IPSec Client/Router Whitepaper Version 1 15 2/1/2016 Systeme Helmholz GmbH Hannberger Weg 2 D-91091 Großenseebach Germany Phone +49 9135 7380-0 Fax +49 9135 7380-110 info@helmholz.de www.helmholz.com
Notes All rights reserved, including those related to the translation, reprinting, and reproduction of this whitepaper or of parts thereof. No part of this whitepaper may be reproduced, processed, duplicated, or distributed in any form (photocopy, microfilm, or any other methods), even for training purposes or with the use of electronic systems, without written approval from Systeme Helmholz GmbH. All rights reserved in the event of the granting of a patent or the registration of a utility model. We welcome all ideas and suggestions. Copyright 2015 by Systeme Helmholz GmbH Hannberger Weg 2 91091 Großenseebach Windows is a registered trademark of Microsoft Corporation.
Contents 1 General Information... 4 1.1 Information about this whitepaper... 4 1.2 Important notes regarding VPN... 4 1.3 IPSec - Client/Router connection (with wizard)... 5 2 Settings in the REX 300... 6 3 Configure, establish and end tunnel connection... 9 3.1 Establishing the connection via the connection client "client.pbk":... 9 3.2 Establishing the connection via the Windows network... 11 IPSec Client/Router Version 1 17.12.2015 3
1 General Information 1.1 Information about this whitepaper This document describes additional REX 300 functions and the settings required for them on the basis of examples. The necessary basic knowledge for dealing with the REX routers is presumed. We have checked the contents of this whitepaper to ensure that they match the hardware and software described. However, System Helmholz GmbH can assume no liability for any existing differences, as these cannot be fully ruled out. When using your purchased products, please make sure to use the latest version of the manual, which can be viewed and downloaded on the Internet at www.helmholz.de. Configuration, execution, and operating errors can interfere with the proper operation of the REX devices and result in personal injury, as well as property or environmental damage. Only adequately qualified personnel may operate the REX devices! 1.2 Important notes regarding VPN VPN connections from a client computer to a REX 300 unit functioning as a VPN server can only be established if the Internet connection is allowed to send incoming data to the REX 300 unit. In other words, if incoming data traffic is completely blocked for your Internet connection, you will not be able to establish a VPN connection to your REX 300 router. When setting up the network configuration of the REX300 and for approval of the required ports and services, please contact the responsible network administrator. IPSec is based on UDP and requires the ports 500 and 4500 as source and destination ports. The establishing of the tunnel takes place via the L2TP protocol. The VPN tunnel will then send you the data of the web interface, enabling you to work with it. The same applies if you want to use the MPI/PROFIBUS interface. When using VPN, the LAN IP address of the REX 300 must be stored in the NETLink driver (SH S7-NET) in order to access the MPI/PROFIBUS interface via VPN. Two types of encryptions can be chosen from. In the example described here, a self-generated static key is used. It is not possible to establish several simultaneous IPSec connections with an IPSec server with this predefined key. A description of the use of X.509 certificates is not a component of this documentation. IPSec Client/Router Version 1 17.12.2015 4
1.3 IPSec - Client/Router connection (with wizard) The following pages describe how you can realize an IPSec connection between a client PC and the REX 300 with the help of the integrated wizard. The instructions refer to a cable-connected REX 300 that is configured as a classic router and to an Internet-compatible Windows 7 PC. Internet WAN IP address: 217.6.86.44 IPSec IP subnet: 192.168. 0.0 /24 LAN IP address: 192.168. 0.100 Static IP address that can be accessed from the Internet at the deployment location of the REX 300 Default IP address in the delivery condition IPSec Client/Router Version 1 17.12.2015 5
2 Settings in the REX 300 The steps necessary for configuring an IPSec connection will now be described with the help of the integrated wizard. Open the REX 300 web interface in a standard browser. In this example it is presumed that the standard LAN IP address of the factory setting is active. 192.168.0.100 must consequently be entered into the address bar of the browser. The First Start page is shown following successful web interface registration: The language selection is found to the top right if needed. For the subsequent steps click the "Classic router" field. The "First Start" page is now displayed when the router is started in the delivery condition. Once selected, changing between the portal server and the classic router is only possible following a reset to factory settings. The window with the system information subsequently opens. With the top menu bar you go to "Wizard". In the explanations now described it is presumed that the WAN access to the Internet has also already been successfully configured! IPSec Client/Router Version 1 17.12.2015 6
