

18 Peering the Managers: Peering Manager 2, fetch the keyset from Manager 1 (do NOT regenerate) Skip to page 20 if you have a single Manager topology. Log in to VPN-Cubed Manager UI on the second manager. Click Fetch Keyset. (Remember that keys must be generated only once per topology!) Type in private IP address of Manager1 (where keys were generated) and keys will be copied from Manager1 and set up locally. 18

19 Peering the Managers: Peering Manager 2 For Manager #1 enter the IP address of MGR1 For Manager #2 select "this instance" from drop down, instead of specifying its IP. To be valid, your form must have "this instance" value in one and only one dropdown. When done select Save Changes. You should then get a status page showing that this manager was able to reach the other launched manager instances. Verify that topology checksum on Manager1 corresponds to that of Manager2. 19

20 VPN-Cubed Manager Status The VPN-Cubed Manager is ready to setup an IPsec Tunnel. You should see all your peered Managers listed under the Links to Other Managers section on each Manager Runtime Status Page. Click IPsec under Peering left menu heading. On the resulting IPsec page note the Configuration Settings needed for configuration. Click Define new remote endpoint. 20

21 VPN-Cubed Manager Setup: Define a New Remote Enpoint Enter descriptive name for the Endpoint configuration, this can be anything. Occasionally there is another router between the IPsec firewall and the Internet. Enter the public facing IP address of either the IPsec device or router between ElasticHosts and the IPsec device (see picture below). Enter a Pre-shared Key and keep a record of that key to be entered into the IPsec device. In this example we use VPNCubedRocks for obvious reasons. If your IPsec device is behind a router, enter the external IP interface of the IPsec device (see picture below). Click Create. One the resulting page click New subnet. Exta Config Parameters: We recommend connecting to the Manager with tunnels using AES256 encryption and SHA authentication for both IKE and ESP. Add the lines shown to the right - ike=aes256-sha1 and esp=aes256- sha1. For other tunnel configuration contact support@cohesiveft.com for assistance. 21

22 IPsec Configuration: Extra Parameters VPN-Cubed's IPSec subsystem is good at autodiscovery on IKE and ESP choices with a wide range of boxes. We recommend being as specific as possible when entering tunnel parameters. Match the algorithm, hash and DiffieH group for your gateway settings by specifying them in the "Extra Params" text field. We support combinations algorithms 3DES, AES128, or AES256; hashes SHA1 or MD5; and DH groups 2 or 5 (which are represented by the software we use as "modp1024" and "modp1536" respectively). Example entries for IKE (Phase 1) and ESP (Phase 2) in the extra params box: ike=aes128-sha1 ike=aes256-sha1 ike=3des-md5-modp1024 ike=aes256-sha1-modp1536 phase2alg=aes256-sha1 phase2alg=3des-sha1; modp1536 (the "modpxxxx" value can only be added to phase2alg={value of esp} with a semi-colon as show above.) PFS Group Extra params entry for PFS Group is technically required only when it must be diff from pfs group in phase1. If that is the case, then use phase2alg={value of esp};modpxxxx IKE and ESP Lifetimes ikelifetime=3600s (default setting on VPN-Cubed) salifetime=28800s (default setting on VPN-Cubed) Dead Peer Detection - Disabled by default, to enable DPD to attempt to re-connect during periods of no response use the following: dpdaction=restart dpddelay=30 dpdtimeout=90 22 Copyright CohesiveFT

23 VPN-Cubed Manager Setup: Setup a Subnet Enter the subnet this is or will be configured behind the datacenter IPsec Extranet Device. In this example we used /24 for our datacenter remote subnet. Click Create. Your VPN-Cubed Manager IPsec setup is complete. The next steps will detail setting the IPsec connection from your extranet device. Once the IPsec connection is live, this guide will detail how to add clients to the created overlay network. Note the Configuration Settings values, you will need these to correctly configure your extranet device. 23

24 Configuring the IPsec Extranet Device: Adding Network Objects Note: As mentioned earlier these screenshots are from a Cisco ASA extranet device. Your setup user experience may differ slightly. The first step in configuring any IPsec extranet device is to add the appropriate Network Objects. The screenshot to the right shows all the objects that need to be added. Their details are below: - eh_inside: inside NAT of your ElasticHosts Overlay Subnet - inside-network: inside interface network of extranet device - inside_network_test_client: initial inside test IP for IPsec connectivity - outside_network: outside interface network of extranet device - outsideinterface: address of outside interface of extranet device - vpncubed_mgr: public IP address of the VPN-Cubed Manager 24

25 Configuring the IPsec Extranet Device: VPN Wizard Create a new VPN Tunnel. The Cisco ASA used in this guide does this through a VPN Wizard. If you are using another facility to create your IPsec Tunnel, make sure to enter the same information we enter in the following slides. Choose a Site-to-Site Tunnel Type. Click Next Tunnel Configuration Considerations If you want the tunnel to be perpetual and as close to "always on" as IPSec can do, then: - Your gateway should be using its "keepalive" feature, VPN-Cubed has this enabled by default - Your gateway should be using Dead Peer Detection (DPD) with a "restart" parameter in the event it believes tunnel is dropped - Your VPN-Cubed manager has DPD disabled by default, to enable DPD see page 21 for the extra parameters box entries. - Your gateway should allow the VPN-Cubed manager to make a connection "inbound to it", by default the VPN-Cubed manager allows inbound connections and attempts outbound 25

