Allied Telesis VPN manual

C613-16004-00 REV D www .alliedtelesis.com AlliedW ar e TM OS How T o | Intr oduction This document descri bes how to pr ovide secur e remote acce ss through IP se curity (IPSec) Virtual Priva te Networks (VPN). This VPN solution is suitable for an y business deployment and pro vides your office with secur e internet acc ess and fire wall protectio[...]

Which pr oducts and releases do es it apply to? > Page 2 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T This document describes h ow to configure the Windows system to use IPSec VPN to connect to your office through the AR4 1 5S r outer . When y our staff want to connect to the office th ey simply use the VPN[...]

Security issue > Page 3 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T Security issue Since this Windows VPN solution is usually used to allow remote access into corporate networks, a common security concern is “what happen s if the remote laptop or PC is stolen or falls into unauthorised hands?” This is [...]

Configuring the r outer > P erform in itial sec urity configuration on the router Page 4 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T Configuring the r outer This section contains a script file f or running IPSec encaps ulating L2TP on a Head Office AR400 series r outer , configured to support IPSec remote [...]

Configuring the r outer > The configuration script Page 5 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T The configuration script Note: Comments are indi cated in the script below using the # symbol. Placeholders for IP addresses, passwords, etc ar e indicated by text within < > set system name=”IPSec[...]

Configuring the r outer > The configuration script Page 6 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T # Firewall enable fire create fire poli=main create fire poli=main dy=dynamic add fire poli=main dy=dynamic user=ANY add fire poli=main int=vlan1 type=private # Dynamic private interfaces are accepted from[...]

Configuring the router > Set the r outer to use the configuration Page 7 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T Set the r outer to use the configuration After loading the configuration onto the switch, set the router to use the script after a reboot. If you named the script vpn.cfg, enter the command:[...]

Configuring the VPN c lient > Add a ne w registry entr y Page 8 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T Configuring the VPN client Configuring the Wi ndows 2000 VPN clie nt inv olves the following stages: z "Add a ne w registr y entr y", on this page z "Add the IP Security P olicy Manage[...]

Configuring the VPN client > Add the IP Security Policy Managem ent snap-in Page 9 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T Add the IP Security P olicy Manag ement snap-in Note: Y ou need to know the public IP ad dress for the r outer from y our Internet Ser vice Pr ovider (ISP) for this configuration. [...]

Configuring the VPN client > Add the IP Security Policy Managem ent snap-in Page 10 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 3. Click Add . This opens the Add Standalone Snap-In window . Scr oll down the list of Available Standalone Snap-ins and select IP Security Policy Management , as shown in the fol[...]

Configuring the VPN client > Create an IP Security Pol icy Page 11 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T Cr eate an IP Security P olicy 1. On the Console window , click , then right-click I P Security Policies on Local Mac hine . 2. Select Create IP Security Polic y . This opens the IP Security Polic[...]

Configuring the VPN client > Create an IP Security Pol icy Page 12 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 3. Click Next , then enter a name for y our security po licy (e .g. “T o Head Office”), as shown in the follo wing figure. 4. Click Next. This opens the Requests f or Secure Communication wind[...]

Configuring the VPN client > Create an IP Securi ty Rule Page 13 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 5. Click Next. Y ou ha ve now completed the IP Security P olicy Wizard, as sho wn in the following figure. 6. Lea ve the Edit proper ties checkbox check ed. Click Finish . Cr eate an IP Security Rul[...]

Configuring the VPN client > Create an IP Securi ty Rule Page 14 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 2. Click Add . This opens the Security Rule Wizard , as shown in the f ollowing figure. 3. Click Next . The next window lets you specify the tunnel en dpoint for the IP Security rule, if requir ed. [...]

Configuring the VPN client > Create an IP Securi ty Rule Page 15 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 4. Click Next . The next window lets y ou specify the network type the IP Security rule applies to . Mak e sure the All network connections option is selected, as shown in the follo wing figure. 5. [...]

