Allied Telesis VPN User manual

C613-16004-00 REV D www.alliedtelesis.com

AlliedWareTM OS

How To |

Introduction

This document describes how to provide secure remote access through IP security (IPSec)

Virtual Private Networks (VPN).

This VPN solution is suitable for any business deployment and provides your office with

secure internet access and firewall protection, plus remote encrypted VPN access for staff

who work from home.

You should use the companion Note How To Create A VPN Between An Allied Telesis Router And

A Microsoft Windows 2000 Client, Over NAT-T instead, if:

zthe Allied Telesis router is connected to the Internet through a NAT gateway device, such

as an ADSL modem, and/or

zyou want to let travelling staff connect to your office from such places as hotel rooms.

This companion How To Note is available from www.alliedtelesis.com/resources/literature/

howto.aspx.

Consider the following typical scenario:

You are the manager of a small business and you have purchased an AR4

5S for your small

office premises. You have five PCs networked together with a server in your office. You

intend to use your AR4

5S as your Internet gateway and for it to provide firewall protection.

You also have people who sometimes work from home. You would like these staff members

to have secure (encrypted) remote access through the Internet to the servers in your office,

to allow them to access files, the private Intranet, and business email.

Each staff member has a laptop or PC with Windows 2000 installed.

1. Internet Explorer and Windows are registered trademarks of Microsoft Corporation in the United States and other countries.

Create a VPN between an Allied Telesis Router

and a Microsoft Windows 2000

Client, Without

Using NAT-T

Which products and releases does it apply to? >

Page 2 | AlliedWare™ OS How To Note: VPNs with Windows 2000 clients, without NAT-T

This document describes how to configure the Windows system to use IPSec VPN to connect

to your office through the AR4

5S router.

When your staff want to connect to the office they simply use the VPN icon on their desktop to

initiate the IPSec VPN connection.

Which products and releases does it apply to?

The following Allied Telesis routers are most suitable as VPN gateways because they have fast

hardware encryption support and high performance:

zAR4

5S, AR44xS series, and AR450S

zAR750S and AR770S

The AR4

5S achieves up to 90 Mbps throughput with 3DES or AES encryption.

You can also use older routers as VPN gateways, but they will not have as high performance. The

older routers depend on either the Encryption Mini Accelerator Card (EMAC) or the

Encryption PCI Accelerator Card (EPAC) to perform encryption. They include:

zAR725, AR745, AR720 and AR740 routers

zAR4

0 series routers

zAR300 series routers

Finally, you can also use the Rapier 24 and Rapier 24iswitches as VPN gateways, but this is

usually not a recommended practice. Doing so means you will lose wire-speed switching of data,

because all traffic needs to be inspected by the firewall and IPSec at CPU processing speed.

Encryption algorithms such as 3DES and AES require a feature licence. This is included on some

models. See your Allied Telesis representative for more information.

The configuration is supported on all AlliedWare versions since 2.3.

and was tested using a PC

running Microsoft Windows 2000 Professional, Service Pack 4.

Related How To Notes

Allied Telesis offers How To Notes with a wide range of VPN solutions, from quick and simple

solutions for connecting home and remote offices, to advanced multi-feature setups. Notes also

describe how to create a VPN between an Allied Telesis router and equipment from a number of

other vendors.

For a complete list of VPN How To Notes, see the Overview of VPN Solutions in How To Notes in

the How To Library at www.alliedtelesis.com/resources/literature/howto.aspx.

The collection includes Notes that describe how to interoperate with Windows 2000, XP and

Vista clients.

Security issue >

Page 3 | AlliedWare™ OS How To Note: VPNs with Windows 2000 clients, without NAT-T

Security issue

Since this Windows VPN solution is usually used to allow remote access into corporate

networks, a common security concern is “what happens if the remote laptop or PC is stolen or

falls into unauthorised hands?” This is particularly a concern because the VPN connection is

enabled through the standard dial-up networking window that allows username and passwords

to be saved.

