Shrew Soft Inc - User contributions [en]

Main Page

2013-07-01T07:54:32Z

Admin: /* Documentation */

== FAQ ==

A list of answers for Frequently Asked Questions is available at the following page.

[[Frequently_Asked_Questions| Frequently Asked Questions]]

== Documentation ==

Online documentation is available for most of our products. If you have a question related to installation, configuration or a specific feature, please read through the documentation.

*[https://www.shrew.net/static/help-2.2.x/html/Shrew%20Soft%20VPN%20Client%20Administrators%20Guide.html VPN Client 2.2 Documentation] [https://www.shrew.net/static/help-2.2.x/pdf/Shrew%20Soft%20VPN%20Client%20Administrators%20Guide.pdf PDF]
*[https://www.shrew.net/static/help-2.1.x/vpnhelp.htm VPN Client 2.1 Documentation] [https://www.shrew.net/static/help-2.1.x/vpnhelp.pdf PDF]
*[https://www.shrew.net/static/help-2.0.x/vpnhelp.htm VPN Client 2.0 Documentation]
*[https://www.shrew.net/static/help-1.1.x/index.html VPN Client 1.1 Documentation]
*[https://www.shrew.net/static/help-1.0.x/index.html VPN Client 1.0 Documentation]

''NOTE : A configuration guide for using the client with [http://ipsec-tools.sourceforge.net/ ipsec-tools] is included with VPN Client Documentation versions 2.0.0 and later.
''

== Configuration Guides ==

Most information required to install and configure our software is included in the product documentation. The following pages focus on specific configuration topics.

=== VPN Client and Open Source Gateway Howtos ===

*[[Howto_m0n0wall| m0n0wall]]
*[[Howto_OpenBSD| OpenBSD]]
*[[Howto_OpenSWAN| OpenSWAN]]
*[[Howto_StrongSWAN| StrongSWAN]]
*[[Howto_pfSense| pfSense]]

=== VPN Client and Commercial Gateway Howtos ===

*[[Howto_Adtran| Adtran NetVanta]]
*[[Howto_Checkpoint| Check Point NGx]]
*[[Howto_Cisco_Asa| Cisco ASA]]
*[[Howto_Cisco_IOS| Cisco IOS]]
*[[Howto_Cisco_Pix| Cisco PIX]]
*[[Howto_Draytek| DrayTek]]
*[[Howto_Fortigate| Fortigate]]
*[[Howto_Fritzbox| FritzBox]]
*[[Howto_Juniper_SSG| Juniper SSG]]
*[[Howto_Juniper_SSG_Using_Certs| Juniper SSG using Certificates]]
*[[Howto_Lancom| Lancom]]
*[[Howto_Linksys| Linksys]]
*[[Howto_NetAsq| NetASQ]]
*[[Howto_Netgear| Netgear]]
*[[Howto_Sidewinder_v6| Sidewinder 6.x]]
*[[Howto_Sidewinder_v7| Sidewinder 7.x]]
*[[Howto_Sonicwall| Sonicwall]]
*[[Howto_Zywall| ZyXEL Zywall]]
*[[Howto_ZywallUsg| ZyXEL Zywall USG]]

== Mailing Lists ==

If you have a problem or a question regarding one of our products, please try searching the mailing list archives for a solution. We prefer to operate in a public forum as much as possible so that our clients have an opportunity to learn from each others experiences. If you have trouble locating a solution, please post a detailed message describing the problem. The mailing lists are monitored and help will be provided promptly.

[https://lists.shrew.net/mailman/listinfo mailing lists]

== Bug Reports ==

Before we can diagnose a problem with one of our products, its important that we receive an accurate bug report. The following guides describe how to gather all the data required by Shrew Soft to analyze and correct your issue.

*[[VPN_Bug_Report_Windows| Preparing a Windows VPN Client Bug Report]]
*[[VPN_Bug_Report_Unix| Preparing a Linux/BSD VPN Client Bug Report]]

Main Page

2013-03-08T07:21:30Z

Admin: /* Mailing Lists */

== FAQ ==

A list of answers for Frequently Asked Questions is available at the following page.

[[Frequently_Asked_Questions| Frequently Asked Questions]]

== Documentation ==

Online documentation is available for most of our products. If you have a question related to installation, configuration or a specific feature, please read through the documentation.

*[http://www.shrew.net/static/help-2.1.x/vpnhelp.htm VPN Client 2.1 Documentation] [http://www.shrew.net/static/help-2.1.x/vpnhelp.pdf PDF]
*[http://www.shrew.net/static/help-2.0.x/vpnhelp.htm VPN Client 2.0 Documentation]
*[http://www.shrew.net/static/help-1.1.x/index.html VPN Client 1.1 Documentation]
*[http://www.shrew.net/static/help-1.0.x/index.html VPN Client 1.0 Documentation]

''NOTE : A configuration guide for using the client with [http://ipsec-tools.sourceforge.net/ ipsec-tools] is included with VPN Client Documentation versions 2.0.0 and later.
''

== Configuration Guides ==

Most information required to install and configure our software is included in the product documentation. The following pages focus on specific configuration topics.

=== VPN Client and Open Source Gateway Howtos ===

*[[Howto_m0n0wall| m0n0wall]]
*[[Howto_OpenBSD| OpenBSD]]
*[[Howto_OpenSWAN| OpenSWAN]]
*[[Howto_StrongSWAN| StrongSWAN]]
*[[Howto_pfSense| pfSense]]

=== VPN Client and Commercial Gateway Howtos ===

*[[Howto_Adtran| Adtran NetVanta]]
*[[Howto_Checkpoint| Check Point NGx]]
*[[Howto_Cisco_Asa| Cisco ASA]]
*[[Howto_Cisco_IOS| Cisco IOS]]
*[[Howto_Cisco_Pix| Cisco PIX]]
*[[Howto_Draytek| DrayTek]]
*[[Howto_Fortigate| Fortigate]]
*[[Howto_Fritzbox| FritzBox]]
*[[Howto_Juniper_SSG| Juniper SSG]]
*[[Howto_Juniper_SSG_Using_Certs| Juniper SSG using Certificates]]
*[[Howto_Lancom| Lancom]]
*[[Howto_Linksys| Linksys]]
*[[Howto_NetAsq| NetASQ]]
*[[Howto_Netgear| Netgear]]
*[[Howto_Sidewinder_v6| Sidewinder 6.x]]
*[[Howto_Sidewinder_v7| Sidewinder 7.x]]
*[[Howto_Sonicwall| Sonicwall]]
*[[Howto_Zywall| ZyXEL Zywall]]
*[[Howto_ZywallUsg| ZyXEL Zywall USG]]

== Mailing Lists ==

If you have a problem or a question regarding one of our products, please try searching the mailing list archives for a solution. We prefer to operate in a public forum as much as possible so that our clients have an opportunity to learn from each others experiences. If you have trouble locating a solution, please post a detailed message describing the problem. The mailing lists are monitored and help will be provided promptly.

[https://lists.shrew.net/mailman/listinfo mailing lists]

== Bug Reports ==

Before we can diagnose a problem with one of our products, its important that we receive an accurate bug report. The following guides describe how to gather all the data required by Shrew Soft to analyze and correct your issue.

*[[VPN_Bug_Report_Windows| Preparing a Windows VPN Client Bug Report]]
*[[VPN_Bug_Report_Unix| Preparing a Linux/BSD VPN Client Bug Report]]

Howto ZywallUsg

2013-01-09T05:28:51Z

Admin:

The Shrew Soft Client has been reported to work with Zywall USG Series products. If you have experience with this gateway type and use it in conjunction with the Shrew Soft VPN Client, please consider contributing a Wiki howto document. For more details on how to contribute, please contact us.

The following English Language guide was contributed by Christian via the vpn-help mailing list.

[[Media:zywall-usg.pdf]]

Howto ZywallUsg

2013-01-09T05:28:29Z

Admin:

File:Zywall-usg.pdf

2013-01-09T05:28:03Z

Admin: Configuration guide.

Configuration guide.

Howto Zywall

2013-01-09T05:27:20Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure a Zywall device to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been tested with Zywall products to ensure interoperability.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. No automatic configuration is possible at this time due to limitations in the Zywall firmware.

== Gateway Configuration ==

This example assumes you have knowledge of the Zywall web configuration interface. For more information, please consult your Zywall product documentation.

=== Interfaces ===

Two network interfaces are configured. The WAN interface has a static public IP address of 10.1.1.23 which faces the internet. The LAN interface has a static private IP address of 10.1.2.23 which faces the internal private network. The default gateway is configured as 1.1.1.3 via the WAN interface.

=== Configuring VPN Rules ===

A Gateway Policy must be configured to define the IKE phase1 negotiation parameters. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[File:Zywall-nav-1a.jpg]]

Click on the following Add Gateway Icon + symbol on the right hand side of the VPN Rules header.

[[File:Zywall-nav-1b.jpg]]

Define the following parameters.

*Property
**Name = vpnclient_gateway
**NAT Traversal = Checked
*Authentication Key
**Pre-Shared Key = mypresharedkey
**Local ID Type = IP
**Content = 0.0.0.0
**Peer ID Type = DNS
**Content = client.domain.com
*Extended Authentication = Checked
**Server Mode = Selected

When finished, click Apply.

[[File:Zywall-pic-1.jpg]]

=== Add a Network Policy ===

A Network Policy must be configured to define the IPsec policy and IKE phase2 negotiation parameters. Click on the following Add Network Policy Icon + symbol on the right hand side of the Gateway Policy row.

[[File:Zywall-nav-2.jpg]]

Define the following parameters.

*Property
**Active = Checked
**Name = vpnclient_policy1
*Gateway Policy Information
**Gateway Policy = vpnclient_gateway
*Local Network
**Address Type = Subnet Address
**Starting IP Address = 10.1.2.0
**Ending IP / Address Subnet = 255.255.255.0
**Local Port
**Start 0
**End 0
*Remote Network
**Address Type = Single Address
**Starting IP Address = 0.0.0.0
**Ending IP / Address Subnet = 0.0.0.0
**Remote Port
**Start 0
**End 0
*IPsec Proposal
**Encapsulation Mode = Tunnel
**Active Protocol = ESP
**Encryption Algorithm = 3DES
**Authentication Algorithm = MD5
**SA Life Time ( Seconds ) = 3600
**Perfect Forward Security = NONE
**Enable Replay Protection = Checked
**Enable Multiple Proposals = Checked

When finished, click Apply.

[[File:Zywall-pic-2.jpg]]

=== Configure Xauth User Accounts ===

Xauth user accounts can be created locally on the Zywall appliance. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[File:Zywall-nav-3.jpg]]

Define the following parameters for each remote access user.

*Active = Checked
*Username = [ user name ]
*Password = [ user password ]

When finished, click Apply.

[[File:Zywall-pic-3.jpg]]

== Client Configuration ==

The client configuration in this example is less than ideal due to limitations of the Zywall. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. This ''Host Name or IP Address'' is defined as 10.1.2.23 to match the Zywall WAN interface address. The Auto Configuration option is set to disabled as Zywall does not support automatic client configuration.

