Allied Telesis AR440S Manuale utente

C613-16049-00 REV E www.alliedtelesis.com

AlliedWareTM OS

How To |

Introduction

In this How To Note’s example, a headquarters office has VPNs to two branch offices and a

number of roaming VPN clients. The example illustrates the following possible components

that you could use in a corporate network:

zVPNs between a headquarters office and roaming VPN clients, such as travellers’ laptops

zVPNs between a branch office and roaming VPN clients, such as travellers’ laptops

za VPN between a headquarters office and a branch office with a fixed IP address, when the

branch office has an ADSL PPPoA connection to the internet

za VPN between a headquarters office and a branch office with a dynamically assigned IP

address, when the branch office has an ADSL PPPoEoA connection to the internet

zusing software QoS to prioritise voice (VoIP) traffic over the VPNs

Select the solution components that are relevant for your network requirements and

internet connection type.

Contents

Which products and software versions does this information apply to? ................................... 2

Related How To Notes .......................................................................................................................... 2

About IPsec modes: tunnel and transport ......................................................................................... 3

Background: NAT-T and policies .......................................................................................................... 4

How to configure VPNs in typical corporate networks ................................................................. 6

Before you start ............................................................................................................................... 7

How to configure the headquarters VPN access concentrator ........................................... 8

How to configure the AR440S router at branch office

..................................................... 16

How to configure the AR440S router at branch office 2 ..................................................... 24

Configure VPNs in a Corporate Network, with

Optional Prioritisation of VoIP

Page 2 | AlliedWare™ OS How To Note: VPNs for Corporate Networks

How to make voice traffic high priority ........................................................................................... 30

How to prioritise outgoing VoIP traffic from the headquarters router ............................ 31

How to prioritise outgoing VoIP traffic from the branch office

router ......................... 33

How to prioritise outgoing VoIP traffic from the branch office 2 router ......................... 35

How to test your VPN solution ......................................................................................................... 36

Configuration scripts for headquarters and branch offices ......................................................... 37

Before you use these scripts ....................................................................................................... 37

Headquarters VPN access concentrator's configuration ..................................................... 38

Branch office

AR440S configuration—the PPPoA site with VPN client access

and a fixed IP address ............................................................................................................ 43

Branch office 2 AR440S configuration—the PPPoEoA site with a dynamically

assigned IP address ................................................................................................................. 48

Extra configuration scripts for lab testing the VPN solution ...................................................... 52

ISP's PPPoE access concentrator configuration ...................................................................... 52

Hotel's NAT gateway firewall configuration ............................................................................ 53

Which products and software versions does this

information apply to?

The information provided in this document applies to the following products:

zAR400 Series routers

zAR750S and AR770S routers

zRapier and Rapier i Series switches

zAT-8800 Series switches

running software version 2.6.6 and above. However, prioritising the voice traffic requires

Software Quality of Service, which is available with version 2.7.

and above.

On the roaming VPN clients, we tested this solution with Microsoft®Windows Virtual

Private Network.

This How To Note shows how to prioritise VoIP traffic at the offices, but does not show how

to set up the VoIP facility itself on your VPN client PCs. You need to find suitable PC

software to provide that.

Related How To Notes

Allied Telesis offers How To Notes with a wide range of VPN solutions, from quick and

simple solutions for connecting home and remote offices, to advanced multi-feature setups.

Notes also describe how to create a VPN between an Allied Telesis router and equipment

from a number of other vendors.

For a complete list of VPN How To Notes, see the Overview of VPN Solutions in How To Notes

in the How To Library at www.alliedtelesis.com/resources/literature/howto.aspx.

Page 3 | AlliedWare™ OS How To Note: VPNs for Corporate Networks

About IPsec modes: tunnel and transport

This solution uses two types of VPN:

zIPsec tunnel mode, for the headquarters office to branch office VPNs. These are site-to-

site (router-to-router) VPNs.

zIPsec transport mode with L2TP, for the roaming Windows VPN clients.

The following figure shows the protocol stacks for the tunnel mode VPN and the transport

mode VPN for the connection type PPPoA.

In this How To Note, branch office

uses PPPoA. The other offices in this How To Note use

different connection types and therefore have different stacks below IP. Branch office 2 uses

PPP over virtual Ethernet over ATM, and headquarters simply uses IP over an actual Ethernet

WAN connection.

