UserGate Client IPsec L2TP

In this case, NGFW acts as a VPN server, and the user with the UserGate Client software installed acts as a VPN client. When you create a VPN using L2TP/IPsec(IKEv1), L2TP creates a tunnel that carries network layer packets in PPP frames. IPsec provides encryption, authentication, and integrity checks for transmitted data.
To do this you need to follow these steps:

Name

Description

Step 1. Allow the VPN service in the zone to which VPN clients will connect.

In the Network ➜ Zones section, edit the access control settings for the zone to which VPN clients will connect and enable the VPN and Connecting endpoints services.

Step 2. Create a zone where the clients connecting using a VPN will be placed.

In the Network ➜ Zones section, create a zone where the clients connecting via a VPN will be placed. This zone can later be used in security policies.

There is already a default zone VPN for remote access.

Step 3. Create a NAT rule for the newly created zone.

In order for connected VPN clients to be able to access the Internet through the NGFW tunnel, it is necessary to create a NAT rule from the VPN for remote access zone to the Untrusted zone. Create the corresponding rule in the Network policies ➜ NAT and routing section.

As an example, a rule named NAT from VPN for remote access to Trusted and Untrusted is created in NGFW that allows IP address substitution from the zone VPN for remote access to the Trusted and Untrusted zones.

Step 4. Create a firewall rule that allows traffic from the zone created earlier.

In the Network policies ➜ Firewall section, create a firewall rule that allows traffic from the zone you created to other zones.

To let the traffic pass to the server via the VPN tunnel from the client zone, you need to create an allowing firewall rule, specifying desired source zone and destination zone.

For example, there ia a rule created in NGFW from the zone of remote VPN connections VPN for remote access allowing access to the zones Trusted and Untrusted.

Шаг 5. Create authentication profile.

Create a profile for VPN users in the Users and devices ➜ Auth profiles section. Note that transparent authentication methods such as Kerberos, NTLM, or SAML IDP cannot be used for VPN authentication.

Step 6. Create a VPN server security profile.

In the VPN security profile settings, the encryption and authentication algorithms are defined. Multiple profiles may be used for connecting to different client types.

To create a VPN server security profile, go to VPN ➜ Server security profiles, click Add, and fill in these fields:

  • Name: the name of the security profile

  • Description: the description of the profile

  • IKE version: the IKE protocol is used to create a secure link between he network and the client Select IKEv1

  • IKE mode:

    • Main mode. In the main mode, the devices exchange six messages.

    • Aggressive mode. In the aggressive mode, there are 2 exchanges, 3 messages in total.

  • ID type: None. Used when the IKE local ID parameter is not required for establishing a connection between the VPN server and the UG Client. IKE local ID parameter type:

    • IPv4: the host's IP address.

    • FQDN: the host's address in the fully-qualified domain name (FQDN) format.

  • ID value: the IKE local ID value in the format specified above.

  • Pre-shared key: authenticate the remote node using pre-shared key. This string must match on the client and server for a successful connection.

Next, the settings for the first and second phases of tunnel negotiation need to be configured.

In the first phase, IKE security is negotiated. The authentication is done using a pre-shared key in the mode selected earlier. Provide the following settings:

  • Key lifetime: the time period after which the parties re-authenticate and re-negotiate the first-phase settings.

  • Dead peer detection: the Dead Peer Detection (DPD) mechanism is used to check the functionality of the channel and timely disconnect/reconnect it when the connection is lost. DPD sends R-U-THERE messages periodically to check if the IPsec neighbor is available. There are 3 operating modes of the mechanism:

    • off: the mechanism is disabled.​ DPD requests are not sent.

    • always on: DPD requests are always sent within the specified time interval. If no response is received, additional requests are sent sequentially at intervals of 5 seconds in the number specified in the Failures field. If there is a response, the mechanism returns to the initial interval for sending DPD requests, and if there is no response, the connection is terminated.

    • Idle: DPD requests are not sent while there is ESP traffic through the created SAs. If there are no packets within twice the specified time interval, then a DPD request is sent. If there is a response, a new DPD request will be sent again after a double interval of the specified time. If no response is received, additional requests are sent sequentially at intervals of 5 seconds in the number specified in the Failures field. If there is no response, the connection is terminated.

  • Diffie-Hellman groups: select the Diffie-Hellman group that will be used for key exchange.

  • Security: the algorithms are used in their listing order. To reorder the algorithms, drag and drop them with the mouse or use the Up/Down buttons.

In the second phase, the method for securing IPsec connections is selected. You need to specify the following:

  • Key lifetime: the time period after which the nodes must rotate the encryption key. The lifetime for the second phase is shorter than for the first one, which entails a more frequent key rotation.

  • Key lifesize: the key lifetime can also be expressed in bytes and is called lifesize in that case. If both values (Key lifetime and Key lifesize) are specified, the counter that reaches the limit first will trigger session key re-generation.