26 Configuring the IPsec Extranet Device: VPN Wizard Enter the VPN-Cubed Managerʼs IP address in the Peer IP Address field. Enter the same Pre-Shared Key entered from page 20 (our example used VPNCubedRocks ). Click Next 26

27 Configuring the IPsec Extranet Device: VPN Wizard Choose your Key Exchange Policy (IKE). Make sure it is the same as the one used in the VPN-Cubed Manager setup. On page 20 we used AES-256. Click Next 27

28 Configuring the IPsec Extranet Device: VPN Wizard Select the ecryption and authentication algos for the Encapsulating Security Payload (ESP). Make sure it is the same as the one used in the VPN-Cubed Manager setup. Again our recommended setup uses AES-256 from page 20. Click Next 28

29 Configuring the IPsec Extranet Device: VPN Wizard Setting up Hosts and Networks. The following information will setup a test tunnel to your VPN-Cubed Manager. After the tunnel is up and running you can return to this step and change the Source and Destination information to open up more traffic between your IPsec extranet device and the cloud. Setup a connection using inside-network as the Source and eh_inside as the Destination. Click Next. 29

30 Configuring the IPsec Extranet Device: VPN Wizard Double check that all the information is entered correctly. Click Finish. 30

31 IPsec Extranet Device: Session Details Make sure the IPsec VPN session is up and running. Goto Monitoring > VPN Statistics > Sessions You should be able to see the session under LAN-to-LAN Click Details. 31

32 IPsec Extranet Device: Session Details The Session Details will give you expanded information about your Key Exchange and IPsec status. 32

33 VPN-Cubed Manager: Check the IPsec Status To check the status of your IPsec connection from the VPN-Cubed Manager click on Runtime Status. Your should see a detected IPsec tunnel under IPsec status. If you do not see your IPsec Tunnel listed, it is not correctly configured. Double check that you have entered all the information correctly in both the VPN-Cubed Manager and your IPsec device. If you are having difficulties please support@cohesiveft.com. Now that the IPsec Tunnel is up and running, cloud-based clients can be added to the secure Overlay Network extension of your Datacenter. 33

34 Client Configuration: Install Client Credentials In the context of VPN-Cubed, client means devices which will be configured as members of the overlay network. These network members will usually be servers running in ElasticHosts cloud environment. In more advanced editions of VPN-Cubed this includes desktop based client machines. Note the Client Download username and password on Status screen on every manager (username is clientpack ). On any Manager go to Client Packs and pick a client pack. A client pack can run on a single client at a time. If you shut down or disconnect client from the topology, you can reuse its client pack. The number of clientpacks your manager generates is tied to the license your received from CohesiveFT. 34

35 Client Configuration For Linux Clients Configuration follow the steps on pages For Windows Clients Configuration follow the steps on page

36 Linux Client Configuration: Install Client Credentials TWO PHILOSOPHIES FOR INSTALLATION a) SSH Only - Have ssh access into a client server (if only for the duration of installation). Download credentials to your trusted admin machine via the VPN-Cubed Manager Client Packs link. SCP them into the client machines, and then SSH into the client machines to complete the configuration. b) Port 22 and Port 8000 Exception - SSH into the client machine and download the credentials from its command line using the following URL: wget --no-check-certificate Something like: wget --no-check-certificate 172_31_1_53.tar.gz NOTE: The clientpack:password combination is on the status screen of each of the VPN-Cubed Managers. 36

37 Linux Client Configuration: Install OpenVPN You can either install OpenVPN 2.1 or later on physical servers or virtual servers you already possess to connect those devices to the VPN-Cubed overlay network. For a quick test you might want to use the Elastic Server factory at You can quickly assemble a representative application stack for testing in the overlay network and easily deploy to the your ElasticHosts account. Use the OpenVPN for VPN-Cubed 2.1 bundle in your servers for a ready-made VPN-Cubed client. You will still have to install a client pack on that device once launched locally or in the cloud, and configure the file /etc/openvpn/ vpncubed.conf. Extract clientpack contents to /etc/openvpn directory (consult OpenVPN documentation for your OS if not found). Edit the vpncubed.conf add the managers you want this client to connect to in priority at the bottom of the file: remote MANAGER_IP_ADDRESS 1194 In multiple Manager topologies the order of remote commands matters - client will try to connect to the first remote endpoint, if not successful - to the second, and so on. You may want to evenly distributed clients among managers by varying the order of "remote" commands on each client. 37