IPsec

PPP

ATM

ADSL

statically-defined

interface ppp0

tunnel mode:

policy “hq”

IPsec payload L2TP

IPsec

PPP

ATM

ADSL

statically-defined

interface ppp0

transport mode:

policy “roaming”

using L2TP server

definition

PPP IPsec payload (dynamic

PPP using template)

Tunnel mode - for site-to-site VPNs Transport mode - for roaming clients

encrypted

by IPsec

vpn-protocol-stack.eps

Page 4 | AlliedWare™ OS How To Note: VPNs for Corporate Networks

Background: NAT-T and policies

NAT-T NAT Traversal (NAT-T) can be enabled on any of our IPsec VPN links. It automatically allows

IPsec VPNs to traverse any NAT gateways that may be in the VPN path. This is likely to occur

with the VPNs from the roaming VPN clients—they are likely to use a LAN at a remote site

that is behind a NAT gateway.

NAT-T may also be applicable for a site-to-site VPN, if one of the routers is behind a NAT

gateway, such as some ADSL devices. Note that AR44xS series routers provide an ADSL

interface, which removes the need for a separate ADSL device. Therefore, the examples in

this How To Note do not include NAT-T for the site-to-site VPNs.

The following figure shows how the addresses in the IPsec headers change as a packet from a

roaming client traverses NAT gateways in the VPN pathway. The figure illustrates IPsec

transport mode with L2TP.

NAT gateway

Dest Addr

PPP

L2TP

IPsec

ETH

Source Addr

192.168.143.1

N/A

192.168.200.1

192.168.140.27

N/A

200.200.200.1

N/A N/A

Encrypted

192.168.200.1

roaming VPN

client

192.168.200.254

211.211.211.1

hotel

Dest Addr

PPP

L2TP

IPsec

ETH

Source Addr

192.168.143.1

N/A

211.211.211.1

192.168.140.27

N/A

200.200.200.1

N/A N/A

Encrypted

Internet

headquarters

VPN access

concentrator

Dest Addr

ETH

Source Addr

192.168.143.1

N/A

192.168.140.27

N/A

200.200.200.1

192.168.140.254

192.168.140.27

hotel

headquarters

vpn-nat-t.eps

Page 5 | AlliedWare™ OS How To Note: VPNs for Corporate Networks

Policies and

interfaces

It is useful to keep in mind that you apply firewall rules and IPsec policies to interfaces in the

following different ways:

zFirewall rules can be applied on either private or public interfaces. The rules are matched

against traffic that comes into the interface to which they were applied. Rules applied to

private interfaces are typically quite different to rules applied to public interfaces.

zIPsec policies are applied only on the public interface. The policy definitions, and any active

Security Associations (SAs), are considered for both incoming and outgoing traffic on that

interface.

Page 6 | AlliedWare™ OS How To Note: VPNs for Corporate Networks

How to configure VPNs in typical corporate

networks

This section describes a typical corporate network using secure VPN. The network consists

of a headquarters (HQ) router and two branch office routers. The headquarters router is

acting as a VPN Access Concentrator, and allows for VPN access from either of the branch

office sites or from roaming laptop VPN clients. The network is illustrated in the following

figure.

Branch office

uses the PPPoA ADSL link type, and branch office 2 uses the PPPoEoA ADSL

link type. We have done this to illustrate these two commonly used ADSL link types. For

information about the ADSL link type you need, see your ADSL provider.

This How To Note gives you the commands for configuring each of the following:

1. The headquarters VPN access concentrator router, which includes:

zan ethernet connection to the Internet

za fixed Internet address. This means that the branch offices and the roaming VPN

clients have a known target for the headquarters end of the VPN

zVPN access to and from branch office

. This can be initiated from the headquarters

or branch office end. This is a site-to-site VPN and uses IPsec tunnel mode (see

"Background: NAT-T and policies" on page 4).

zVPN access from branch office 2. This can only be initiated from the branch office end,

because the branch office has a dynamically-assigned IP address. This also uses IPsec

tunnel mode.

zVPN client access from roaming users on Windows 2000 and Windows XP. This is

provided by using IPsec transport mode with L2TP (see "About IPsec modes: tunnel

and transport" on page 3)

zoptionally, prioritisation of voice (VoIP) traffic for these VPN clients by using Software

Quality of Service (SQoS). If the VPN clients use VoIP to establish voice calls via the

headquarters network, this helps maintain voice quality.

VLAN 1

192.168.141.254

222.222.222.1 222.222.222.254 200.200.200.254 192.168.140.254

211.211.211.1

192.168.200.254

physical address: 192.168.200.1

VPN tunnel address frompool: 192.168.143.1

211.211.211.254

200.200.200.1

ISP’s

router

headquarters

VPN access

concentrator

corporate

LAN

hotel’s NAT gateway

roaming VPN client

branch office 1

VPN router

branch office 2

dynamically

assigned

VLAN 1

192.168.142.254

Telco’s ADSL

exchange

Pool ofaddresses available

for roaming clients:

192.168.143.1-50

vpn-corporate.eps

Page 7 | AlliedWare™ OS How To Note: VPNs for Corporate Networks

2. The branch office

router, which provides:

zan ADSL PPPoA Internet connection. Note that the PPPoA connection requires an

ATM DSLAM

zVPN access to headquarters using IPsec tunnel mode

zincoming VPN client access from roaming users

za fixed Internet address so that roaming VPN clients have a known target for the

branch office end of the VPN

3. The branch office 2 router, which provides:

zan ADSL PPPoEoA Internet connection

zVPN access to headquarters using IPsec tunnel mode

za dynamically assigned Internet address, as used by many ISPs.