A solution to this security concern is to disable the standard behaviour that allows passwords to

be saved. VPN users will then have to enter their password each time they connect.

If you would like to implement this security measure, refer to Microsoft Knowledge Base article

72430 by following this link: support.microsoft.com/default.aspx?scid=

72430.

This solution works on both Windows 2000 and Windows XP.

Example network

The following figure shows an example of a network that could use this configuration.

Office PCs

Office

Windows 2000 Professional

office’s public

IP address

dial-up modem

cable modem

2 MB pipe

DSL

VPN router

Internet

remote

teleworker

remote

teleworker

remote

teleworker

remote

teleworker

remote

teleworker

network.eps

Configuring the router > Perform initial security configuration on the router

Page 4 | AlliedWare™ OS How To Note: VPNs with Windows 2000 clients, without NAT-T

Configuring the router

This section contains a script file for running IPSec encapsulating L2TP on a Head Office AR400

series router, configured to support IPSec remote PC clients.

Using this script involves the following steps:

1. "Perform initial security configuration on the router", on this page.

2. Make a copy the script, which starts on page 5. Name it (for example) vpn.cfg.

3. Personalise IP addresses, passwords etc in the script, so that they apply to your network.

Placeholders for these are indicated in the script by text within < >.

4. Load the script onto the router using ZMODEM or TFTP.

5. "Set the router to use the configuration" on page 7.

6. Restart the router or activate the script.

Perform initial security configuration on the router

Before loading the configuration, you need to do the following steps.

1. Define a security officer.

add user=secoff password=<your-password> priv=securityofficer

This command must be in the configuration script as well.

2. Enable system security. Unless you do this, rebooting the router destroys encryption keys.

enable system security

3. Log in as the security officer.

4. Generate a random key.

create enco key=1 type=general value=<alphanumeric-string>

Note the value of the string you have entered so that you can load it on the PC clients. This

shared key will be used to encrypt ISAKMP negotiation.

Configuring the router > The configuration script

Page 5 | AlliedWare™ OS How To Note: VPNs with Windows 2000 clients, without NAT-T

The configuration script

Note: Comments are indicated in the script below using the # symbol.

Placeholders for IP addresses, passwords, etc are indicated by text within < >

set system name=”IPSec Gateway”

# The command below shows the Security Officer inactive timeout delay.

# The default is 60 seconds. During setup you can instead use 600

# seconds if desired.

set user securedelay=600

# The incoming L2TP calls will be CHAP authenticated.

# They may be authenticated against the router's user database as

# configured below, or against a RADIUS Server if configured.

add user=dialin1 pass=friend1 login=no

add user=dialin2 pass=friend2 login=no

add user=dialin3 pass=friend3 login=no

add user=dialin4 pass=friend4 login=no

add user=secoff pass=<your-password> priv=securityOfficer login=yes

set user=secoff description=”Security Officer Account”

# If RADIUS server support is needed, use a line such as this:

# add radius server=<your-RADIUS-server-address> secret=<secret-key>

# All dynamic incoming L2TP calls will associate with this PPP template

# as indicated below.

create ppp template=1 bap=off ippool="ip" authentication=chap echo=10

lqr=off

# To cater for dynamic creation of incoming L2TP calls enter the

# following commands.

enable l2tp

enable l2tp server=both

add l2tp ip=1.1.1.1-255.255.255.254 ppptemplate=1

# The IP address allows for any valid Internet address.

enable ip

add ip int=vlan1 ip=<office-private-LAN-address>

add ip int=eth0 ip=<office-Internet-address> mask=<appropriate-mask>

# The default route to the Internet.

add ip route=0.0.0.0 mask=0.0.0.0 int=eth0

next=<your-Internet-gateway-or-ISP-next-hop-address>

# The IP pool addresses are the internal address ranges you want to

# allocate to your IPSec remote PC clients

# (e.g. ip=192.168.8.1-192.168.8.254).

create ip pool=ip ip=<pool-range>

Configuring the router > The configuration script

Page 6 | AlliedWare™ OS How To Note: VPNs with Windows 2000 clients, without NAT-T