Configuring the VPN client > Create an IP Filter Page 16 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T Cr eate an IP Filter 1. Click Next . The next window , shown in the following figur e , lets you specify the IP filter for the type of IP traffic the IP Secu rity rule applies to . 2. Click Add to start cre[...]

Configuring the VPN client > Create an IP Filter Page 17 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 3. Click Add . This star ts the IP Filter Wizard , as shown in the following figure. 4. Click Next . This opens the IP T raff ic Source window . Select My IP Address from the Source addr ess drop- down bo x[...]

Configuring the VPN client > Create an IP Filter Page 18 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 5. Click Next . This opens the IP T raff ic Destination window . Select A specif ic IP Address fr om the Destination address dr op-down bo x, as shown in the follo wing figure. Enter the destination IP addr[...]

Configuring the VPN client > Create an IP Filter Page 19 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 7. Click Next . This opens the IP Protocol Port window . Sele ct Fro m t h is po r t and enter 1 70 1 , as shown in the following figur e . 8. Click Next . This completes the IP F ilter wizard. Lea ve the E[...]

Configuring the VPN client > Create an IP Filter Page 20 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 9. Click Finish , then on the IP Filter Li st window , click Close . This r eturns you to the Secur ity Rule Wizard IP Filter List windo w . The filter list no w includes y our new L2TP T unnel Filter filte[...]

Configuring the VPN client > Create an IP Filter Page 21 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 11. Click Next . This completes the Rule wizar d. Leav e the Edit properties box uncheck ed, as sho wn in the following figur e . 12. Click Finish , then on the T o Head Office Pr oper ties window , click C[...]

Configuring the VPN client > Create an IP Filter Page 22 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 13. Click and then right-click on T o Head Office , and select Assign . The policy is now assigned or enabled on y our PC host, indica ted by Ye s in the Polic y Assigned column, as shown in the following f[...]

Configuring the VPN client > Configure the connection Page 23 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T Configur e the connection 1. On your desktop , click Star t > Settings > Control P anel . 2. Double-click the Network and Dial-Up Connection fold er . This opens the window sh own in th e followi[...]

Configuring the VPN client > Configure the connection Page 24 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 5. Click Next . The next window lets you assign an associated dialled call or select Do not dial the initial connection . Selecting Do not dial the initial connection is appr opriate if you will ha ve [...]

Configuring the VPN client > Configure the connection Page 25 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 7. Click Next . This opens the Connection Availability window . Select Only for m yself , as shown in the follo wing figure. 8. Click Next . Enter the name for y our connection (e .g. Vir tual Private [...]

Configuring the VPN client > Configure the connection Page 26 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 9. Click Finish . This opens the Connection Window . Enter y our user name and passw ord as shown in the following figur e . These are the user name and passw ord that ar e (or will be) configured on t[...]

Configuring the VPN client > Configure the connection Page 27 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T 11. Click OK . This completes the configuration of the L2TP client. T o connect to the office, click Connect . Note that the connection will fail if th e router has not y et been configured. If the con[...]

T esting the tunnel > Checking the connection from the Windows client Page 28 | AlliedW are™ OS Ho w T o Note: VPNs with Windo ws 2000 clients, without NA T -T T esting the tunnel The simplest wa y to tell if traffic is passing th rough the tunnel is to perform a tr acer ou te from the Windows 20 00 client to a PC in the r outer’ s LAN. T o [...]

USA Headq u ar ters | 19800 Nor th Cr eek Parkwa y | S u ite 200 | Bothell | WA 98011 | USA | T: +1 800 424 4284 | F: +1 425 481 3895 E u r opea n Headq u ar ters | Via Motta 24 | 6830 Chiasso | Switzerla n d | T: +41 91 69769.00 | F: +41 91 69769.11 Asia-Paci f ic Headq u ar ters | 11 T ai Se ng Li n k | Si ng apor e | 534182 | T : +65 6383 3832 |[...]