Color coding For your convenience, the configurations are color-coded:

Before you start

Don’t forget to check you have the following when planning your secure VPN network:

1. ISAKMP shared key

2. Fixed public IP addresses to use where appropriate

3. The IP subnets to use on private LANs at the branch and headquarters sites

4. The range of IP addresses to use in the IP pools for allocating to the remote users

5. Usernames and passwords for the remote users

6. IP addresses from which SSH connections can be made to the routers (if applicable)

7. Connection parameters for the ADSL connections at the branch offices

8. VPN client PCs set up, as described in the How To Notes in "Related How To Notes" on

page 2.

headquarters

branch office

branch office 2

Headquarters

Page 8 | AlliedWare™ OS How To Note: VPNs for Corporate Networks

How to configure the headquarters VPN access

concentrator

Before you begin to configure your router, ensure that it is running the appropriate software

release, patch and GUI files and has no configuration.

set inst=pref rel=<rel-file> pat=<patch-file> gui=<gui-file>

set conf=none

disable system security

restart reboot

Note: A software QoS extension to this configuration, to prioritise VoIP traffic over the

VPNs, is available in "How to prioritise outgoing VoIP traffic from the headquarters router" on

page 31.

Name the router

set system name=HQ

Define a security officer.

add user=secoff pass=<your-secoff-password> priv=securityofficer

lo=yes telnet=yes

Do not forget your “secoff” password.

Enable security mode so that VPN keys are stored securely, and other security features are

enabled.

enable system security

Once security mode is enabled, you need to log in as a security officer to enter most

configuration-altering commands.

password: <your-secoff-password>

It is important to keep this security officer username and password secure, and to consider

proper handover of it in the event of IT staff changes.

Also, we recommend you leave a “manager” privilege user defined because this may provide

backup access if the security officer password is lost. Do not leave the manager password at

the factory default—change it to a password in keeping with your company's security policy.

set user=manager password=<your-company-policy-password>

When security mode is enabled, router configuration access times out after inactivity to

prevent unauthorised access. The default timeout is 60 seconds, but you may temporarily

raise it to 600 seconds if desired.

set user securedelay=600

1. Configure general system and user settings

Headquarters

Page 9 | AlliedWare™ OS How To Note: VPNs for Corporate Networks

Give a fixed public address to the interface eth0, which is the Internet connection interface.

You can replace eth0 with ppp0 if you use a leased line.

enable ip

add ip int=eth0 ip=200.200.200.1

Give a fixed private address to the interface vlan

, which connects the router to the

headquarters LAN.

add ip int=vlan1 ip=192.168.140.254

Set the default route. The next hop is the gateway address provided by the ISP.

add ip rou=0.0.0.0 mask=0.0.0.0 int=eth0 next=200.200.200.254

If desired, set up the router as a DHCP server for the headquarters LAN.

create dhcp policy=hq lease=7200

add dhcp policy=hq rou=192.168.140.254

add dhcp policy=hq subn=255.255.255.0

create dhcp range=hq_hosts policy=hq ip=192.168.140.16 num=32

ena dhcp

If you need remote management access, we strongly recommend that you use Secure Shell

(SSH). You should not telnet to a secure gateway.

To configure SSH, define appropriate RSA encryption keys, then enable the SSH server.

create enco key=2 type=rsa length=1024 description="host key"

format=ssh

create enco key=3 type=rsa length=768 description="server key"

format=ssh

enable ssh server serverkey=3 hostkey=2

Enable the user who connects via SSH to log in as secoff, by adding the secoff user as an SSH

user. Also, you may choose to restrict access so that it is only permitted from particular

addresses.

add ssh user=secoff password=<secoff-password>

ipaddress=<trusted-remote-ip-address>

mask=<subnet-mask-of-trusted-hosts>

disable telnet server

Secure Shell is a more secure, encrypted method of remote management access than telnet.