  • Enable NAT keepalive: used in scenarios when IPsec traffic goes through a NAT node. NAT table entries are active for a limited time. If there was no VPN traffic over the tunnel during that time span, NAT table entries on the NAT host will be deleted, preventing further passage of VPN traffic. The VPN server located behind the NAT gateway uses NAT keepalive function to periodically send keepalive packets to a peer node in order to keep the NAT session active.

  • Security: the algorithms are used in their listing order. To reorder the algorithms, drag and drop them with the mouse or use the Up/Down buttons.

Step 7.. Create a VPN interface.

A VPN interface is a virtual network adapter that will be used to connect VPN clients. This is a cluster-type interface, which means that it will be created automatically on all UserGate nodes included in a configuration cluster. If an HA cluster exists, in case any problems are identified with the active server, VPN clients will be automatically switched to a backup server, and without terminating existing VPN connections.

In the Network ➜ Interfaces section, click Add and select Add VPN. Provide the following settings:

  • Name: the name of the interface. Should be in the form tunnelN, where N is the ordinal number of the VPN interface.

  • Description: a description of the interface.

  • Zone: the zone to which this interface will belong. All clients with a VPN connection to NGFW will be placed in the same zone. Specify the zone created at Step 2.

  • Netflow profile: the Netflow profile used for this interface. This parameter is optional.

  • Mode: a static IP address must be used.

  • MTU: the MTU size for the selected interface.

Step 8. Create a VPN network.

A VPN determines the network settings that will be used for connecting the client to the server. This is primarily the assignment of IP addresses to the clients inside the tunnel, the DNS settings, and the routes that will be passed to the clients that support the use of routes assigned to them. Multiple tunnels may be used with different settings for different clients.

To create a VPN tunnel, go to VPN ➜ VPN networks, click Add, and fill in these fields:

  • Name: the name of the network.

  • Description: a description of the network.

  • IP address range: the range of IP addresses that will be used by the clients and server. Exclude the addresses assigned to the VPN interface used with this network from the range. Do not enter network addresses or the broadcast address here.

  • Specify the DNS servers that will be passed to the client or set the Use system DNS checkbox, in which case the client will be assigned the DNS servers used by NGFW.

Important! A maximum of two DNS servers can be specified.

  • VPN routes: specify the routes sent to the client as an IP address with a mask or a predefined IP address list.

  • UserGate client routes: the tab used to edit the routes sent to the clients with the UserGate client software installed.

Important! Route settings transmitted to UserGate Client endpoints are transmitted only with VPN with IKEv2.

Step 9. Create a VPN server rule.

Create a VPN server rule using the VPN network, interface, and profile created earlier. To create the rule, go to VPN ➜ Server rules, click Add, and fill in these fields:

  • Enabled: the checkbox to enable/disable the rule.

  • Name: the name of the rule.

  • Description: a description of the rule.

  • VPN Security profile: the server security profile created earlier.

  • VPN network: the VPN network created earlier.

  • Auth profile: the authentication profile created earlier.

  • Interface: the VPN interface created earlier.

  • Source: the zones and IP addresses from which VPN connections are allowed. Normally, the clients are on the Internet, so specify the Untrusted zone.

Important! The traffic processing logic is as follows:
-- The conditions are combined using Boolean OR, if several IP address and/or domain lists are specified.
-- The conditions are combined using Boolean AND, if GeoIPs and IP address and/or domain lists are specified.

  • Destination: one or more interface addresses to which the clients will connect. The interface must belong to the zone specified at Step 1.

  • Users: a user group or individual users for whom VPN connections are allowed.

Important! To apply different server rules to different clients, use the Source zone and Source address settings. The Users setting does not govern the selection of a server rule, as the user is checked only after the VPN connection has been established.

Step 10. Configure a VPN connection on the client computer.

To configure a VPN connection on a user's computer, provide these settings:

  • Installing UserGate VPN Client software on a workstation.

  • VPN server IP address: the IP address of an interface from the zone specified at Step 1

  • A pre-shared key for connecting VPN L2TP/IPsec(IKEv1) (pre-shared key, shared secret): use the pre-shared key specified at Step 6.

  • Authentication credentials: specify the user's login and password.

For more details on using UserGate Client endpoints in conjunction with NGFW, see the UserGate Client Endpoints section.
Note When changing the VPN server settings (changing server rules, changing security profiles, adding new VPN networks), the VPN server does not reboot, so previously established active VPN client sessions are not terminated. A reboot of the VPN server and reconnection of active VPN client sessions may occur if the IP address of the tunnel interface of the VPN server is changed.

Configuring Remote Access VPN Using CLI

​Step 1. Allow the VPN service in the zone to which VPN clients will connect.

To edit the zone parameters, use the following command:

Admin@UGOS# set network zone <parameters>

To learn more about the commands and parameters for creating and editing zones using the CLI, see the article Zones.

