SonicWALL VPN with Win2K using IKE Prepared by SonicWALL, Inc. 05/01/2001

Transcription

1 Prepared by SonicWALL, Inc. 05/01/2001 Introduction: Compared to other client VPN solutions, the Microsoft VPN implementation is probably the most complex. There are many levels of menus and options that must be maneuvered and set in order to establish the client VPN. This white paper will provide a step-by-step guide to creating an MS Win2k client VPN to a SonicWALL firewall. However, this paper will assume that the reader has familiarity with SonicWALL firewall configurations and has a fundamental understanding of VPN, encryption, authentication, data integrity/hashing and key exchange. Technical Notes: - VPN was established using MS Win2k Prof. SP1 with high encryption pack and the SonicWALL Pro with firmware Although this is a client to site VPN, static IP addresses are required on both the SonicWALL and the Win2k client as per MS article Q US&SD=gn&FR=0&qry=q252735&rnk=1&src=DHCS_MSPSS_gn_SRCH&SPR=WIN Changes made to the Win2k security policy are not immediately reflected and can take up to the default 240 minutes to be recognized. The alternative is to restart the IPSEC service. - Ensure the Win2k client is running the High Encryption Pack for 3DES support: Page 1 of 15

2 Step by Step: SonicWALL Configuration 1. Using a web browser, open and login to the SonicWALL management GUI by accessing the internal LAN IP address of the SonicWALL. 2. Click on the VPN tab on the left, click on the Configure tab at top, and choose - Add New SA from the Security Association drop-down. 3. Choose IKE using pre-shared secret from the IPSec Keying Mode drop-down. 4. Enter in a unique name for the VPN tunnel in the Name box. 5. Enter the public IP address of the Win2k client in the IPSec Gateway Address box. 6. Leave the SA Life Time (secs) box at its default seconds. 7. Choose the Encrypt and Authentication (ESP DES HMAC MD5) method for the tunnel from the Encryption Method box. 8. Enter in the shared-key you have chosen for the tunnel (must be same on both sides) in the Shared Secret box. (ie vpn ). 9. Click on the Add New Network Button. This will pop up a small screen, where you will enter in the for the IP subnet Once you have done this the tunnel programming is complete. Page 2 of 15

3 Step by Step: Microsoft Win2k Professional Configuration 1. Start the Microsoft Management Console (MMC) by clicking on start run and keying in MMC. Click OK. 2. At the top of the MMC menu, click on console, add remove snap-ins, add, highlight each snap-in and click OK: IP Security Policy, Event Viewer, Services, Computer Management and Group Policy. Always select Local Computer and click finish when prompted. Click close and then OK to return to the MMC main screen. The completed MMC will appear as follows: Page 3 of 15

4 Create a rule for traffic between the Win2k Client and the SonicWALL 3. From MMC, hightlight the IP Security Policies to create the new Ipsec Security Policy. Click on Action then Create IP Security Policy. The IP Security Policy Wizard screen will appear. Click next to continue. 4. Enter a name for the IP Security Policy Name (i.e. Win2k Client VPN). Click next to continue 5. On the Requests for Secure Communications screen, uncheck Activate the default response rule. Click next. 6. Leave the Edit properties box checked on the next screen and click finish to begin adding rules. Page 4 of 15

5 Click add on your Win2k Client VPN properties screen 7. On the New Rule Properties screen, click on the IP Filter List tab and click add. 8. On the IP Filter List box, enter a descriptive name and click add. 9. On the Filter Properties screen, select My IP Address for the source, A specific IP Subnet for the Destination address. Key in the private subnet behind the SonicWALL with the appropriate subnet mask. Finally uncheck the box next to Mirror. Click OK then click close on the IP Filter List screen. Page 5 of 15

