CLI: Example for Configuring IPSec VPN for Users to Access the Headquarters Using the Windows 7 IKEv2 Client
Networking Requirements
As shown in Figure 3-12, the IKEv2 client directly initiates a connection request to the IPSec gateway to establish an IPSec tunnel. A certificate is used for tunnel negotiation security, client identity integrity, and data security.
Data Plan
Item |
Data |
|---|---|
IPSec gateway |
Interface number: GigabitEthernet 1/0/1 IP address: 1.1.1.2/24 Security zone: Untrust |
Interface number: GigabitEthernet 1/0/3 IP address: 10.1.1.1/24 Security zone: Trust |
|
IPSec configuration IPSec policy type: policy template Authentication type: certificate authentication Security protocol: ESP ESP authentication algorithm: SHA2-256 ESP encryption algorithm: AES-256 Local ID type: IP address Peer ID type: any IKE version: v2 |
|
IKEv2 client |
Internet IP address: 1.1.1.2 Authentication method: certificate authentication |
Configuration Roadmap
- Complete basic firewall configurations, including the interfaces, security policies, and routes.
- Complete the IPSec configuration on FW.
- Complete the Windows 7 client configuration on the traveling employee's PC. The parameters of the PC must be consistent with those of the FW.
Procedure
- Set basic parameters on FW.
- Configure interzone security policies.
# Configure a security policy to allow users in the headquarters to initiate access requests to traveling employees.
[FW] security-policy [FW-policy-security] rule name policy1 [FW-policy-security-rule-policy1] source-zone trust [FW-policy-security-rule-policy1] destination-zone untrust [FW-policy-security-rule-policy1] source-address 10.1.1.0 24 [FW-policy-security-rule-policy1] destination-address range 10.1.1.2 10.1.1.100 [FW-policy-security-rule-policy1] action permit [FW-policy-security-rule-policy1] quit
# Configure a security policy to allow traveling users to initiate access requests to users in the headquarters.
[FW-policy-security] rule name policy2 [FW-policy-security-rule-policy2] source-zone untrust [FW-policy-security-rule-policy2] destination-zone trust [FW-policy-security-rule-policy2] source-address range 10.1.1.2 10.1.1.100 [FW-policy-security-rule-policy2] destination-address 10.1.1.0 24 [FW-policy-security-rule-policy2] action permit [FW-policy-security-rule-policy2] quit
# Configure security policies to allow traveling users to negotiate an IPSec tunnel with the headquarters.
The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).
[FW-policy-security] rule name policy3 [FW-policy-security-rule-policy3] source-zone local [FW-policy-security-rule-policy3] destination-zone untrust [FW-policy-security-rule-policy3] source-address 1.1.1.2 32 [FW-policy-security-rule-policy3] action permit [FW-policy-security-rule-policy3] quit
[FW-policy-security] rule name policy4 [FW-policy-security-rule-policy4] source-zone untrust [FW-policy-security-rule-policy4] destination-zone local [FW-policy-security-rule-policy4] destination-address 1.1.1.2 32 [FW-policy-security-rule-policy4] action permit [FW-policy-security-rule-policy4] quit [FW-policy-security] quit
- Configure interzone security policies.
- Configure the service scheme on the FW.
- Use SCEP to apply for a certificate online for FW.
Create RSA key pair rsa_scep of 2048 bits and make it exportable from the device.
[FW] pki rsa local-key-pair create rsa_scep exportable Info: The name of the new key-pair will be: rsa_scep The size of the public key ranges from 2048 to 4096. Input the bits in the modules:2048 Generating key-pairs... ..................+++ .+++
Configure a PKI entity.
[FW_A] pki entity user01 [FW_A-pki-entity-user01] common-name hello [FW_A-pki-entity-user01] country cn [FW_A-pki-entity-user01] email test@user.com [FW_A-pki-entity-user01] fqdn test.abc.com [FW_A-pki-entity-user01] ip-address 1.1.3.1 [FW_A-pki-entity-user01] state jiangsu [FW_A-pki-entity-user01] organization huawei [FW_A-pki-entity-user01] organization-unit info [FW_A-pki-entity-user01] quit
Apply for and update certificates online through SCEP.
The fingerprint of the CA certificate is obtained from the CA server. In this example, the CA server version is Windows Server 2008, and the CA server uses the challenge password to process certificate requests and the challenge password is 6AE73F21E6D3571D. The URL for obtaining the challenge password and fingerprint is http://1.1.4.1:80/certsrv/mscep_admin. Assume that the fingerprint of the CA certificate is 7A34D94624B1C1BCBF6D763C4A67035D5B578EAF in sha1 mode, and the URL for applying for the certificate is http://1.1.4.1:80/certsrv/mscep/mscep.dll.
[FW_A] pki realm abc # Configure the trusted CA. FW_A-pki-realm-abc] ca id ca_root # Bind the entity. [FW_A-pki-realm-abc] entity user01 # Configure the fingerprint of the CA certificate. The following uses 7A34D94624B1C1BCBF6D763C4A67035D5B578EAF as the fingerprint. [FW_A-pki-realm-abc] fingerprint sha1 7A34D94624B1C1BCBF6D763C4A67035D5B578EAF # Specify the URL of CA for certificate application. FW_A-pki-realm-abc] enrollment-url http://1.1.4.1:80/certsrv/mscep/mscep.dll ra # Specify the RSA key pair for certificate application. FW_A-pki-realm-abc] rsa local-key-pair rsa_scep # Specify the challenge password. The following uses 6AE73F21E6D3571D as the challenge password. [FW_A-pki-realm-abc] password cipher 6AE73F21E6D3571D [FW_A-pki-realm-abc] quit # Obtain the CA certificate. [FW_A] pki get-certificate ca realm abc
The CA certificate is saved in the device storage with the name abc_ca.cer.