# Firewall

enable fire

create fire poli=main

create fire poli=main dy=dynamic

add fire poli=main dy=dynamic user=ANY

add fire poli=main int=vlan1 type=private

# Dynamic private interfaces are accepted from L2TP, which are from

# IPSec only.

add fire poli=main int=dyn-dynamic type=private

add fire poli=main int=eth0 type=public

# The firewall allows for internally generated access to the Internet

# through the following NAT definition.

add fire poli=main nat=enhanced int=vlan1 gblint=eth0

# This NAT definition allows Internet access for remote VPN users by

# providing address translation.

add fire poli=main nat=enhanced int=dyn-dynamic gblint=eth0

add fire poli=main rule=1 int=eth0 action=allow prot=udp

ip=<office-Internet-address> port=500

gblip=<office-Internet-address> gblpo=500

# Rule 2 becomes the L2TP tunnel allow rule. Additional security is

# provided by only allowing traffic from IPSec tunnels.

add fire poli=main rule=2 int=eth0 action=allow prot=udp

ip=<office-Internet-address> port=1701

gblip=<office-Internet-address> gblpo=1701 encap=ipsec

create ipsec sas=1 key=isakmp prot=esp encalg=3desouter hashalg=sha

mode=transport

create ipsec sas=2 key=isakmp prot=esp encalg=3desouter hashalg=md5

mode=transport

create ipsec sas=3 key=isakmp prot=esp encalg=des hashalg=sha

mode=transport

create ipsec sas=4 key=isakmp prot=esp encalg=des hashalg=md5

mode=transport

# The ORDER of proposals is important. You should propose the strongest

# encryption first.

create ipsec bundle=1 key=isakmp string=”1 or 2 or 3 or 4”

create ipsec policy=isakmp int=eth0 action=permit lport=500 rport=500

# This is a generic IPSec policy that multiple IPSec remote PC clients

# can connect through.

create ipsec policy=to_HQ int=eth0 action=ipsec key=isakmp bundle=1

peer=any isa=keys

set ipsec policy=to_HQ transport=udp rport=1701

# The following policy allows for internally generated Internet access.

create ipsec policy=Internet int=eth0 act=permit

enable ipsec

create isakmp policy=keys peer=any key=1

set isakmp policy=keys sendd=true

enable isakmp

Configuring the router > Set the router to use the configuration

Page 7 | AlliedWare™ OS How To Note: VPNs with Windows 2000 clients, without NAT-T

Set the router to use the configuration

After loading the configuration onto the switch, set the router to use the script after a reboot. If

you named the script vpn.cfg, enter the command:

set conf=vpn.cfg

If you entered the configuration directly into the command line instead of loading the script, save

the configuration by entering the commands:

create conf=vpn.cfg

set conf=vpn.cfg

Configuring the VPN client > Add a new registry entry

Page 8 | AlliedWare™ OS How To Note: VPNs with Windows 2000 clients, without NAT-T

Configuring the VPN client

Configuring the Windows 2000 VPN client involves the following stages:

z"Add a new registry entry", on this page

z"Add the IP Security Policy Management snap-in" on page 9

z"Create an IP Security Policy" on page 11

z"Create an IP Security Rule" on page 13

z"Create an IP Filter" on page 16

z"Configure the connection" on page 23

Add a new registry entry

To ensure compatibility, you need to make a change to the registry. This Windows registry

change allows the Windows client to bypass the default encryption scheme, and allows for user

defined encryption parameters, or no encryption.

1. On your desktop, select Start > Run and enter the following command:

regedit

Then click OK.

This opens the Registry Editor.

2. In the Registry Editor, browse to the following folder:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters

3. Right-click on this folder and select New > DWORD Value. This creates a new entry.

4. Name the new entry “ProhibitIpSec”.

5. Double-click on the ProhibitIpSec entry. This opens a dialog box with the entry’s settings.

6. In the Value data field, enter

. Click OK.