Each remote access client must be assigned a unique Virtual Adapter IP address. Please see the known issues section of this document for more details. In this example we define an address of 10.2.23.2 with a netmask as 255.255.255.0 for a single client. Each subsequent client would be assigned the next address in the network. For example, the next is assigned 10.2.23.3, the next 10.2.23.4, etc ...

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' to match the Zywall Gateway Policy definition.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.

==== Local Identity Tab ====

The Local Identity parameters are defined as ''Fully Qualified Domain Name'' with a ''FQDN String'' of "client.domain.com" to match the Zywall Gateway Policy definition.

==== Remote Identity Tab ====

The Remote Identity parameters are set to IP Address with the Use a discovered remote host address option checked to match the Zywall Gateway Policy definition.

==== Credentials Tab ====

The Credentials ''Pre Shared Key'' is defined as "mypresharedkey" to match the match the Zywall Gateway Policy definition.

=== Policy Tab ===

The IPsec Policy configuration must be manually configured when communicating with Zywall gateways. A single Topology Entry is defined to include the 10.1.2.0/24 network.

== Known Issues ==

Building a client configuration for Zywall appliances can be problematic as they have no support for address assignment via modecfg. There are two options available to work around this shortcoming.

# Select the "Use a virtual adapter and assigned address" method. Each client that connects to the gateway will need to have a unique virtual address manually configured. If more that one client connects to the gateway simultaneously using the same address, it will have conflicts and one of them will stop working unexpectedly.
# Select the "Use an existing adapter and current address" option under the General tab. This also works with my Zywall but will has some severe limitations in a production environment ...
#: a) Two clients cannot use the same public adapter address simultaneously when connecting to the Zywall gateway. This can happen easily if two clients exist behind different SOHO firewalls and receive the same address via DHCP. Essentially, this creates a similar problem to using option (1) and configuring identical virtual adapter address for more than one client.
#: b) The Zywall needs to be the default gateway for the network it protects or NAT all inbound IPsec traffic that passes to the private network. Otherwise, the return traffic destined to the client will go out your default gateway instead of being seen by the Zywall.
#: c) The client cannot use a public adapter address that exists in any private network protected by the Zywall. If this happens, you will end up with a very confused gateway that doesn't know which direction to pass the traffic. This can easily happen, again, if the client exists behind a SOHO firewall that uses an IP pool that maps to one of your internal networks.

== Resources ==

[[Media:zywall.vpn.txt]]

File:Zywall.vpn.txt

2013-01-09T05:26:54Z

Admin: Example client configuration file.

Example client configuration file.

Howto Netgear

2013-01-09T05:26:03Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure a Netgear Prosafe FVS33x or FVX53x device running firmware version 3.0.4+ to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been tested with Netgear products to ensure interoperability.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client uses the pull configuration method to acquire the following parameters automatically from the gateway.

*IP Address
*IP Netmask
*DNS Servers
*WINS Servers

== Gateway Configuration ==

This example assumes you have knowledge of the Netgear gateway Web configuration interface. For more information, please consult your Netgear product documentation.

=== Create a Mode Config Record ===

A Mode Config record is used to define configuration settings that are automatically obtained by the client. This includes private network IP address assignment as well as DNS and WINS server settings. Navigate to the following screen using the Menu list at the top of the browser interface.

[[File:Netgear-nav-1.jpg]]

Click the add button and define the following parameters.

Client Pool
*Record Name = vpnclient-cfg
*First Pool = 10.2.25.1 - 10.2.25.100
*WINS Server = 10.1.2.100
*DNS Server = 10.1.2.100

Traffic Tunnel Security Level
*PFS Key Group = Unchecked
*SA Lifetime = 3600 Seconds
*Encryption Algorithm = 3DES
*Integrity Algorithm = SHA-1
*Local IP Address = 10.1.2.0
*Local Subnet Netmask = 255.255.255.0

[[File:Netgear-pic-1.jpg]]

When finished click Apply.

=== Create an IKE Policy ===

An IKE Policy is used to define the parameters used to negotiate the phase1 ISAKMP SA. Navigate to the following screen using the Menu list at the top of the browser interface.

[[File:Netgear-nav-2.jpg]]

Click the add button and define the following parameters.

Mode Config Record
*Do you want to use Mode Config Record? = Yes
*Select Mode Config Record = vpnclient-cfg

General
*Policy Name = vpnclient-ike
*Exchange Mode = Aggressive

Local
*Identifier Type = Local Wan IP

Remote
*Identifier Type = FQDN
*Identifier = client.domain.com

IKE SA Parameters
*Encryption Algorithm = 3DES
*Authentication Algorithm = SHA-1
*Authentication Method = Pre-shared key
*Pre-shared key = mysharedsecret
*Diffie-Hellman Group = Group 2 (1024 bit)
*SA-Lifetime (sec) = 28800
*Enable Dead Peer Detection = Yes
*Detection Period = 10 seconds
*Reconnect after failure count = 3

Extended Authentication
*XAUTH Configuration = Edge Device
*Authentication Type = User Database

[[File:Netgear-pic-2.jpg]]

When finished click Apply.

=== Create VPN Client User Accounts ===

A VPN Client User Account defines the password that will be used for a particular username. Navigate to the following screen using the Menu list at the top of the browser interface.
[[File:Netgear-nav-3.jpg]]

Define a User Name and Password for each user that will connect using the VPN Client software and click Add to add them to the Configured Users list.
[[File:Netgear-pic-3.jpg]]

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. This ''Host Name or IP Address'' is defined to match the Netgear WAN Internet IP address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' to match the Netgear IKE Policy definition.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.

==== Local Identity Tab ====

The Local Identity parameters are defined as ''Fully Qualified Domain Name'' with a ''FQDN String'' of "client.domain.com" to match the Netgear IKE Policy Remote Identity value.

==== Remote Identity Tab ====

The Remote Identity parameters are defined as ''IP Address'' with ''Use a discovered remote host address'' to match the IKE Policy Local Identity value.

==== Credentials Tab ====

The Credentials ''Pre Shared Key'' is defined as "mysharedsecret" to match the Netgear IKE Policy Pre-shared key value.

=== Policy Tab ===

The IPsec Policy information must be manually configured when communicating with Netgear gateways. Create an include Topology entry that matches the ''Local IP Address'' and ''Local Subnet Netmask'' of the Netgear Mode Config record. For our example, a single Topology Entry is defined to include the 10.1.2.0/24 network.

== Known Issues ==

The Netgear Firmware has several known issues with DPD. Version 2.2.0 apha 2 and later versions of the Shrew Soft Client include code to work around these issues. If using 2.1.x client versions, you will need to disable DPD support.

== Resources ==

[[Media:netgear.vpn.txt]]

File:Netgear.vpn.txt

2013-01-09T05:25:30Z

Admin: Example client configuration file.

Example client configuration file.

Howto NetAsq

2013-01-09T05:23:35Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure a NETASQ UTM running firmware version ''8.0.0.2 (tested also with 7.0.5)'' to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been reported to inter-operate correctly with NETASQ UTM devices.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a remote private network but this NETASQ UTM does not support modcfg (ike push/pull) fonctionnality

== Gateway Configuration ==

This example assumes you have knowledge of the NETASQ GUI configuration interface. For more information, please consult your NETASQ product documentation.

=== Interfaces ===

Two network interfaces are configured. The WAN interface has a static public IP address which faces the internet. The LAN interface has a static private IP address of 192.168.254.254 which faces the internal private network.

=== Configuring VPN Rules ===

Using the NETASQ GUI, navigate to the VPN => IPSec Tunnels configuration area.

Select a ''slot'' and click to ''Edit''

A wizard is launch

[[File:NetASQ-img1.png]]

Define the parameters
*Name of tunnel = Shrew
*Template = Good Encryption

[[File:NetASQ-img2.png]]

Define the parameters
*Tunnel Type = Dynamic (Pre-Shared Key)
*Enable ''Advanced Mode''

[[File:NetASQ-img3.png]]

Define the parameters
*Local Firewall = Firewall_in
*Select VPN Peer = Any

[[File:NetASQ-img4.png]]

Define the parameters
*LOCAL hosts/networks = Network_in
*REMOTE hosts/networks = Any

[[File:NetASQ-img5.png]]

Define the parameters
*Phase 1 negotiation mode = Aggressive mode
*Identity type = user@FQDN (E-mail)
*Identity : netasq@shrew.net

Click in ''Pre-Shared Key Configuration''

[[File:NetASQ-img6.png]]

Add a key
*Key Name = Shrew
*Type = user@FQDN (E-mail)
*Peer identity = client@shrew.net
*Pre-Shared Key = mysharedsecret

=== Configuring Filtering Rules ===
Navigate to the Policy => Filering

The Firewall Rules is not Automatically create

[[File:NetASQ-img7.png]]

The first 4 are required
*Rule 1 : Allow the ISAKMP Protocol
*Rule 2 : Allow the ISAKMP-T Protocol
*Rule 3 : Allow the ESP Protocol
*Rule 4 : Allow the traffic for IPsec Tunnel to Internal Networks

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. This Host Name or IP Address is defined as your public WAN IP to match the NETASQ WAN interface address.

Set the Address Method to ''Use a existing adapter and current address''

=== Name Resolution Tabb ===

Disable WINS
Disable DNS

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK''.

==== Local Identity Tab ====

The Local Identity parameters are defined as ''User Fully Qualified Domain Name'' with a ''UFQDN String'' of "client@shrew.net" to match the NETASQ UTM Policy definition.

==== Remote Identity Tab ====

The Remote Identity parameters are defined as ''User Fully Qualified Domain Name'' with a ''UFQDN String'' of "netasq@shrew.net" to match the NETASQ UTM Policy definition.

==== Credentials Tab ====

The Credentials ''Pre Shared Key'' is defined as "mypresharedkey" to match the NETASQ UTM Policy definition.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''Key Life Time Limit'' is set to ''21600 (secs)'' to match the NETASQ UTM Policy definition.

=== Phase 2 Tab ===

The Proposal section must be configured. The ''PFS Exchange'' is set to ''group 2'' to match the NETASQ UTM Policy definition.

=== Policy Tab ===

The IPsec Policy information must be manually configured when communicating with NETASQ UTM. Create an include Topology entry for each IPsec Policy network created on the NETASQ UTM. For our example, a single Topology Entry is defined to include the 192.168.254.0/24 network.

== Known Issues ==

None reported.

== Resources ==

[[Media:netasq.vpn.txt]]

File:Netasq.vpn.txt

2013-01-09T05:22:57Z

Admin: Example client configuration file.

Example client configuration file.

Howto Linksys

2013-01-09T05:22:03Z

Admin: /* Additional Considerations */

== Introduction ==

This guide provides information that can be used to configure a Linksys RV-042 or RV-082 router to support IPsec GroupVPN client connectivity. This guide will also provide configuration information when using a Windows XPSP3 client. The current Linksys firmware version at the time of this writing is Version: 1.3.98-tm We are using Shrew version 2.1.4. 