# Import the CA certificate to memory.
[FW_A] pki import-certificate ca filename abc_ca.cer The CA's Subject is /CN=ca_root The CA's fingerprint is: MD5 fingerprint:6DF2 CC66 6E6A 09A0 F590 F63B 80BA 017B SHA1 fingerprint:7A34 D946 24B1 C1BC BF6D 763C 4A67 035D 5B57 8EAF Is the fingerprint correct?(Y/N):y Info: Succeeded in importing file.# Enable automatic certificate enrollment and update: the PKI entity updates the certificate and RSA key pair when 60% of the certificate validity period has passed.
[FW_A] pki realm abc [FW_A-pki-realm-abc] auto-enroll 60 regenerate 2048 [FW_A-pki-realm-abc] quit
The device automatically obtains the local certificate abc_local.cer and installs it on the device.
- Configure an IPSec policy and apply the policy to the corresponding interface on FW.
- Configure a route to the headquarters.
To communicate with traveling employees, the headquarters device must have a route to the address pool, with the next hop pointing to the intranet interface address of the FW.
- Configure the traveling employee's PC. The configuration on the Windows 7 operating system is as follows:
- Create an IKEv2 connection.
- Choose .
- Select .
- Open .
- Select .
- Click .
- Select .
Set the Internet address and target name.
Set the Internet address to the IP address of the extranet interface on the FW (you can also enter the domain name if the domain name is fixed).
Set the user name and password. This step can be omitted in this scenario.
- Click Connect.
- Click Skip to skip the verification process. After The connection is ready for use is displayed, click Close.
- Set IKEv2 connection parameters.
- In the left pane of , select Change adapter settings.
- Right-click the new VPN connection and select Properties.
Set Options, Security, and Networking.
Figure 3-13 Choose a connection optionFigure 3-14 Choose a connection optionFigure 3-15 Choose a connection optionThe Windows 7 operating system requires that the firewall certificate extensions should contain Server Authentication and IP Security IKE intermediate. Perform the configurations on the certificate server.
- Generate a certificate request file.
- Choose Start > Run, enter mmc, and click OK.
Add a certificate node on the console.
Click OK.
Create a user-defined request.
Expand Certificates, click Personal, and right-click the right blank area to create a user-defined request.
Configure a certificate registration policy.
Click Next. Perform the following configurations.
Set a certificate attribute owner and leave General and Extensions unconfigured.
Select RSA as the private key encryption service process, set key options, and click OK.
Click Next, set the file format to Base 64 and specify the file name and file storage path, and click Finish.
- Import the local certificate.
Expand Certificates on the left menu bar of the console, click Personal, and right-click the right blank area to import the certificate.
- Access the certificate import wizard and click Next.
- Select the PC's local certificate and click Next.
- Select Place all certificates in the following store, click Browse, and select personal.
- Click OK.
- Click Next.
- Click Finish. View Certificates to check whether the certificate is imported to Personal.
- Import the root certificate.
Expand Certificates on the left menu bar of the console, click Personal, and right-click the right blank area to import the certificate.
- Access the certificate import wizard and click Next.
- Select the root certificate and click Next.
- Select Place all certificates in the following store, click Browse, and select Trusted Root Certification Authorities.
- Click OK.
- Click Next.
- Click Finish. View Certificates to check whether the certificate is imported to Trusted Root Certification Authorities.
- Create an IKEv2 connection.
Configuration file
# sysname FW # acl number 3000 rule 5 permit ip source 10.1.1.0 0.0.0.255 # ipsec proposal tran1 esp encryption-algorithm aes-256 esp authentication-algorithm sha2-256 # ike proposal 10 encryption-algorithm aes-256 dh group14 authentication-algorithm sha2-256 authentication-method rsa-signature integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer a ike-proposal 10 certificate local-filename abc_local.cer service-scheme ikev2 # ipsec policy-template policy_temp 1 security acl 3000 ike-peer a proposal tran1 # ipsec policy policy 10 isakmp template policy_temp # pki entity user01 country cn state jiangsu organization huawei organization-unit info common-name hello fqdn test.abc.com ip-address 1.1.3.1 email test@user.com # pki realm abc ca id ca_root enrollment-url http://1.1.4.1:80/certsrv/mscep/mscep.dll ra entity user01 fingerprint sha1 7A34D94624B1C1BCBF6D763C4A67035D5B578EAF rsa local-key-pair rsa_scep password cipher %$%$r1OA2scco3r5w.A\:(18v%+z%$%$ auto-enroll 60 regenerate # interface GigabitEthernet1/0/1 undo shutdown ip address 1.1.1.2 255.255.255.0 ipsec policy policy # interface GigabitEthernet1/0/3 undo shutdown ip address 10.1.1.1 255.255.255.0 # firewall zone trust set priority 85 add interface GigabitEthernet1/0/3 # firewall zone untrust set priority 5 add interface GigabitEthernet1/0/1 # ip pool pool1 section 1 10.1.1.3 10.1.1.100 # aaa authorization-scheme default authentication-mode local service-scheme ikev2 ip-pool pool1 domain net1 service-type internetaccess ike authentication-schem default service-scheme ikev2 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.1.0 24 destination-address range 10.1.1.2 10.1.1.100 action permit rule name policy2 source-zone untrust destination-zone trust source-address range 10.1.1.2 10.1.1.100 destination-address 10.1.1.0 24 action permit rule name policy3 source-zone local destination-zone untrust source-address 1.1.1.2 32 action permit rule name policy4 source-zone untrust destination-zone local destination-address 1.1.1.2 32 action permit # return