38 Linux Client Configuration: Launch OpenVPN Start openvpn. On Linux OSs this is done using the /etc/init.d/openvpn start command. Your client will get a virtual IP address that corresponds to the clientpack it received. WARNING: If you accidentally give the same client credentials to 2 different devices you will notice the two clients popping off and on the overlay network inside the VPN-Cubed manager Status screen. Only one device can have a set of credentials in the same topology at a time. Adjust local firewall on the client if necessary (on Linux, your tunnel device name will be tun0). Verify connectivity by pinging Managerʼs Overlay Network IP address displayed on the Runtime Status screen. In multiple Manager topologies, the manager whose "remote" line appears first in /etc/openvpn/vpncubed.conf will be pingable first, other managers will become pingable once they learn about new client. 38

39 Windows Client Configuration: Install Client Credentials RDP into the Windows Machine using the Administrator credentials specified when launching the server. Navigate to Manager IP>:8000 in IE. Login using the default vpncubed for the password and username or the password you changed on your first login. Click Client Packs on the left menu. Download the appropriate client pack zip file to the Windows machine. 39

40 Windows Client Configuration: Install OpenVPN You can either install OpenVPN on physical servers or virtual servers you already possess to connect those devices to the VPN-Cubed overlay network. On Vista you will need to have admin privileges to install the software. You will have to install a client pack on the Windows desktop machine and put the client pack files in \Program Files\Openvpn\config\ RENAME vpncubed.conf to vpncubed.ovpn!!!! Edit the vpncubed.ovpn and add the managers you want this client to connect to in priority at the bottom of the file: remote MANAGER_IP_ADDRESS 1194 In multiple Manager topologies the order of remote commands matters - client will try to connect to the first remote endpoint, if not successful - to the second, and so on. You may want to evenly distributed clients among managers by varying the order of "remote" commands on each client. 40

41 Windows Client Configuration: Launch OpenVPN Start openvpn. On Windows XP and Vista this can be done through the Services tool or via the command line openvpn vpncubed.ovpn. On Vista if you run it from the command line you will need to know how to start a command line with administrative privileges. Details here: Alternatively, start the OpenVPN service from the Services tool. On Vista and Win2k servers OpenVPN also has a graphical tool - OpenVPN GUI. Your client will get a virtual IP address that corresponds to the clientpack it received. WARNING: If you accidentally give the same client credentials to 2 different devices you will notice the two clients popping off and on the overlay network inside the VPN-Cubed manager Status screen. Only one device can have a set of credentials in the same topology at a time. Adjust local firewall on the client if necessary. Verify connectivity by pinging Managerʼs Overlay Network IP address displayed on the Runtime Status screen. In multiple Manager topologies, the manager whose "remote" line appears first in /etc/openvpn/vpncubed.conf will be pingable first, other managers will become pingable once they learn about new client. 41

42 Windows Client Configuration: Launch OpenVPN 42

43 Windows Client Configuration: Windows 2008 RegEdit Consideration When setting up OpenVPN as a Service on Windows2008 there can be an issue with the machine resolving IPv6 instead of IPv4. Follow the steps below to fix the problem. 1. Go to "regedit" 2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\tcpip\parameters 3. Double-click the ArpRetryCount value, type 0, and then click OK. If it does not exist create a new REG_DWORD, rename to ArpRetryCount, and set the value to Reboot the machine 43

44 Client Configuration: 3 clients in the overlay network The key elements of the display to look for are the connections to that managerʼs peer, both showing the local processes are running and the link as up. You should see the clients listed in the client table at the bottom, connected to the appropriate manager. If this is not the case please check the items listed on the Troubleshooting page of this document. 44

45 Save Manager Configuration with Runtime Snapshots 45

46 Runtime Snapshots save the Manager Configuration Once your VPN-Cubed Managers and Clients are configured and running, save the configuration with Runtime Snapshots. Snapshots can be used to reconfigure a new Manager with the same SSL Certificates and Keyset with just one file upload. Click the Runtime Snapshots link to take a new snapshot or view/ download available snapshots. Download the snapshot to your local network. In the event of a Manager failure or re-provisioning event, you can upload the snapshot file to a new VPN-Cubed Manager. The new Manager will retain all the configuration settings as your saved snapshot. If you are utilizing Elastic IPs, once the Elastic IP is transferred to the new Manager, your overlay network devices will automatically connect back with the Managers. Save time on both Manager and client configuration. 46

47 Save and Download a Snapshot Click the Take New Snapshot Now button to generate a new Snapshot. The resulting screen will have the snapshot download link. Download the Snapshot and save locally. 47

48 Upload a Snapshot To use a Snapshot to configure a Manager click the Import Runtime Snapshot link. Browse for your saved Snapshot and upload. The Manager will reboot with the updated configuration. The same client packs will be used to redistribution of the credentials to each Overlay Network Device (OLNDs) is not necessary. A slight configuration change on each OLND is necessary if you have not assigned Elastic IPs to your Manager. The OpenVPN configuration file (vpncubed.ovpn) on each OLND needs the new IP of the new Manager referenced in the remote commands section. To automate this step, you can assign an Elastic IP (see AWS billing for rates) to the Manager and reference the Elastic IP in each OLNDʼs OpenVPN configuration file. 48

49 End 49