Securepoint Security Systems
Contents
1 Configuration of the appliance ... 4
1.1 Setting up network objects ... 4
1.2 Creating firewall rules ... 5
1.3 L2TP basic settings ... 6
1.4 L2TP configuration ... 7
1.4.1 Configuration with the assistant ... 7
1.4.2 Configuration using the layer view ...10
1.5 Setting up users ...15
2 Configuration of the VPN L2TP roadwarriors under Windows...16
2.1 Setting up the VPN connection ...16
VPN with L2TP and the Windows VPN client
A VPN connects one or several computers or networks by using a different network, e. g. the internet, as a means of transport. For instance, this could be the computer of a member of staff at their home or in a subsidiary which is linked to the network at the headquarter through the internet.
For the user, the VPN looks like a normal network connection to the destination computer. The actual way of transmission is not perceived. The VPN provides the user with a virtual IP-connection which is tunneled by an actual one. The data packages transmitted via this connection are encoded at the client and decoded by the Securepoint servers - and the other way around.
Target: Setting up a VPN-L2TP between the Securepoint appliance and a Windows
1 Configuration of the appliance
1.1 Setting up network objects
Proceed as follows:
Over Firewall select the tab Network objects.
Set up the network objects as shown in the following image.
1.2 Creating firewall rules
Proceed as follows:
Over Firewall select the tab Rules.
Create the firewall-rules as shown in the following image.
1.3 L2TP basic settings
Proceed as follows:
From the main menu VPN select VPN L2TP from the selection list.
fig. 4 selecting VPN L2TP
The local interface should be a free IP-address from the internal net. The L2TP-IP-addresses (L2TP address-pool) are assigned following the L2TP-interface.
As authentication method you can select between Radius Server and Active Directory.
With this configuration the L2TP-client can communicate with the internal net via proxy-arp function, because it is assigned an IP-address from this net upon dial-in.
1.4 L2TP configuration
This configuration can be conducted in two different methods. Either through a assistant guided configuration or a manual configuration based on a drawing layer.
1.4.1 Configuration with the assistant
Proceed as follows:
Click the icon VPN and select the tab VPN connections. Click the icon New. The IPSec Wizard appears.
Select Roadwarrior and click Next.
Select L2TP and click Next.
fig. 8 IPSec Wizard - step 2
Insert a name for the connection and select Preshared Key and enter it. Then click Next.
The assistant advises what you have to do.
Complete the assistant configuration by clicking the Finish button.
fig. 10 IPSec Wizard - step 4
1.4.2 Configuration using the layer view
Proceed as follows:
Over VPN select the tab VPN connections.
With the mouse move the existing firewallobject from the left window onto the VPN viewport.
Now set up a new roadwarrior object in the left window.
Click on the Notebook-Symbol on the image bar of the upper window. In the dialog
Roadwarrior add the roadwarrior is set up without IP as (0.0.0.0), because this may
vary all the time!
Click on L2TP in the roadwarrior dialog in order to activate L2TP.
fig. 13 create a roadwarrior object
Click on the icon Connect and on the roadwarrior object.
A flag appears on the roadwarrior object with the information Please click destination object. Click on the firewall object.
fig. 15 create connection between the objects on the layer
Now a new dialog opens automatically: IPSec connection - accept Select the authentication method SECRET.
Change to the tab firewall.foo.local.
Under Local key click on the symbol (...) and enter the local key (Secret).
fig. 17 tab firewall.foo.local
fig. 18 enter the local key
If the client-pc works behind a router (natted), the client-subnet has to be inserted as well.
If the entry is to be valid for all kinds of subnets, one has to insert 0.0.0.0/0.
In the following step check the status of the services.
Click on the icon Applications and change to the tab Status of services. SERVICE_IPSEC and SERVICE_L2TP are required for an L2TP connection.
1.5 Setting up users
Proceed as follows:
Under Authentication click on the icon New.
Set up an L2TP-user with name, login, password etc.
fig. 21 adding new L2TP user
Change to the tab Group Membership and activate the checkbox VPN L2TP user. Change to the tab VPN options and enter an IP-address out of the local address pool
2 Configuration of the VPN L2TP roadwarriors under Windows
2.1 Setting up the VPN connection
Proceed as follows:
First create a standard VPN connection with the network connection assistant. Start the assistant by clicking start Control Panel Network and Internet
Connections Network Connections Create a new connection
fig. 24 start the assistant fig. 25 select conecttion to a network
2.2 Configure the VPN connection settings
Proceed as follows:
On the dialog Connect name-of-the-connection insert your login name on the firewall and the password.
Open the properties of the VPN connection, for further setup steps. Choose in the Properties Security IPSec-Settings.
Put the Preshared Key (SECRET) and activate the checkbox to using it.
fig. 30 insert connection data and select Properties
Under the tab Networking adjust the VPN type to L2TP IPSec VPN.
In the Properties of the (TCP/IP) Protocol -> Advanced the option Use the default
gateway on the remote network may also be selected in addition to that.
Now you can start the IPSec-connection.
fig. 33 change the VPN type
fig. 34 click Advanced...