7. Restart Windows 2000 so that the changes take effect.

Configuring the VPN client > Add the IP Security Policy Management snap-in

Page 9 | AlliedWare™ OS How To Note: VPNs with Windows 2000 clients, without NAT-T

Add the IP Security Policy Management snap-in

Note: You need to know the public IP address for the router from your Internet Service

Provider (ISP) for this configuration.

This example assumes that you have already set up your internet connection.

1. On your desktop, select Start > Run and enter the following command:

mmc

This opens the Console window, as shown in the following figure.

2. Select Console Root > Add/Remove Snap-In.

This opens the Add/Remove Snap-in window, as shown in the following figure.

Configuring the VPN client > Add the IP Security Policy Management snap-in

Page 10 | AlliedWare™ OS How To Note: VPNs with Windows 2000 clients, without NAT-T

3. Click Add.

This opens the Add Standalone Snap-In window.

Scroll down the list of Available Standalone Snap-ins and select IP Security Policy Management, as

shown in the following figure.

4. Click Add.

This opens the Select Computer window, which lets you select the computer or domain that

the snap-in will manage. Select Local computer, as shown in the following figure.

5. Click Finish, then Close, then OK, to return to the Console window.

Table of contents

Other Allied Telesis Network Router manuals

Allied Telesis

Allied Telesis AT-GS900/8 User manual

Allied Telesis

Allied Telesis AT-AR415S User manual

Allied Telesis

Allied Telesis AR745 User manual

Allied Telesis

Allied Telesis AR400 Series Installation and operating manual

Allied Telesis

Allied Telesis AT FS708LE AT-FS708LE AT-FS708LE User manual

Allied Telesis

Allied Telesis AT-GS950/8 User manual

Allied Telesis

Allied Telesis AT-GS950/16 User manual

Allied Telesis

Allied Telesis AT-FS705LE User manual

Allied Telesis

Allied Telesis AT-8000GS/24 User manual

Allied Telesis

Allied Telesis WebSmart AT-FS750/16 User manual

Allied Telesis

Allied Telesis Formula 8200 User manual

Allied Telesis

Allied Telesis AT-GS950/8 User manual

Allied Telesis

Allied Telesis AR750S-DP Installation and operating manual

Allied Telesis

Allied Telesis AT-8000S/24 User manual

Allied Telesis

Allied Telesis AR100 series User manual

Allied Telesis

Allied Telesis AR400 Series Original instructions

Allied Telesis

Allied Telesis AT-8550/SP Series User manual

Allied Telesis

Allied Telesis AT-x230-10GT User manual

Allied Telesis

Allied Telesis AT-8000C Reference guide

Allied Telesis

Allied Telesis AR400 Series User manual

Allied Telesis

Allied Telesis AT-BSTACK1 User manual

Allied Telesis

Allied Telesis AT-FS710/5 User manual

Allied Telesis

Allied Telesis AR410 User manual

Allied Telesis

Allied Telesis SwitchBlade AT-AR440S User manual

Popular Network Router manuals by other brands

Allnet

Allnet ALL0333AU user guide

HomeSeer

HomeSeer HT-SEL Getting started guide

Sercomm

Sercomm Genesis OC3505D Quick installation guide

Billion

Billion BIPAC 5102 Series user manual

TP-Link

TP-Link TD-8817 QIG

Motorola

Motorola MR1900 user guide

Digi

Digi IX14 user guide

Cisco

Cisco NCS 540 Hardware installation guide

XAVi

XAVi X8821e user manual

BEC

BEC 6200WZL Quick installation guide

MikroTik

MikroTik hAP ac3 Series quick start

Korenix

Korenix JetNet 5428G Series user manual

NETGEAR

NETGEAR FS526T - Switch installation guide

Korenix

Korenix JetNet 5710G Series user manual

Automated Logic

Automated Logic ZN551 Technical instructions

Cisco

Cisco ASR 1000 Series Installation and configuration guide

EnGenius

EnGenius ESR-9710 quick start guide

Cisco

Cisco 805 Series Product overview