== Overview ==

The Shrew client running on Windows XP will need to know the specifics of the remote WAN/LAN since this Linksys router does not support modcfg (ike push/pull) functionality. 

== Gateway Configuration ==

This guide assumes familiarity with configuring the Linksys router using its web UI. This Linksys router allows for multiple WAN links. This guide assumes WAN1 is the preferred link to use for the remote VPN connectivity. 

It is suggested to use the routers DDNS feature if the router is assigned a non-static IP address by the ISP. The Linksys will self register any IP address changes it receives by the ISP with the selected DDNS service. If the router is in the Americas, it is suggested to create a free account at DynDNS.org and set those values in the routers DDNS configuration area, Setup->More...->DDNS

=== Gateway Configuration - GroupVPN ===

Using the Linksys web UI, navigate to the VPN => Client to Gateway configuration area.

[[File:Lynksys-img1.png]]

==== Add new group VPN ====

*Select the Group VPN radio button. 
*Group No. is not editable and will auto increment from 1 to 2. A maximum of 2 GroupVPNs are allowable. 
*Group Name: is a unique string used to identify the Group. 
*Interface: Default value is WAN1. This is the interface that remote clients will connect through. 
*Enable: Is greyed out. This option will become available after these changes are "Saved". 

[[File:Lynksys-img2.png]]

==== Local Group Setup ====

*Local Security Group Type: Choose 'subnet' from the dropdown. This will allow all systems on the LAN to access the tunnel. 
*IP Address should autopopulate with the network IP block of the LAN. 
*Subnet mask should autopopulate with the mask of the LAN. 

[[File:Lynksys-img3.png]]

==== Remote Client Setup ====

*Remote Client: Either Domain Name(FQDN) or E-mail Address(USER FQDN) can be selected from the drop down list. We have selected Domain Name(FQDN) in this guide. 
*Domain name: shrew.net 
{This value will be needed when configuring the client} 

[[File:Lynksys-img4.png]]

==== IPSec Setup ====

{Most of the following values will be needed when configuring the Shrew client. 
*Keying Mode: IKE with Preshared key is auto selected when using GroupVPN 
*Phase1 DH Group: We have selected Group 2 
{Select Group 1 for network speed or Group 5 for greatest security} 
*Phase1 Encryption: We have selected AES-256 
{Select DES for lesser but greater speed or up to AES-256 for greatest security} 
*Phase1 Authentication: We have selected SHA1 
{SHA is recommended because it is more secure} 
*Phase1 SA Lifetime: 28800 (default value) 
*Perfect Forward Security: enable 
*Phase2 DH Group: We have selected Group 2 
*Phase2 Encryption: We have selected AES-256 
*Phase2 Authentication: SHA1 
*Phase2 SA Lifetime: 3600 (default) 
*Preshared Key: Use up to a 30 digit character or hexadecimal string that is difficult to brute force 

[[File:Lynksys-img5.png]]

Select the 'Advanced' button for further options 

==== Advanced ====

Aggressive Mode is enabled when using GroupVPN. This cannot be changed. 
Enable the following 3 advanced options leaving the rest of the options disabled.
#Keep-Alive
2. NetBIOS Broadcast (If browsing network shares is required)
3. NAT Traversal 

[[File:Lynksys-img6.png]]

== Client Configuration ==

As stated earlier, the Linksys router does not support modecfg, so Shrew client will need to be configured with specific information about the connection. Also, it is suggested to run WINS from the LAN side of the Linksys if network share browsing is required.

Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. The Host Name or IP Address is defined as either the static IP address assigned to the WAN interface of the router or it's DDNS hostname.
The Auto Configuration mode should be set to 'disabled'. 

Set the Address Method to "Use a Virtual Adaptor and assigned address", then choose and address which is NOT in the current range of the Windows XP (client) network (local LAN) AND not in the current range of the LAN side of the Linksys (remote LAN). For example, 
The client used in this guide is on a local LAN of 10.1.1.0 with a subnet of 255.255.255.0. The LAN side of the Linksys is on a remote LAN of 192.168.0.0 with a subnet of 255.255.255.0. For this Shrew client configuration, we will choose an address of 192.168.30.0 with a subnet of 255.255.255.0

Set MTU to '1380' (default) 

=== Client Tab ===

Set NAT Traversal to 'enable' 
Nat Traversal Port to '4500' (default) 
Keep alive packet rate '15' secs (default) 
IKE Fragmentation 'disable' 

=== Name Resolution Tab ===

Enable WINS and key in the IP address of the WINS server of the remote LAN. 
Enable DNS and key in the IP address of the DNS server of the remote LAN. In most cases, the IP address of the LAN interface of the router will be successful. The LAN side of the router used in this example is 192.168.0.1 
Key in a domain suffix if the remote LAN is set to use such value 
DO Not enable 'SPlit DNS', this is not supported by the Linksys 

=== Authentication Tab ===

Set Authentication Method to 'Mutual PSK' in the drop down menu 

==== Local Identity sub-tab ====

Idntification Type was configured into the router, see section titled Remote Client Setup above for these values.
This guide uses:
* Identification Type 'Fully Qualified Domain Name' 
* FQDN String 'shrew.net' 

==== Remote Identity sub-tab ====

Idntification Type was configured into the router, see section titled Local Group Setup above.
This guide uses:
* Identification Type 'IP Address' 
* Enable 'Use a discovered remote host address' 

==== Credentials sub-tab ====

Key in the Pre-Shared Key, a non-dictionary word that was configured into the router. See section IPSec Setup above. 

=== Phase 1 Tab ===

See section IPSec Setup above. The values that are set in this tab area must match those used in the router configuration. 

* Exchange Type 'aggresive' 
* DH Exchange 'group 2' 
* Cipher Algorithm 'aes' 
* Cipher Key Length '256' Bits 
* Hash Algorithm 'sha1' 
* Key Life Time Limit '28800' (default) 
* Key Life Data limit '0' (default) 

=== Phase 2 Tab ===

See section IPSec Setup above. The values that are set in this tab area must match those used in the router configuration. 

* Transform Algorithm 'esp-aes' 
* Transform Key Length '256' Bits 
* HMAC Algorithm 'sha1' 
* PFS Exchange 'group 2' 
* Compress Algorithm 'disabled' 
* Key Life Time limit '3600' Secs (default) 
* Key Life Data limit '0' Kbytes (default) 

=== Policy Tab ===

Here we must give access to the Remote LAN network resources.[[BR]
DO Not enable either of the two options under IPSec Policy Configuration, however, select the 'Add' button to include a mapping to the remote LAN.

* Select 'Add'
** In the new window Set Type 'Include' (default)
** Address of the remote LAN. (Our example remote LAN is 192.168.0.0)
** Netmask of the remote LAN (Our example remote LAN netmask is 255.255.255.0)
* Select 'Save'

== Additional Considerations ==

If browsing directory shares is a requirement and the WINS server is running on the remote LAN and the Shrew client is configured to find WINS, then browsing should be successful using Network Neighborhood. We have found that starting the following 2 services on the XP client enable the success.

Remote Procedure Call (RPC) 
Remote Procedure Call (RPC) Locator

== Credits ==

This guide was submitted by Drew Flickema. Happy Tunneling <>< 
Thanks Shrew!

Howto Lancom

2013-01-09T05:20:47Z

Admin:

The Shrew Soft Client has been reported to work with Lancom products. If you have experience with this gateway type and use it in conjunction with the Shrew Soft VPN Client, please consider contributing a Wiki howto document. For more details on how to contribute, please [http://www.shrew.net/?page=contact contact] us.

The following German Language guides were contributed by Jens Rautenstengel.

[[Media:Lancom%201611%20-%20gateway.pdf]] 
[[Media:Lancom%201611%20-%20client.pdf]]

Howto Lancom

2013-01-09T05:20:26Z

Admin:

Howto Lancom

2013-01-09T05:20:14Z

Admin:

The Shrew Soft Client has been reported to work with Lancom products. If you have experience with this gateway type and use it in conjunction with the Shrew Soft VPN Client, please consider contributing a Wiki howto document. For more details on how to contribute, please [http://www.shrew.net/?page=contact contact] us.

The following German Language guides were contributed by Jens Rautenstengel.

[Media:Lancom%201611%20-%20gateway.pdf 1611+ Gateway Configuration guide]
[Media:Lancom%201611%20-%20client.pdf 1611+ Shrew Soft Client Configuration guide]

File:Lancom 1611 - gateway.pdf

2013-01-09T05:18:08Z

Admin:

File:Lancom 1611 - client.pdf

2013-01-09T05:13:53Z

Admin:

Howto Lancom

2013-01-09T05:10:48Z

Admin:

The Shrew Soft Client has been reported to work with Lancom products. If you have experience with this gateway type and use it in conjunction with the Shrew Soft VPN Client, please consider contributing a Wiki howto document. For more details on how to contribute, please [http://www.shrew.net/?page=contact contact] us.

The following German Language guides were contributed by Jens Rautenstengel.

[http://www.shrew.net/static/howto/Lancom/Lancom%201611%20-%20gateway.pdf 1611+ Gateway Configuration guide]
[http://www.shrew.net/static/howto/Lancom/Lancom%201611%20-%20client.pdf 1611+ Shrew Soft Client Configuration guide]

Howto Juniper SSG Using Certs

2013-01-09T05:09:20Z

Admin: /* Sources */

== Introduction ==

This guide describes how to setup a dial-up connection between a ScreenOS device and the Shrewsoft client, using certificates for mutual authentication. In this guide every user uses its own certificate. A self signed CA is setup and used for signing the certificates of the users and the ScreenOS device. Certificates are created by using openssl.

== Summary ==

Configuration of the ScreenOS device and the Shrewsoft client to use certificates does not differ very much from the xAuth setup. More tricky is the creation of the certificates, especially when self-signed certificates are used:
* Make sure that your ScreenOS certificate contains a 'Subject Alternative Name' in this format: 'DNS:<vpn.mycompany.com>' (FQDN)
* Make sure that your Client certificates contain a 'Subject Alternative Name' in this format: 'email:<UserX@mycompany.com>' (UFQDN)
Additionally, the ScreenOS and the Shrewsoft client have to be configured to use xAuth authentication in the 'Auto Key Advanced' section.

== Part 1 - Certificates ==

=== Root CA - Create Root CA Certificate ===

Creating private key for CA

openssl genrsa -des3 -out CA.key 4096

Create root certificate

openssl req -new -x509 -days 7300 -key CA.key -out CA.crt

Output: CA.crt (certificate)

Output: CA.key (private key of certificate)

=== Root CA - Install Root CA Certificate ===

Load root CA certificate to the ScreenOS Device
* Objects -> Certificates (navigate to you local CA.crt file and upload it)

Disable certification revocation list (optional). If you do not want / need to maintain a certificate revocation list you can disable it on the screenos device. [01] explains how to do this.

=== ScreenOS Certificate - Creation ===
Create Certificate
* Objects -> Certificates -> New

Define some meaningful string for 'FQDN' (vpn.mycompany.com), then chose 'Generate'. Now the ScreenOS device creates the certificate and a certificate signing request (CSR). Export the csr file to having it signed by your CA.