Here is an example command that edits the Untrusted zone to allow the VPN service inside it:

Admin@UGOS# set network zone Untrusted enabled-services [ VPN ]

Step 2. Create a zone where the servers connecting using a VPN will be placed.

To create a zone, use the following command:

Admin@UGOS# create network zone <parameters>

To learn more about the commands and parameters for creating and editing zones using the CLI, see the article Zones.

Here is an example command that creates a zone called RA_VPN:

Admin@UGOS# create network zone name RA_VPN enabled-services [ VPN ]

Step 3. Create a NAT rule for the newly created zone.

NAT rules are created using a command that employs the UPL syntax:

Admin@UGOS# create network-policy nat-routing <position> upl-rule <parameters>

For more details on how to configure firewall rules using the CLI, see the Configuring NAT and Routing Rules article.

Here is an example command that creates a NAT rule from RA_VPN to Zone1:

# create network-policy nat-routing 1 upl-rule PASS \ ...src.zone = RA_VPN \ ...dst.zone = Zone1 \ ...nat \ ...rule_log(session) \ ...name("RA NAT rule") \ ...enabled true

Step 4. If required, create a firewall rule that allows traffic from the zone created earlier to the desired network segment.

Firewall rules are created using a command that employs the UPL syntax:

Admin@UGOS# create network-policy firewall <position> upl-rule <commands>

For more details on how to configure firewall rules using the CLI, see the Configuring Firewall Rules article.

An example of creating firewall rules that allow traffic from RA_VPN to Zone1 is shown below:

Admin@UGOS# create network-policy firewall 2 upl-rule PASS \ ...src.zone = RA_VPN \ ...dst.zone = Zone1 \ ...rule_log(session) \ ...name("RA_VPN to Zone1") \ ...enabled(true)

Step 5. Create an authentication profile for VPN users.

For more details on configuring authentication profiles using the CLI, see the Configuring Authentication Profiles article.

Here are example commands that create an LDAP authentication server named New ldap server for the domain testd.local and authentication profile named New profile:

Admin@UGOS# create users auth-server ldap name "New ldap server" address 192.168.1.2 domains [ test.local ] bind-dn test@test.local password 12345 enabled on Admin@UGOS# create users auth-profile name "New profile" auth-methods ldap [ "New ldap server" ]

Step 6. Create a VPN server security profile.

To create a VPN server security profile, use the following command:

Admin@UGOS# create vpn server-security-profiles <parameters>

For more details on configuring VPN security profiles using the CLI, see the Configuring VPN Security Profiles article.

Here is an example command that creates a VPN server security profile named "VPN-server profile 2" for a L2TP/IPsec VPN:

Admin@UGOS# create vpn server-security-profiles name "VPN-server profile 2" ike-version 1 ike-mode main psk 12345 dh-groups [ "Group 2 Prime 1024 bit" "Group 14 Prime 2048 bit" ] phase1-security [ SHA1/AES256 SHA256/AES256 ] phase2-security [ SHA1/AES256 SHA256/AES256 ] Repeat preshared key: Admin@UGOS#

Step 7. Create a VPN interface.

To create a VPN interface, use the following command:

Admin@UGOS# create network interface vpn <parameters>

For more details on how to create a VPN interface using the CLI, see the Interfaces article.

Here is an example command that creates a VPN interface named tunnel1 belonging to the zone RA_VPN:

Admin@UGOS# create network interface vpn interface-name 1 zone RA_VPN ip-addresses [ 172.30.252.1/24 ] enabled on

Step 8. Create a VPN network.

To create a VPN network, use the following command:

Admin@UGOS# create vpn networks <parameters>

For more details on how to create a VPN network using the CLI, see the Configuring VPN Networks article.

Here is an example command that creates a VPN network named "VPN network 2":

Admin@UGOS# create vpn networks name "VPN network 2" ip-range 172.30.252.2-172.30.252.254 mask 255.255.255.0 use-system-dns on routes-ip-list [ "Int net address" ]

Step 9. Create a VPN server rule.

VPN server rules are created using a command that employs the UPL syntax:

Admin@UGOS# create vpn server-rules <position> upl-rule <commands>

For more details on how to create VPN server rules using the CLI, see the Configuring Server Rules article.

Here is an example command that creates a VPN server rule named "VPN-server rule 2" using the following previously defined items: VPN server security profile "VPN-server profile 2", VPN network "VPN network 2", user authentication profile "New profile", VPN interface tunnel1, and VPN server external IP address list "Ext VPN address":

Admin@UGOS# create vpn server-rules 2 upl-rule OK \ ...name("VPN-server rule 2") \ ...profile("VPN-server profile 2") \ ...vpn_network("VPN network 2") \ ...auth_profile("New profile") \ ...interface(tunnel1) \ ...src.zone = Untrusted ...dst.ip = lib.network("Ext VPN address") ...enabled(true)