If you need to use telnet, even though it is insecure, you should restrict access by defining

2. Configure IP for internet access

3. Configure remote management access, if desired

Headquarters

Page 10 | AlliedWare™ OS How To Note: VPNs for Corporate Networks

remote security officers (RSOs). RSO definitions specify trusted remote addresses for

security officer users.

add user rso ip=<ipadd>[-<ipadd>]

enable user rso

enable telnet server

If desired, set the router to send log messages to a syslog server.

create log output=2 destination=syslog server=<syslog-server-address>

syslogformat=extended

add log out=2 filter=1 sev=>3

If desired, you can configure SNMP to inform you or your service provider of network

events, such as the LAN interface of the router going down. We recommend SNMPv3 for

security reasons. For details, see How To Configure SNMPv3 On Allied Telesis Routers and

Managed Layer 3 Switches. This How To Note is available from www.alliedtelesis.com/

resources/literature/howto.aspx.

You need to configure dynamic PPP over L2TP to accept incoming Windows VPN client

connections.

Create an IP pool to allocate unique internal payload addresses to incoming VPN clients.

create ip pool=roaming ip=192.168.143.1-192.168.143.50

Define a PPP template. This defines authentication and uses the IP pool of addresses.

create ppp template=1

set ppp template=1 bap=off ippool=roaming authentication=chap echo=10

lqr=off

Configure L2TP. When the router successfully negotiates an L2TP tunnel connection from

any remote peer, it then creates a PPP interface over that tunnel, using the PPP parameters

defined by the PPP template. If you intend to prioritise voice traffic (see page 30), also turn

on TOS (type of service) reflection, so that DSCP marked VoIP packets can be classified for

prioritisation at the PPP level.

enable l2tp

enable l2tp server=both

add l2tp ip=1.1.1.1-255.255.255.254 ppptemplate=1 tos=on

Add your approved roaming VPN client usernames.

add user=roaming1 pass=roaming1 lo=no telnet=no

add user=roaming2 pass=roaming2 lo=no telnet=no

If desired, you can instead use a RADIUS authentication server.

add radius server=<radius-server-address> secret=<secret-key>

4. Capture status information remotely, if desired

5. Configure dynamic PPP over L2TP connections

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Allied Telesis Hardware di rete

Allied Telesis

Allied Telesis AT-TN128-A Manuale utente

Allied Telesis

Allied Telesis CentreCOM 3600 Series Manuale utente

Allied Telesis

Allied Telesis AT-MC103XL Manuale utente

Allied Telesis

Allied Telesis AT-SPFX/40 Manuale utente

Allied Telesis

Allied Telesis SwitchBlade x8106 Manuale utente

Allied Telesis

Allied Telesis AT-MCF2000 Manuale utente

Allied Telesis

Allied Telesis ADSL24AE Manuale utente

Allied Telesis

Allied Telesis AT-6101 Manuale utente

Allied Telesis

Allied Telesis AT-ON1000 Manuale utente

Allied Telesis

Allied Telesis AT-AR040 Guida all'applicazione

Allied Telesis

Allied Telesis AT-SPLX40 Manuale utente

Allied Telesis

Allied Telesis iMap 9100 Manuale utente

Allied Telesis

Allied Telesis AT-XEM-12S Manuale utente

Allied Telesis

Allied Telesis GE8 Manuale utente

Allied Telesis

Allied Telesis AT-TN123-B Manuale utente

Allied Telesis

Allied Telesis ADSL48 Manuale utente

Allied Telesis

Allied Telesis AT-TN127-A Manuale utente

Allied Telesis

Allied Telesis iMAP XE1 Manuale utente

Allied Telesis

Allied Telesis AT-9000/12PoE Manuale utente

Allied Telesis

Allied Telesis ANC10 Series Manuale utente

Allied Telesis

Allied Telesis AT-SPBD10-13 Manuale utente

Allied Telesis

Allied Telesis iMAP 9400 Manuale utente

Allied Telesis

Allied Telesis ADSL24A Manuale utente

Allied Telesis

Allied Telesis AT-TN136-A Manuale utente

Manuali Hardware di rete popolari di altre marche

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuale utente

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuale utente

Yudor

Yudor YDS-16 Manuale utente

D-Link

D-Link ShareCenter DNS-320L Manuale utente

Samsung

Samsung ES1642dc Istruzioni per l’uso

Honeywell Home

Honeywell Home LTEM-PV Istruzioni per il montaggio

evertz

evertz 7700 Series Manuale utente

D-Link

D-Link ShareCenter DNS-343 Manuale utente

Asante

Asante AsanteBridge 1012 Manuale utente

FireBrick

FireBrick FB2700 Manuale utente

Audiovox Electronics

Audiovox Electronics ARWH2T Manuale utente

ADC

ADC DSX-1 Manuale

NetComm

NetComm NF2 Manuale utente

Alcatel-Lucent

Alcatel-Lucent 5620 Manuale utente

Dell EMC

Dell EMC XC6420 Series Manuale utente

Lanner

Lanner NCA-1020A Manuale utente

Arista

Arista CCA-ETM-Q12 Manuale utente

Lanner

Lanner NCA-1525 Manuale utente