Output: Screenos_csr.txt (Certificate Signing Request)

=== ScreenOS Certificate - Sign CSR ===
As described here [01], if you use some self created CA certificate, create a text file named subj.txt containing the string 'subjectAltName="DNS:vpn.mycompany.com"'

openssl x509 -req -days 7300 -in Screenos_csr.txt -CA CA.crt \
-CAkey CA.key -set_serial 01 -out Screenos.crt -extfile subj.txt

Output: Screenos.crt (Screenos Device Certificate)

=== ScreenOS Certificate - Upload Certificate ===

Objects -> Certificates
* Navigate to the location of certificate, select certificate
* Confirm with 'Load'

=== User Certificate - Creation ===

Create private key for user X

openssl genrsa -des3 -out UserX.key 4096

Create certificate signing request

openssl req -new -key UserX.key -out UserX.csr -subj "/CN=UserX/emailAddress=UserX@mycompany.com"

=== User Certificate - Sign CSR ===
If you use some self created CA certificate create a file subj.txt with the string 'subjectAltName="email:UserX@mycompany.com"'

openssl x509 -req -days 3650 -in UserX.csr -CA CA.crt -CAkey CA.key \
-set_serial 01 -out UserX.crt -extfile subj.txt

== Part II - ScreenOS Setup ==

=== New User ===

Create a new user object for every user:
* Objects -> Users -> Local -> new
** Important here it that you select 'IKE User' - 'Simple Identity' and place 'UserX@mycompany.com' into the 'IKE Identity' field
** Additionally select 'XAuth User' and define a password (or use e.g. xAuth with your radius server).

[[File:Juniper-SSG-Certs-pic1.png]]

=== New Group ===

Create a new group and add the defined users to this group
* Objects -> Users -> Local Groups -> new
** Add the users and add them to the group

[[File:Juniper-SSG-Certs-pic2.png]]

=== New Gateway ===

Create a new Gateway object

* VPNs -> AutoKey Advanced -> Gateway -> new
** Select 'Dialup User Group' and select the group you previously defined
** Advanced
*** Select correct outgoing interface (were your device is connected to the internet)
*** Under 'Security Level' select 'Custom' and chose 'rsa-g2-3des-sha'
*** Under 'Mode' selet 'aggressive'
*** Select 'Enable NAT-Traversal'
*** Under 'Peer Status Detection' select DPD and enter 30 seconds for 'Interval'
*** Under 'Preffered Certificate' select
**** Signed certificate (Screenos.crt) in 'Local Cert'
**** CA certificate (CA.crt) in 'Peer CA'

[[File:Juniper-SSG-Certs-pic3.png]]

[[File:Juniper-SSG-Certs-pic4.png]]

=== New Gateway - XAuth ===

* Click on Xauth on the new created Gateway object
* Select 'XAuth Server' - 'Allowed Authentication Type' Generic
* Select 'Local Authentication' - 'User Group' - <Name of your group previously configured>

[[File:Juniper-SSG-Certs-pic5.png]]

Note: Of course here you can also you your radius server

=== New IKE Instance ===

* VPNs -> Autokey IKE -> new
* Select 'Remote Gateway' - 'Predefined' and chose your previously created Gateway object
* Advanced
* Under 'Security Level' select 'Custom' and chose:
* nopfs-esp-3des-sha nopfs-esp-3des-md5
* nopfs-esp-aes128-sha nopfs-esp-aes128-md5
* Mark 'Replay Protection'
* Adapt other setting to your needs
* Under 'Action' select 'Tunnel'
* Under 'Tunnel' select your previously created IKE object

[[File:Juniper-SSG-Certs-pic6.png]]

[[File:Juniper-SSG-Certs-pic7.png]]

=== New Security Policy ===
Configure the security policy to your needs:

* Policy -> Policies
* Select From 'Untrust' TO 'Trust' and click new
* Under 'Source Address' - 'Address Book Entry' select 'Dial-Up VPN'
* Under 'Destination Address' select your desired target
* Under 'Action' select 'Tunnel'
* Under 'Tunnel' select your new gateway 'VPN_P2_GW'

[[File:Juniper-SSG-Certs-pic8.png]]

== Part III - Shrewsoft Client ==

Here only information is given about the certificate specific configuration. The rest of the client configuration is identical to the one described here [http://www.shrew.net/support/wiki/HowtoJuniperSsg]

[[File:Juniper-SSG-Certs-pic9.png]]

[[File:Juniper-SSG-Certs-pic10.png]]

Additionally you have to place the CA certificate (CA.crt) into: C:\Program Files\ShrewSoftPATH\VPN Client\certificates\CA.crt (at lesat if using a self created CA certificate, otherwise the shrewsoft client cannot check the authenticity of the Screenos certificate).

== Additional Information ==

Why do we need that subj.txt file?

Take a look at the certificate with the following command:

openssl x509 -in Screenos.crt -text -noout
...
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:vpn.mycompany.com
...

It seems this additional part is added automatically when the certificate is signed by a 'real' CA. In case you use openssl and self created certificates it seems this is not the case (unless configured).

== Sources ==
Juniper Forum Topic [http://www.juniperforum.com/index.php?topic=5628.0]

Howto Juniper SSG Using Certs

2013-01-09T05:09:10Z

Admin: /* Sources */

== Introduction ==

This guide describes how to setup a dial-up connection between a ScreenOS device and the Shrewsoft client, using certificates for mutual authentication. In this guide every user uses its own certificate. A self signed CA is setup and used for signing the certificates of the users and the ScreenOS device. Certificates are created by using openssl.

== Summary ==

Configuration of the ScreenOS device and the Shrewsoft client to use certificates does not differ very much from the xAuth setup. More tricky is the creation of the certificates, especially when self-signed certificates are used:
* Make sure that your ScreenOS certificate contains a 'Subject Alternative Name' in this format: 'DNS:<vpn.mycompany.com>' (FQDN)
* Make sure that your Client certificates contain a 'Subject Alternative Name' in this format: 'email:<UserX@mycompany.com>' (UFQDN)
Additionally, the ScreenOS and the Shrewsoft client have to be configured to use xAuth authentication in the 'Auto Key Advanced' section.

== Part 1 - Certificates ==

=== Root CA - Create Root CA Certificate ===

Creating private key for CA

openssl genrsa -des3 -out CA.key 4096

Create root certificate

openssl req -new -x509 -days 7300 -key CA.key -out CA.crt

Output: CA.crt (certificate)

Output: CA.key (private key of certificate)

=== Root CA - Install Root CA Certificate ===

Load root CA certificate to the ScreenOS Device
* Objects -> Certificates (navigate to you local CA.crt file and upload it)

Disable certification revocation list (optional). If you do not want / need to maintain a certificate revocation list you can disable it on the screenos device. [01] explains how to do this.

=== ScreenOS Certificate - Creation ===
Create Certificate
* Objects -> Certificates -> New

Define some meaningful string for 'FQDN' (vpn.mycompany.com), then chose 'Generate'. Now the ScreenOS device creates the certificate and a certificate signing request (CSR). Export the csr file to having it signed by your CA.

Output: Screenos_csr.txt (Certificate Signing Request)

=== ScreenOS Certificate - Sign CSR ===
As described here [01], if you use some self created CA certificate, create a text file named subj.txt containing the string 'subjectAltName="DNS:vpn.mycompany.com"'

openssl x509 -req -days 7300 -in Screenos_csr.txt -CA CA.crt \
-CAkey CA.key -set_serial 01 -out Screenos.crt -extfile subj.txt

Output: Screenos.crt (Screenos Device Certificate)

=== ScreenOS Certificate - Upload Certificate ===

Objects -> Certificates
* Navigate to the location of certificate, select certificate
* Confirm with 'Load'

=== User Certificate - Creation ===

Create private key for user X

openssl genrsa -des3 -out UserX.key 4096

Create certificate signing request

openssl req -new -key UserX.key -out UserX.csr -subj "/CN=UserX/emailAddress=UserX@mycompany.com"

=== User Certificate - Sign CSR ===
If you use some self created CA certificate create a file subj.txt with the string 'subjectAltName="email:UserX@mycompany.com"'

openssl x509 -req -days 3650 -in UserX.csr -CA CA.crt -CAkey CA.key \
-set_serial 01 -out UserX.crt -extfile subj.txt

== Part II - ScreenOS Setup ==

=== New User ===

Create a new user object for every user:
* Objects -> Users -> Local -> new
** Important here it that you select 'IKE User' - 'Simple Identity' and place 'UserX@mycompany.com' into the 'IKE Identity' field
** Additionally select 'XAuth User' and define a password (or use e.g. xAuth with your radius server).

[[File:Juniper-SSG-Certs-pic1.png]]

=== New Group ===

Create a new group and add the defined users to this group
* Objects -> Users -> Local Groups -> new
** Add the users and add them to the group

[[File:Juniper-SSG-Certs-pic2.png]]

=== New Gateway ===

Create a new Gateway object

* VPNs -> AutoKey Advanced -> Gateway -> new
** Select 'Dialup User Group' and select the group you previously defined
** Advanced
*** Select correct outgoing interface (were your device is connected to the internet)
*** Under 'Security Level' select 'Custom' and chose 'rsa-g2-3des-sha'
*** Under 'Mode' selet 'aggressive'
*** Select 'Enable NAT-Traversal'
*** Under 'Peer Status Detection' select DPD and enter 30 seconds for 'Interval'
*** Under 'Preffered Certificate' select
**** Signed certificate (Screenos.crt) in 'Local Cert'
**** CA certificate (CA.crt) in 'Peer CA'

[[File:Juniper-SSG-Certs-pic3.png]]

[[File:Juniper-SSG-Certs-pic4.png]]

=== New Gateway - XAuth ===

* Click on Xauth on the new created Gateway object
* Select 'XAuth Server' - 'Allowed Authentication Type' Generic
* Select 'Local Authentication' - 'User Group' - <Name of your group previously configured>

[[File:Juniper-SSG-Certs-pic5.png]]

Note: Of course here you can also you your radius server

=== New IKE Instance ===

* VPNs -> Autokey IKE -> new
* Select 'Remote Gateway' - 'Predefined' and chose your previously created Gateway object
* Advanced
* Under 'Security Level' select 'Custom' and chose:
* nopfs-esp-3des-sha nopfs-esp-3des-md5
* nopfs-esp-aes128-sha nopfs-esp-aes128-md5
* Mark 'Replay Protection'
* Adapt other setting to your needs
* Under 'Action' select 'Tunnel'
* Under 'Tunnel' select your previously created IKE object

[[File:Juniper-SSG-Certs-pic6.png]]

[[File:Juniper-SSG-Certs-pic7.png]]

=== New Security Policy ===
Configure the security policy to your needs:

* Policy -> Policies
* Select From 'Untrust' TO 'Trust' and click new
* Under 'Source Address' - 'Address Book Entry' select 'Dial-Up VPN'
* Under 'Destination Address' select your desired target
* Under 'Action' select 'Tunnel'
* Under 'Tunnel' select your new gateway 'VPN_P2_GW'

[[File:Juniper-SSG-Certs-pic8.png]]

== Part III - Shrewsoft Client ==

Here only information is given about the certificate specific configuration. The rest of the client configuration is identical to the one described here [http://www.shrew.net/support/wiki/HowtoJuniperSsg]

[[File:Juniper-SSG-Certs-pic9.png]]

[[File:Juniper-SSG-Certs-pic10.png]]

Additionally you have to place the CA certificate (CA.crt) into: C:\Program Files\ShrewSoftPATH\VPN Client\certificates\CA.crt (at lesat if using a self created CA certificate, otherwise the shrewsoft client cannot check the authenticity of the Screenos certificate).