The most important settings can be easily made with the help of a wizard. For the procedure described here it should be noted that the IPSec method has been chosen in the selection menu. Click on the "Start" button with the mouse to start the VPN wizard. Because the LAN & Internet wizards haven't been carried out yet, the following warning appears: As already noted, the correct LAN and WAN settings are presumed in this example. To this purpose put a check in the box and click on "Start". The information following subsequent to this is confirmed with "Next >". The client-router connection is selected on this page and confirmed with "Next >". IPSec Client/Router Version 1 17.12.2015 7
In this step you create a static key; numbers, letters and special characters are possible. This is also referred to as PSK (Pre-shared Key). Now click on the "Next >". button. You must now download the client file provided in this window and file it on the client PC. The dialogue can then be confirmed with "Next >". Acknowledge the following field with "Finish". The REX 300 will now apply the configuration. This process will take about 30 seconds. The previously described procedure is completed as soon as a green check appears in front of the VPN wizard in the wizard screen. IPSec Client/Router Version 1 17.12.2015 8
3 Configure, establish and end tunnel connection An IPSec connection with the REX300 can be configured and established with little effort with the client.pbk connection client you have downloaded. An alternative method for configuring and establishing an IPSec connection with the REX300 is described in the following chapter. 3.1 Establishing the connection via the connection client "client.pbk": Open the previously downloaded "client.pbk" and click on "Properties" Enter the public IP address (WAN) of the REX300 under the tab "General". In the Options, place the check for "Display status while dialing" and "Query name, password, certificate, etc.". The check for "Incorporate Windows registration domains" should not be set. Under the tab "Security", set the "VPN type" to automatic and enter your VPN keys under "Advanced settings" in the tab "L2TP" for "Use pre-installed keys for authentification. Confirm with OK. The "Data IPSec Client/Router Version 1 17.12.2015 9
encryption" should be set to "Required" or "Maximum" in order that only encoded connections are established. Under the tab "Network", remove the check for "File and printer approval and "Client for MS networks". "IPv6" can also be removed to reduce traffic. Confirm with OK to complete the configuration. Now click on "Connect " and enter your user name and your password for the REX 300. In this example, these are the standard values user name: helmholz; password: router IPSec Client/Router Version 1 17.12.2015 10
Never use the standard login data for this kind of access method. For security reasons, change the login data of the REX 300 preset at the factory in the web interface under "System/user". When you now click on "Connect", the status window for the establishing of the connection opens. Following the successful establishing of the connection, the window automatically disappears into the background. You can now, for example, reach the LAN IP address of the removed REX 300 and, for example, open the web interface with the URL: http:\\192.168.0.100. Other participants that are located in the IP range 192.168.0.0/24 and are connected on the LAN side with the REX300 can of course now also be reached. Open the "client.pbk" again and click on "Hang up" if you want to end the connection. 3.2 Establishing the connection via the Windows network A second possibility for realizing the tunnel connection will now be described in the following. IPSec Client/Router Version 1 17.12.2015 11
Open the "Network and sharing center" in the Windows "Control panel" and click there on "Set up a new connection or a new network Choose the connection option "Establish connection with the work station" Now click on "Use my Internet connection (VPN) IPSec Client/Router Version 1 17.12.2015 12
Under "Internet address", enter the public IP address (WAN) of the REX300 and assign the connection a name ("Destination name"). Activate "Don't connect now " and click "Next". Now enter your user name and your password for the REX 300. Never use the standard login data for this kind of access method. For security reasons, change the login data of the REX 300 preset at the factory in the web interface under "System/user". In this example, these are the standard values user name: helmholz; password: router Click on Create. IPSec Client/Router Version 1 17.12.2015 13
Click on "Close" to end the wizard. Now go to the network symbol in the task bar. There you will see the just created connection. Use a right click to open a menu through which you can go to "Properties". Click on "Properties" and continue to act in the following steps as with the configuration of the client.pbk described in chapter 3.1. In order to disconnect the connection again, return to the network symbol in the task bar. The "Disconnect" button is found next to the active network connection. Use this to end the connection. IPSec Client/Router Version 1 17.12.2015 14