6 Select your new Win2k to SonicWALL rule. Now click on the filter action tab and click add 10. On the new filter action properties screen, click on negotiate security, accept unsecured communication and click on add. 11. On the new security method screen, click on High(ESP) and click ok. 12. Select the general tab and key in a descriptive name such as Win2k to SonicWALL and click ok. Page 6 of 15

7 13. Select your new Win2k to SonicWALL filter action. 14. Click the authentication tab and click add. On the new authentication method screen, select the use this string to protect the key exchange and key in the pre-shared secret. Click ok. 15. Now highlight the kerbeos entry and click remove and click yes when asked to confirm. 16. Select the tunnel setting tab, click on the tunnel endpoint and key in the SonicWALL wan IP address. 17. Select the connection type tab, select the Local area network and click close. Page 7 of 15

8 Create a rule for traffic between the SonicWALL and the Win2k Client 18. Your final rule will appear as shown below. Now we need to create another rule for traffic coming from the SonicWALL to the win2k client. Click add to begin. On the new rule properties screen, select the IP filter list and click add. 19. On the IP filter list name, key in a descriptive name (ie SonicWALL to Win2k) and click add. 20. Select A specific IP subnet for the Source Address, key in the LAN subnet and subnet mask behind the SonicWALL, select My IP address for the destination and finally uncheck mirror. Click OK and click close to save the IP filter list. Page 8 of 15

9 21. On the IP filter list screen, select the new SonicWALL to Win2k filter list. Now select the filter action tab and click add. 22. On the new filter action properties screen, click on negotiate security, accept unsecured communication and click on add. 23. On the new security method screen, click on High (ESP) and click ok. 24. Select the general tab and key in a descriptive name such as SonicWALL to Win2k and click ok Page 9 of 15

10 Select your new SonicWALL to Win2k filter action. 25. Click the authentication tab and click add. On the new authentication method screen, select the use this string to protect the key exchange and key in the pre-shared secret. Click OK. 26. Now highlight the kerbeos entry and click remove and click yes when asked to confirm. Page 10 of 15

11 Select the tunnel setting tab, click on the tunnel end point and key in the Win2k Client IP address. 27. Select the connection type tab, select the Local area network and click close. 28. The final policy is shown below. Now we finally have to set the phase one key exchange method. From your Win2k Client VPN properties, select the general tab, click on the advanced button on the bottom, click on methods, highlight the IKE, DES, MD5 line and move it to the top. Click ok twice and then close. Your policy is ready to be applied. Page 11 of 15

12 29. From MMC, select the new policy, right mouse click and select assign. The status will now show the policy assigned (yes). Page 12 of 15

13 Testing the VPN Starting the VPN tunnel Restart the SonicWALL From MMC, highlight services on the left and locate the IPSEC Policy Agent service. Highlight the IPSEC Policy Agent, right mouse click and then select stop. Right mouse click again and select start. You can also stop the IPSEC service from a DOS prompt. Click on start run and key in CMD. Click OK. Key in the command, net stop policyagent followed by net start policyagent From a DOS prompt ping a private IP behind the SonicWALL. You should see four Negotiating IP Security lines. Issue the ping command again and you should now see successful replies. Page 13 of 15

14 You can also verify that the SonicWALL logs display the completed IKE negotiation Page 14 of 15

15 Enable Win2k Logging Wink2k does not have logging enabled by default. If you need to troubleshoot your connection, perform the following steps to enable logging: 1. In MMC, expand the Local Computer Policy and go to Computer Configuration, Windows Settings, Security Settings, Local Policies, Audit Policy 2. Double click on Audit logon events, select Success and click OK. Repeat for Audit object access. 3. Add the registry key: hkey_local_machine\system\currentcontrolset\services\policyagent\oakley add REG_DWORD value name = EnableLogging with value of 1 The Oakley.log file is stored in winnt\debug folder Tools Ipsecmon - Click on start, run and type in ipsecmon to run. Netdiag /test:ipsec /debug install from Win2kcd in the support\tools folder. Page 15 of 15