== Additional Information ==

Why do we need that subj.txt file?

Take a look at the certificate with the following command:

openssl x509 -in Screenos.crt -text -noout
...
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:vpn.mycompany.com
...

It seems this additional part is added automatically when the certificate is signed by a 'real' CA. In case you use openssl and self created certificates it seems this is not the case (unless configured).

== Sources ==
[http://www.juniperforum.com/index.php?topic=5628.0]

Howto Juniper SSG Using Certs

2013-01-09T05:08:22Z

Admin: /* Additional Information */

== Introduction ==

This guide describes how to setup a dial-up connection between a ScreenOS device and the Shrewsoft client, using certificates for mutual authentication. In this guide every user uses its own certificate. A self signed CA is setup and used for signing the certificates of the users and the ScreenOS device. Certificates are created by using openssl.

== Summary ==

Configuration of the ScreenOS device and the Shrewsoft client to use certificates does not differ very much from the xAuth setup. More tricky is the creation of the certificates, especially when self-signed certificates are used:
* Make sure that your ScreenOS certificate contains a 'Subject Alternative Name' in this format: 'DNS:<vpn.mycompany.com>' (FQDN)
* Make sure that your Client certificates contain a 'Subject Alternative Name' in this format: 'email:<UserX@mycompany.com>' (UFQDN)
Additionally, the ScreenOS and the Shrewsoft client have to be configured to use xAuth authentication in the 'Auto Key Advanced' section.

== Part 1 - Certificates ==

=== Root CA - Create Root CA Certificate ===

Creating private key for CA

openssl genrsa -des3 -out CA.key 4096

Create root certificate

openssl req -new -x509 -days 7300 -key CA.key -out CA.crt

Output: CA.crt (certificate)

Output: CA.key (private key of certificate)

=== Root CA - Install Root CA Certificate ===

Load root CA certificate to the ScreenOS Device
* Objects -> Certificates (navigate to you local CA.crt file and upload it)

Disable certification revocation list (optional). If you do not want / need to maintain a certificate revocation list you can disable it on the screenos device. [01] explains how to do this.

=== ScreenOS Certificate - Creation ===
Create Certificate
* Objects -> Certificates -> New

Define some meaningful string for 'FQDN' (vpn.mycompany.com), then chose 'Generate'. Now the ScreenOS device creates the certificate and a certificate signing request (CSR). Export the csr file to having it signed by your CA.

Output: Screenos_csr.txt (Certificate Signing Request)

=== ScreenOS Certificate - Sign CSR ===
As described here [01], if you use some self created CA certificate, create a text file named subj.txt containing the string 'subjectAltName="DNS:vpn.mycompany.com"'

openssl x509 -req -days 7300 -in Screenos_csr.txt -CA CA.crt \
-CAkey CA.key -set_serial 01 -out Screenos.crt -extfile subj.txt

Output: Screenos.crt (Screenos Device Certificate)

=== ScreenOS Certificate - Upload Certificate ===

Objects -> Certificates
* Navigate to the location of certificate, select certificate
* Confirm with 'Load'

=== User Certificate - Creation ===

Create private key for user X

openssl genrsa -des3 -out UserX.key 4096

Create certificate signing request

openssl req -new -key UserX.key -out UserX.csr -subj "/CN=UserX/emailAddress=UserX@mycompany.com"

=== User Certificate - Sign CSR ===
If you use some self created CA certificate create a file subj.txt with the string 'subjectAltName="email:UserX@mycompany.com"'

openssl x509 -req -days 3650 -in UserX.csr -CA CA.crt -CAkey CA.key \
-set_serial 01 -out UserX.crt -extfile subj.txt

== Part II - ScreenOS Setup ==

=== New User ===

Create a new user object for every user:
* Objects -> Users -> Local -> new
** Important here it that you select 'IKE User' - 'Simple Identity' and place 'UserX@mycompany.com' into the 'IKE Identity' field
** Additionally select 'XAuth User' and define a password (or use e.g. xAuth with your radius server).

[[File:Juniper-SSG-Certs-pic1.png]]

=== New Group ===

Create a new group and add the defined users to this group
* Objects -> Users -> Local Groups -> new
** Add the users and add them to the group

[[File:Juniper-SSG-Certs-pic2.png]]

=== New Gateway ===

Create a new Gateway object

* VPNs -> AutoKey Advanced -> Gateway -> new
** Select 'Dialup User Group' and select the group you previously defined
** Advanced
*** Select correct outgoing interface (were your device is connected to the internet)
*** Under 'Security Level' select 'Custom' and chose 'rsa-g2-3des-sha'
*** Under 'Mode' selet 'aggressive'
*** Select 'Enable NAT-Traversal'
*** Under 'Peer Status Detection' select DPD and enter 30 seconds for 'Interval'
*** Under 'Preffered Certificate' select
**** Signed certificate (Screenos.crt) in 'Local Cert'
**** CA certificate (CA.crt) in 'Peer CA'

[[File:Juniper-SSG-Certs-pic3.png]]

[[File:Juniper-SSG-Certs-pic4.png]]

=== New Gateway - XAuth ===

* Click on Xauth on the new created Gateway object
* Select 'XAuth Server' - 'Allowed Authentication Type' Generic
* Select 'Local Authentication' - 'User Group' - <Name of your group previously configured>

[[File:Juniper-SSG-Certs-pic5.png]]

Note: Of course here you can also you your radius server

=== New IKE Instance ===

* VPNs -> Autokey IKE -> new
* Select 'Remote Gateway' - 'Predefined' and chose your previously created Gateway object
* Advanced
* Under 'Security Level' select 'Custom' and chose:
* nopfs-esp-3des-sha nopfs-esp-3des-md5
* nopfs-esp-aes128-sha nopfs-esp-aes128-md5
* Mark 'Replay Protection'
* Adapt other setting to your needs
* Under 'Action' select 'Tunnel'
* Under 'Tunnel' select your previously created IKE object

[[File:Juniper-SSG-Certs-pic6.png]]

[[File:Juniper-SSG-Certs-pic7.png]]

=== New Security Policy ===
Configure the security policy to your needs:

* Policy -> Policies
* Select From 'Untrust' TO 'Trust' and click new
* Under 'Source Address' - 'Address Book Entry' select 'Dial-Up VPN'
* Under 'Destination Address' select your desired target
* Under 'Action' select 'Tunnel'
* Under 'Tunnel' select your new gateway 'VPN_P2_GW'

[[File:Juniper-SSG-Certs-pic8.png]]

== Part III - Shrewsoft Client ==

Here only information is given about the certificate specific configuration. The rest of the client configuration is identical to the one described here [http://www.shrew.net/support/wiki/HowtoJuniperSsg]

[[File:Juniper-SSG-Certs-pic9.png]]

[[File:Juniper-SSG-Certs-pic10.png]]

Additionally you have to place the CA certificate (CA.crt) into: C:\Program Files\ShrewSoftPATH\VPN Client\certificates\CA.crt (at lesat if using a self created CA certificate, otherwise the shrewsoft client cannot check the authenticity of the Screenos certificate).

== Additional Information ==

Why do we need that subj.txt file?

Take a look at the certificate with the following command:

openssl x509 -in Screenos.crt -text -noout
...
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:vpn.mycompany.com
...

It seems this additional part is added automatically when the certificate is signed by a 'real' CA. In case you use openssl and self created certificates it seems this is not the case (unless configured).

== Sources ==
[http://http://www.juniperforum.com/index.php?topic=5628.0]

Howto Juniper SSG

2013-01-09T05:07:08Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure a Juniper SSG or Netscreen device running firmware version 5.4+ to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been tested with Juniper products to ensure interoperability.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client uses the push configuration method to acquire the following parameters automatically from the gateway.

*IP Address
*IP Netmask
*DNS Servers
*WINS Servers

== Gateway Configuration ==

This example assumes you have knowledge of the Juniper gateway Web configuration interface. For more information, please consult your Juniper product documentation.

=== Create a Phase1 ID ===

Create a user that is used to define the phase1 id parameters. Navigate to the following screen using the tree pane on the left hand side of the browser interface.

[[File:Juniper-SSG-nav-1.jpg]]

Click the New button and define the following parameters.

*User Name = vpnclient_ph1id
*Status = Enabled
*IKE User = Checked
**Simple Identity = Selected
**IKE ID Type = AUTO
**IKE Identity = client.domain.com

[[File:Juniper-SSG-pic-1.jpg]]

=== Create a Local Key Group ===

Create a Local Group that can be assigned to an Auto Key Advanced Gateway. Navigate to the following screen using the tree pane on the left hand side of the browser interface.

[[File:Juniper-SSG-nav-2.jpg]]

Click the New button and define the group name as vpnclient_group. Also add the vpnclient_ph1id user object as a group member.

[[File:Juniper-SSG-pic-2.jpg]]

=== Create an Auto Key Advanced Gateway ===

Create an auto key advanced gateway to configure the phase1 parameters. Navigate to the following screen using the tree pane on the left hand side of the browser interface.

[[File:Juniper-SSG-nav-3.jpg]]

Click the New button and define the following parameters.

*Gateway Name = vpnclient_gateway
*Security Level = Custom
*Remote Gateway Type = Dialup User Group
*Group = vpnclient_group
*Preshared Key = mypresharedkey
*Local ID = vpngw.domain.com

[[File:Juniper-SSG-pic-3a.jpg]]

==== Define Advanced Parameters ====

Click the Advanced button and define the following parameters.

*Security Level - Custom
**Phase 1 Proposal
**pre-g2-3des-sha
**pre-g2-3des-md5
**pre-g2-aes128-sha
**pre-g2-aes128-md5
*Mode = Aggressive
*Enable NAT-Traversal = Checked
**Keepalive Frequency = 20
*Peer Status Detection
**DPD = Selected
**Interval = 30
**Retry = 5

When finished click Return.

[[File:Juniper-SSG-pic-3b.jpg]]

=== Define Xauth Parameters ===

You will now see your auto key advanced gateway listed. Click non the Xauth button in the Configure column.

[[File:Juniper-SSG-nav-4.jpg]]

Define the following parameters.

*Xauth Server = Selected
**Allowed Authentication Type = Generic
**Local Authentication = Selected
**Allow Any = Selected

When finished click OK.

[[File:Juniper-SSG-pic-4.jpg]]

=== Create an Auto Key IKE Gateway ===

Create an auto key IKE gateway to configure the phase2 parameters. Navigate to the following screen using the tree pane on the left hand side of the browser interface.

[[File:Juniper-SSG-nav-5.jpg]]

Clicking the New button and define the following parameters.

*VPN Name = vpnclient_tunnel
*Security Level = Custom
*Remote Gateway Predefined = vpnclient_gateway

[[File:Juniper-SSG-pic-5a.jpg]]

==== Define Advanced Parameters ====

Click the Advanced button and define the following parameters.

*Security Level = Custom
**nopfs-esp-3des-sha
**nopfs-esp-3des-md5
**nopfs-esp-aes128-sha
**nopfs-esp-aes128-md5
*Replay Protection = Checked

When finished click Return.

[[File:Juniper-SSG-pic-5b.jpg]]

=== Create a Client Address Pool ===

Create a pool of addresses to be assigned to VPN clients. Navigate to the following screen using the tree pane on the left hand side of the browser interface.

[[File:Juniper-SSG-nav-6.jpg]]

Clicking the New button and define an IP Pool. For example, you could define a pool
named vpnclient with a start IP address of 10.2.21.1 and and end address of 10.2.21.254.

[[File:Juniper-SSG-pic-6.jpg]]

=== Set Client Configuration Parameters ===

The client configuration parameters are stored in the global Auto Key Advanced XAuth
parameters. Navigate to the following screen using the tree pane on the left hand side of the browser interface.

[[File:Juniper-SSG-nav-7.jpg]]

Define the following parameters.

*Reserve Private IP for XAuth User - 480 minutes
*Default Authentication Server = Local
*Query Client Settings on Default Server - Unchecked
*CHAP - Unchecked
*IP Pool Name = vpnclient
*DNS Primary Server IP = [ private DNS server address ]
*DNS Secondary Server IP = [ private DNS secondary address ]
*WINS Primary Server IP = [ private WINS server address ]
*WINS Secondary Server IP = [ private WINS secondary address ]

[[File:Juniper-SSG-pic-7.jpg]]

=== Configure IPsec Policies ===

The last step for the tunnel configuration is to define policies that allow protected traffic to pass into your private network from the client. Navigate to the following screen using the tree pane on the left hand side of the browser interface.

[[File:Juniper-SSG-nav-8.jpg]]

To create a new IPsec Policy, the from and to zones must be specified. An IPsec VPN Client policy is defined. Select the following zones and click the New button.

*From = Untrust
*To = Trust

[[File:Juniper-SSG-pic-8a.jpg]]

Define the following parameters.

*Name = vpnclient_inbound
*Source Address
**Address Book Entry = Dial-UP VPN
*Destination Address
**New Address = 10.1.2.0/24
*Service = ANY
*Application = None ( means ANY )
*Action = Tunnel
*Tunnel = vpnclient_tunnel [ Auto Key IKE vpn name ]

[[File:Juniper-SSG-pic-8b.jpg]]

=== Create Local User Accounts ===

Create local user accounts that will be used during Xauth. Navigate to the following screen using the tree pane on the left hand side of the browser interface.

[[File:Juniper-SSG-nav-1.jpg]]

Click the new button and define the following parameters.

*User Name - joe ( the xauth user name )
*Status - Enable
*XAuth User - Checked
**User Password - **** ( the xauth user password )
**Confirm Password - **** ( the same user password )

When finished press OK.

[[File:Juniper-SSG-pic-9.jpg]]

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. This ''Host Name or IP Address'' is defined to match the Junipers public interface address. The ''Auto Configuration'' mode should be set to ''ike config push''.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' to match the Auto Key IKE Advanced definition.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.

==== Local Identity Tab ====

The Local Identity parameters are defined as ''Fully Qualified Domain Name'' with a ''FQDN String'' of "client.domain.com" to match the Phase1 User ID value.

==== Remote Identity Tab ====

The Remote Identity parameters are defined as ''Fully Qualified Domain Name'' with a ''FQDN String'' of "vpngw.domain.com" to match the Auto Key Advanced Gateway ID value.

==== Credentials Tab ====

The Credentials ''Pre Shared Key'' is defined as "mypresharedkey" to match the Auto Key Advanced Gateway Preshared Key value.

=== Policy Tab ===

The IPsec Policy information must be manually configured when communicating with Juniper gateways. Create an include Topology entry for each IPsec Policy network created on the gateway. For our example, a single Topology Entry is defined to include the 10.1.2.0/24 network.

== Known Issues ==

None reported.

== Resources ==

[[Media:juniperssg.vpn.txt]]

File:Juniperssg.vpn.txt

2013-01-09T05:06:38Z

Admin: Example client configuration file.

Example client configuration file.

Howto Fortigate

2013-01-09T05:03:56Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure a Fortigate device to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been tested with Fortigate products to ensure interoperability.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client uses the DHCP over IPsec configuration method to acquire the following parameters automatically from the gateway.

*IP Address
*IP Netmask
*DNS Servers
*DNS Default Domain Suffix
*WINS Servers

== Gateway Configuration ==

This example assumes you have knowledge of the Fortigate web configuration interface. For more information, please consult your Fortigate product documentation.

=== Interfaces ===

Two network interfaces are configured. The wan interface has a static public IP address of 10.1.1.22 which faces the internet. The internal interface has a static private IP address of 10.1.2.22 which faces the internal private network. The default gateway is configured as 1.1.1.1 via the WAN interface.

=== Address Definitions ===

Several address definitions must be created. These will be used later in other parts of the gateway configuration. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[File:Fortigate-nav-1a.jpg]]

To create a new address definition, click on the ''Create New'' button at the top of the page.

[[File:Fortigate-nav-1b.jpg]]

=== Wan Interface Entry ===

Create an address definition to represent the IP address of the public interface. This will be used later in a firewall policy definition to allow clients to communicate with the DHCP server via IPsec.

Define the following parameters.

*Address Name = gateway_wan1
*Type = Subnet / IP Range
*Subnet / IP Range = 10.1.1.22/255.255.255.255
*Interface = wan1 [ or your external interface ]

When finished click OK.

[[File:Fortigate-pic-1a.jpg]]

=== Private Network Entry ===

Create an address definition to represent the private network protected by the Fortigate. This will be used later in a firewall policy definition to allow clients to communicate with the private network via IPsec.

Define the following parameters.

*Address Name = gateway_prvnet1
*Type = Subnet / IP Range
*Subnet / IP Range = 10.1.2.0/255.255.255.0
*Interface = internal [ or your internal interface ]

When finished click OK.

[[File:Fortigate-pic-1b.jpg]]

=== DHCP Server Parameters ===

An IPsec over DHCP server must be created. This will define the parameters to be assigned to clients when they connect. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[File:Fortigate-nav-2a.jpg]]

To create a new DHCP server definition, click on the arrow next to your external interface name to expand the options. Then click on the plus icon to the right of the ''Servers'' option.

[[File:Fortigate-nav-2b.jpg]]

When defining your DHCP parameters, make sure you select an address range that does not overlap with any private network protected by the Fortigate unit.

Define the following parameters.

*Name = vpnclient_dhcp
*Enable = Checked
*Type = IPSEC
*IP Range = 10.2.22.2 - 10.2.22.64 [ or your desired range ]
*Network Mask = 255.255.255.0
*Default Gateway = 10.2.22.1
*Domain = yourdomain.com
*Lease Time = 1 day

When finished click OK.
[[File:Fortigate-pic-2.jpg]]

=== Dialup Users ===

Dialup user accounts must be created. These will be the user name and passwords a remote access users will use to authenticate with the gateway. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[File:Fortigate-nav-3a.jpg]]

To create a new user, click on the ''Create New'' button at the top of the page.

[[File:Fortigate-nav-3b.jpg]]

Define the following parameters for each user account.

*User Name = User account name
*Password = User account password

When finished click OK.

[[File:Fortigate-pic-3.jpg]]

=== Dialup User Group ===

A dialup user group must be created. By placing a user account in this group, it will allow them to access the gateway using the client software. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[File:Fortigate-nav-4a.jpg]]

To create a new user group, click on the ''Create New'' button at the top of the page.

[[File:Fortigate-nav-4b.jpg]]

Define the following parameters for each user account.

*Name = vpnclient_usergroup
*Type = Firewall
*Protection Profile = unfiltered

Next, select the remote access user account names from the left hand ''Available'' list and add them to the right hand ''Members'' list.

When finished click OK.

[[File:Fortigate-pic-4.jpg]]

=== Phase 1 Parameters ===

The IKE phase 1 parameters must be configured for our remote access connections. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[File:Fortigate-nav-5a.jpg]]

To create a new Phase 1 definition, click on the ''Create Phase 1'' button at the top of the screen.

[[File:Fortigate-nav-5b.jpg]]

Define the following parameters.

*Name = vpnclient_phase1
*Remote Gateway = Dialup User
*Local Interface = wan1 [ or your external interface ]
*Mode = Aggressive
*Authentication Method = Preshared Key
*Preshared Key = mypresharedkey
*Peer Options
**Accept this peer ID = vpnclient.yourdomain.com

Advanced

*Local Gateway IP = Main Interface IP
*P1 Proposal
**1 - Encryption / Authentication = 3DES / MD5
**2 - Encryption / Authentication = AES256 / MD5
**DH Group = 2
**Keylife = 28800 seconds
**Local ID = [ blank ]
*XAuth = Enable as Server
**Server Type = AUTO
**User Group = vpnclient_usergroup
**Nat Traversal = Checked
**Keepalive Frequency = 10 seconds
**Dead Peer Detection = Checked

When finished click OK.

[[File:Fortigate-pic-5a.jpg]]

=== Phase 2 Parameters ===

The IKE phase 2 parameters must be configured for our remote access connections. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[File:Fortigate-nav-5a.jpg]]

To create a new Phase 2 definition, click on the ''Create Phase 1'' button at the top of the screen.

[[File:Fortigate-nav-5c.jpg]]

Define the following parameters.

*Name = vpnclient_phase2
*Phase 1 = vpnclient_phase1

Advanced

*P2 Proposal
**1 - Encryption / Authentication = 3DES / MD5
**2 - Encryption / Authentication = AES256 / MD5
**Enable replay detection = Checked
**Enable perfect forward secrecy = Unchecked
**Keylife = 3600 seconds
**Autokey Keep Alive = Unchecked
**DHCP-IPsec = Checked
*Quick Mode Selector
**Source address = 0.0.0.0/0
**Source port = 0
**Destination address = 0.0.0.0/0
**Destination port = 0
**Destination protocol = 0

When finished click OK.

[[File:Fortigate-pic-5b.jpg]]

=== Firewall Policies ===

Firewall policies must be created to define the resources remote access clients will have access to. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[File:Fortigate-nav-6a.jpg]]

To create a new policy, click the ''Create New'' button at the top of the screen.

[[File:Fortigate-nav-6b.jpg]]

The first policy will allow clients to communicate with the external interface DHCP server.

Define the following parameters.

*Enable Policy = Checked
*Source
**Interface / Zone = wan1 [ or your external interface ]
**Address Name = gateway_wan1
*Destination
**Interface / Zone = wan1 [ or your external interface ]
**Address Name = all
*Schedule = always
*Service = DHCP
*Action = IPSEC
*VPN Tunnel = vpnclient_phase1
*Allow Inbound = Checked
*Allow Outbound = Checked
*Inbound NAT = Unchecked
*Outbound NAT = Unchecked

When finished click OK.

[[File:Fortigate-pic-6a.jpg]]

The second policy will allow clients to communicate with the private network protected by the Fortigate. A seperate policy needs to be created for each private network that should be accessible to remote access clients.

Define the following parameters.

*Enable Policy = Checked
*Source
**Interface / Zone = internal [ or your internal interface ]
**Address Name = gateway_prvnet1
*Destination
**Interface / Zone = wan1 [ or your external interface ]
**Address Name = all
*Schedule = always
*Service = ANY
*Action = IPSEC
*VPN Tunnel = vpnclient_phase1
*Allow Inbound = Checked
*Allow Outbound = Checked
*Inbound NAT = Unchecked
*Outbound NAT = Unchecked

When finished click OK.

[[File:Fortigate-pic-6b.jpg]]

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. This ''Host Name or IP Address'' is defined as 10.1.2.22 to match the Fortigate wan interface address. The Auto Configuration option is set to ''dhcp over ipsec''.

=== Phase 1 Tab ===

The Proposal section must be configured to match the Fortigate Phase 1 definition. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2''.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.

==== Local Identity Tab ====

The Local Identity parameters are defined as ''Fully Qualified Domain Name'' with a ''FQDN String'' of "vpnclient.domain.com" to match the Fortigate Phase 1 definition.

==== Remote Identity Tab ====

The Remote Identity parameters are set to IP Address with the Use a discovered remote host address option checked to match the Zywall Gateway Policy definition.

==== Credentials Tab ====

The Credentials ''Pre Shared Key'' is defined as "mypresharedkey" to match the match the Zywall Gateway Policy definition.

=== Policy Tab ===

The IPsec Policy configuration must be manually configured when communicating with Fortigate gateways. A single Topology Entry is defined to include the 10.1.2.0/24 network.

== Known Issues ==

There is a known issue with Fortigate firmware revision 3.00-b0660(MR6). The problem prevents Xauth ( user authentication ) from working with peers that correctly implement the RFC draft. To correct this issue, upgrade your Fortigate unit to firmware revision 3.00-b0668(MR6 Patch 2) or downgrade to an older firmware version.

== Resources ==

[[Media:fortigate.vpn.txt]]

Howto Fortigate

2013-01-09T05:03:45Z

Admin: /* Resources */

File:Fortigate.vpn.txt

2013-01-09T05:02:36Z

Admin: Example client configuration.

Example client configuration.

Howto Draytek

2013-01-09T05:00:59Z

Admin:

The Shrew Soft Client has been reported to work with Draytek products. If you have experience with this gateway type and use it in conjunction with the Shrew Soft VPN Client, please consider contributing a Wiki howto document. For more details on how to contribute, please contact us.

The following German Language guide is available from the Draytek website.

[http://alt.draytek.de/Beispiele/VPN/ShrewSoft_Client.pdf Gateway and Client Configuration guide]

Howto Cisco Pix

2013-01-09T04:58:20Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure a Cisco PIX device running firmware version 6.x to support IPsec VPN client connectivity. If you have a PIX device running firmware version 7.x, please consult the HowtoCiscoAsa. The Shrew Soft VPN Client has been tested with Cisco products to ensure interoperability.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client uses the pull configuration method to acquire the following parameters automatically from the gateway.

* IP Address
* IP Netmask
* DNS Servers
* DNS Default Domain Suffix
* DNS Split Network Domain List
* Remote Network Topology

== Gateway Configuration ==

This example assumes you have knowledge of the Cisco PIX gateway command line configuration interface. For more information, please consult your Cisco product documentation.

=== Interfaces ===

Two network interfaces are configured. The ''outside'' interface has a static public IP address of 1.1.1.2 which faces the internet. The ''inside'' interface has a static private IP address that faces the internal private network. The default gateway is configured as 1.1.1.2 via the outside interface.

nameif ethernet0 outside security0
nameif ethernet1 inside security100
ip address outside 1.1.1.2 255.255.255.224
ip address inside 172.17.0.6 255.255.0.0
route outside 0.0.0.0 0.0.0.0 1.1.1.1 1

=== Access List ===

An access lists must be configured to define the IPSec policies. This is expressed with the source matching the local private network(s) and the destination matching the remote client network address pool. A single single local network of 172.17.0.0/16 and an address pool of 172.18.0.0/24 is defined.

access-list in2out permit ip 172.17.0.0 255.255.0.0 172.18.0.0 255.255.255.0

=== Address Pool ===

The IP address pool must be configured. Clients will be assigned private network addresses from a class C pool of 172.18.0.0/24.

ip local pool clientpool 172.18.0.2-172.18.0.11 mask 255.255.255.0

=== User Authentication ===

User authentication must be configured to support IKE extended authentication ( XAuth ). In this example, we use define user accounts locally on the PIX. It is possible to pass this authentication to a radius or an LDAP account server using the Cisco AAA authentication mechanism. For more information, please consult your cisco product documentation.

aaa-server LOCAL protocol local
username bill password XXX encrypted privilege 2
username bob password XXX encrypted privilege 2

=== ISAKMP Parameters ===

The ISAKMP protocol must be enabled on the outside ( public ) interface and an ISAKMP policy must be configured. NAT Traversal is also enabled to allow clients to communicate effectively when their peer address is being translated. The keep alive packet rate is set to 20 seconds.

isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp log 25
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption aes-256
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400

=== IPsec Parameters ===

A transform set and dynamic IPsec crypto map must be configured to support client VPN connections. The dynamic crypto map is then assigned to a standard crypto map and bound to the outside ( public ) interface. Local user authentication is also enabled.

crypto ipsec transform-set trset2 esp-aes-256 esp-md5-hmac
crypto dynamic-map ipsec_map 1 set transform-set trset2
crypto map outside_map 65535 ipsec-isakmp dynamic ipsec_map
crypto map outside_map client authentication LOCAL
crypto map outside_map interface outside

=== VPN Group ===

A VPN group must be defined to provide the client with dynamic configuration information. The client uses the VPN group name as its FQDN identity value and the VPN group password as its pre-shared key value.

vpngroup remoteClient address-pool clientpool
vpngroup remoteClient dns-server 172.17.0.2
vpngroup remoteClient default-domain abc.com
vpngroup remoteClient split-tunnel in2out
vpngroup remoteClient split-dns abc.com
vpngroup remoteClient idle-time 1800
vpngroup remoteClient password mypresharedkey

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. This ''Host Name or IP Address'' is defined as '''10.1.1.2''' to match the PIX outside ( public ) interface address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' to match the PIX ISAKMP policy definition.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.

==== Local Identity Tab ====

The Local Identity parameters are defined as ''Key Identifier'' with a ''Key ID String'' of "remoteClient" to match the PIX VPN group name.

==== Remote Identity Tab ====

The Remote Identity parameters are set to ''IP Address'' with the ''Use a discovered remote host address'' option checked to match the PIX ISAKMP ''identity'' parameter.

==== Credentials Tab ====

The Credentials ''Pre Shared Key'' is defined as "mypresharedkey" to match the PIX VPN group password.

== Known Issues ==

Cisco gateways support a proprietary form of hybrid authentication which does not conform to RFC draft standards. At this time the Shrew Soft VPN Client does not support this authentication mode. We hope to add support for this in the future.

== Resources ==

[[Media:Ciscopix.cfg.txt]] 
[[Media:Ciscopix.vpn.txt]]

== Credits ==

Most of the information in this guide was submitted by Marc Goldburg.

Howto Cisco Pix

2013-01-09T04:58:08Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure a Cisco PIX device running firmware version 6.x to support IPsec VPN client connectivity. If you have a PIX device running firmware version 7.x, please consult the HowtoCiscoAsa. The Shrew Soft VPN Client has been tested with Cisco products to ensure interoperability.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client uses the pull configuration method to acquire the following parameters automatically from the gateway.

* IP Address
* IP Netmask
* DNS Servers
* DNS Default Domain Suffix
* DNS Split Network Domain List
* Remote Network Topology

== Gateway Configuration ==

This example assumes you have knowledge of the Cisco PIX gateway command line configuration interface. For more information, please consult your Cisco product documentation.

=== Interfaces ===

Two network interfaces are configured. The ''outside'' interface has a static public IP address of 1.1.1.2 which faces the internet. The ''inside'' interface has a static private IP address that faces the internal private network. The default gateway is configured as 1.1.1.2 via the outside interface.

nameif ethernet0 outside security0
nameif ethernet1 inside security100
ip address outside 1.1.1.2 255.255.255.224
ip address inside 172.17.0.6 255.255.0.0
route outside 0.0.0.0 0.0.0.0 1.1.1.1 1

=== Access List ===

An access lists must be configured to define the IPSec policies. This is expressed with the source matching the local private network(s) and the destination matching the remote client network address pool. A single single local network of 172.17.0.0/16 and an address pool of 172.18.0.0/24 is defined.

access-list in2out permit ip 172.17.0.0 255.255.0.0 172.18.0.0 255.255.255.0

=== Address Pool ===

The IP address pool must be configured. Clients will be assigned private network addresses from a class C pool of 172.18.0.0/24.

ip local pool clientpool 172.18.0.2-172.18.0.11 mask 255.255.255.0

=== User Authentication ===

User authentication must be configured to support IKE extended authentication ( XAuth ). In this example, we use define user accounts locally on the PIX. It is possible to pass this authentication to a radius or an LDAP account server using the Cisco AAA authentication mechanism. For more information, please consult your cisco product documentation.

aaa-server LOCAL protocol local
username bill password XXX encrypted privilege 2
username bob password XXX encrypted privilege 2

=== ISAKMP Parameters ===

The ISAKMP protocol must be enabled on the outside ( public ) interface and an ISAKMP policy must be configured. NAT Traversal is also enabled to allow clients to communicate effectively when their peer address is being translated. The keep alive packet rate is set to 20 seconds.

isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp log 25
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption aes-256
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400

=== IPsec Parameters ===

A transform set and dynamic IPsec crypto map must be configured to support client VPN connections. The dynamic crypto map is then assigned to a standard crypto map and bound to the outside ( public ) interface. Local user authentication is also enabled.

crypto ipsec transform-set trset2 esp-aes-256 esp-md5-hmac
crypto dynamic-map ipsec_map 1 set transform-set trset2
crypto map outside_map 65535 ipsec-isakmp dynamic ipsec_map
crypto map outside_map client authentication LOCAL
crypto map outside_map interface outside

=== VPN Group ===

A VPN group must be defined to provide the client with dynamic configuration information. The client uses the VPN group name as its FQDN identity value and the VPN group password as its pre-shared key value.

vpngroup remoteClient address-pool clientpool
vpngroup remoteClient dns-server 172.17.0.2
vpngroup remoteClient default-domain abc.com
vpngroup remoteClient split-tunnel in2out
vpngroup remoteClient split-dns abc.com
vpngroup remoteClient idle-time 1800
vpngroup remoteClient password mypresharedkey

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. This ''Host Name or IP Address'' is defined as '''10.1.1.2''' to match the PIX outside ( public ) interface address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' to match the PIX ISAKMP policy definition.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.

==== Local Identity Tab ====

The Local Identity parameters are defined as ''Key Identifier'' with a ''Key ID String'' of "remoteClient" to match the PIX VPN group name.

==== Remote Identity Tab ====

The Remote Identity parameters are set to ''IP Address'' with the ''Use a discovered remote host address'' option checked to match the PIX ISAKMP ''identity'' parameter.

==== Credentials Tab ====

The Credentials ''Pre Shared Key'' is defined as "mypresharedkey" to match the PIX VPN group password.

== Known Issues ==

Cisco gateways support a proprietary form of hybrid authentication which does not conform to RFC draft standards. At this time the Shrew Soft VPN Client does not support this authentication mode. We hope to add support for this in the future.

== Resources ==

[[Media:Ciscopix.cfg.txt]]
[[Media:Ciscopix.vpn.txt]]

== Credits ==

Most of the information in this guide was submitted by Marc Goldburg.

File:Ciscopix.vpn.txt

2013-01-09T04:57:33Z

Admin: Example client configuration file.

Example client configuration file.

File:Ciscopix.cfg.txt

2013-01-09T04:57:22Z

Admin: Example PIX configuration file.

Example PIX configuration file.

Howto Cisco Asa

2013-01-09T04:54:52Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure a Cisco PIX/ASA device running firmware version 7.x to support IPsec VPN client connectivity. If you have a PIX device running firmware version 6.x, please consult the HowtoCiscoPix. The Shrew Soft VPN Client has been tested with Cisco products to ensure interoperability.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client uses the pull configuration method to acquire the following parameters automatically from the gateway.

* IP Address
* IP Netmask
* DNS Servers
* DNS Default Domain Suffix
* DNS Split Network Domain List
* WINS Servers
* PFS Group
* Remote Network Topology
* Login Banner

== Gateway Configuration ==

This example assumes you have knowledge of the Cisco ASA gateway command line configuration interface. For more information, please consult your Cisco product documentation.

=== Interfaces ===

Two network interfaces are configured. The ''outside'' interface has a static public IP address of 1.1.1.20 which faces the internet. The ''inside'' interface has a static private IP address that faces the internal private network. The default gateway is configured as 1.1.1.3 via the outside interface.

interface Vlan1
nameif inside
security-level 100
ip address 10.1.2.20 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 10.1.1.20 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!

=== Access List ===

An access lists must be configured to define the IPSec policies. This is expressed with the source matching the local private network(s) and the destination matching any as the VPN client address will be assigned by the gateway.

object-group network group-inside-vpnclient
description All inside accessible networks
network-object 10.1.2.0 255.255.255.0

access-list acl-vpnclient extended permit ip object-group group-inside-vpnclient any

=== Address Pool ===

The IP address pool must be configured. Clients will be assigned private network addresses from a pool of 10.2.20.1-10.2.20.126.

ip local pool ippool-vpnclient 10.2.20.1-10.2.20.126 mask 255.255.255.0

=== User Authentication ===

User authentication must be configured to support IKE extended authentication ( XAuth ). In this example, we use define user accounts locally on the ASA. It is possible to pass this authentication to a radius or an LDAP account server using the Cisco AAA authentication mechanism. For more information, please consult your cisco product documentation.

aaa authentication ssh console LOCAL
username bill password XXX encrypted
username bob password XXX encrypted

=== IPsec Parameters ===

A transform set and dynamic IPsec crypto map must be configured to support client VPN connections. The dynamic crypto map is then assigned to a standard crypto map and bound to the outside ( public ) interface.

crypto ipsec transform-set xform-3des-md5 esp-3des esp-md5-hmac
crypto dynamic-map dcmap-vpnclient 1 set transform-set xform-3des-md5
crypto map cmap-vpncient 65535 ipsec-isakmp dynamic dcmap-vpnclient
crypto map cmap-vpncient interface outside

=== ISAKMP Parameters ===

The ISAKMP protocol must be enabled on the outside ( public ) interface and an ISAKMP policy must be configured. NAT Traversal is also enabled to allow clients to communicate effectively when their peer address is being translated. The keep alive packet rate is set to 20 seconds.

crypto isakmp enable outside
crypto isakmp identity address
crypto isakmp nat-traversal 20
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

=== Group Policy ===

A group policy must be configured to provide the client with dynamic configuration information.

group-policy group-policy-default internal
group-policy group-policy-default attributes
banner value Welcome to the shrew.net ciscoasa
wins-server value 10.1.2.100 10.1.2.1
dns-server value 10.1.2.100 10.1.2.1
vpn-tunnel-protocol IPSec
password-storage disable
re-xauth disable
pfs disable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value acl-vpnclient
default-domain value shrew.net
split-dns value shrew.net example.com

=== Tunnel Group ===

A tunnel group must be configured to define the VPN Client tunnel parameters. It is created using the type ipsec-ra for IPsec remote access. The client uses the tunnel group name as its FQDN identity value and the tunnel group pre-shared-key as its pre-shared key value.

tunnel-group vpnclient type ipsec-ra
tunnel-group vpnclient general-attributes
address-pool ippool-vpnclient
default-group-policy group-policy-default
tunnel-group vpnclient ipsec-attributes
pre-shared-key mypresharedkey

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. The ''Host Name or IP Address'' is defined as '''10.1.1.20''' to match the ASA outside ( public ) interface address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' to match the ASA ISAKMP policy definition.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.

==== Local Identity Tab ====

The Local Identity parameters are defined as ''Fully Qualified Domain Name'' with a ''FQDN String'' of "vpnclient" to match the ASA tunnel group name.

==== Remote Identity Tab ====

The Remote Identity parameters are set to ''IP Address'' with the ''Use a discovered remote host address'' option checked to match the ASA ISAKMP ''identity'' parameter.

==== Credentials Tab ====

The Credentials ''Pre Shared Key'' is defined as "mypresharedkey" to match the ASA tunnel group pre-shared-key.

== Known Issues ==

Cisco gateways support a proprietary form of hybrid authentication which does not conform to RFC draft standards. At this time the Shrew Soft VPN Client does not support this authentication mode. We hope to add support for this in the future.

== Resources ==

[[Media:Ciscoasa.cfg.txt]] 
[[Media:Ciscoasa.vpn.txt]]

Howto Cisco Asa

2013-01-09T04:54:37Z

Admin: /* Resources */

File:Ciscoasa.vpn.txt

2013-01-09T04:53:55Z

Admin: Example client configuration file.

Example client configuration file.

File:Ciscoasa.cfg.txt

2013-01-09T04:53:40Z

Admin: Example ASA configuration file.

Example ASA configuration file.

Howto Checkpoint

2013-01-09T04:51:21Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure a device running Checkpoint NGX version 8.0.33 or higher to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been tested with Checkpoint NGX products to ensure interoperability. The configuration guild below shows examples from an Embedded NGX product.

NOTE: Checkpoint NGX is only supported by Shrew Soft Client version 2.1.5 RC2 or later.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client uses the pull configuration method to acquire the following parameters automatically from the gateway.

*IP Address
*IP Netmask
*DNS Servers
*WINS Servers

== Gateway Configuration ==

This example assumes you have knowledge of the Checkpoint NGX gateway web configuration interface. For more information, please consult your gateway product documentation.

=== Interfaces ===

Two network interfaces are configured. The Internet Primary interface has a static public IP address of 10.1.1.28 which faces the internet. The internal interface has a static private IP address of 10.1.2.28 which faces the internal private network. The default gateway is configured as 10.1.1.1 via the WAN interface.

=== Office Mode Network ===

The Office Mode Network is the Checkpoint name for the remote access client network configuration. To configure these settings, navigate to the Network page and click the My Network tab. Then click the ''Edit'' link that corresponds to the Office Mode network.

[[File:Checkpoint-nav-1.jpg]]

Define the following parameters.

*Mode = Enabled
*IP Address = 10.2.28.1
*Subnet Mask = 255.255.255.0

NOTE : The IP Address and Subnet Mask defines the network that will be used to assign client virtual addresses. It is important to use a network that does not overlap a private network that exists behind the Checkpoint gateway.

[[File:Checkpoint-pic-1.jpg]]

Click the ''Options'' link and define the following parameters.

*Domain Name = shrew.net
*DNS Server 1 = 10.1.2.100
*DNS Server 2 = 10.1.2.101
*WINS Server 1 = 10.1.2.100
*WINS Server 2 = 10.1.2.101

Click Apply when done.

[[File:Checkpoint-pic-2.jpg]]

=== Internal Users ===

Before users can authenticate, individual accounts must be created. To configure these accounts, navigate to the Users page and click the ''New User'' button.

[[File:Checkpoint-nav-2.jpg]]

Enter the basic user information including the User name and Password. Once done, click ''Next'' to continue.

[[File:Checkpoint-pic-3.jpg]]

Enter the permissions for the new user. Be sure to enable the VPN Remote Access option. Once done, click ''Finish'' to continue. Repeat this process for all users.

[[File:Checkpoint-pic-4.jpg]]

=== VPN Remote Access ===

Remote access support needs to be enabled before users can connect to the gateway using a VPN Client. To configure these settings, navigate to the VPN page and enable the following options.

*Allow Secur Remote users to connect from the internet
*Bypass NAT
*Bypass default firewall policy

[[File:Checkpoint-pic-5.jpg]]

=== Exporting the Certificate ===

In order for the client to VPN Client to correctly validate the Checkpoint gateway, it needs to have a copy of the certificate authority which contains the public key used for RSA authentication. To download the certificate from he gateway, click the ''Export CA Certificate'' button.

NOTE : Firmware versions prior to 8.0.33 do not support certificate export.

[[File:Checkpoint-pic-6.jpg]]

=== Converting the Certificate ===

In a perfect world we would be done. Unfortunately, OpenSSL and Checkpoint apparently disagree on the PKCS#12 certificate container format. Since the VPN Client uses the OpenSSL library to read certificate files, we need to convert it into a format that can be read by the client. The only method I have discovered to convert these certificates successfully is rather annoying. It involves importing it into the certificate storage of a Microsoft Operating system and then exporting it in PEM format.

NOTE : You will need administrative access to the host to complete this process.

Copy the file to a windows OS and double click the file. A Certificate Import Wizard will appear. Click the ''Next'' button.

[[File:Checkpoint-import-1.jpg]]

The ''File name'' field should be populated with the path to your certificate file. Click the ''Next'' button.

[[File:Checkpoint-import-2.jpg]]

Although you are presented with the opportunity to enter a password, leave this field blank. Be sure to check the ''Mark this key as exportable'' option so we can export it later. Click the ''Next'' button.

[[File:Checkpoint-import-3.jpg]]

Let windows automatically select the certificate store. Click the ''Next'' button.

[[File:Checkpoint-import-4.jpg]]

Now we have a dialog that says you have completed the wizard. Click the ''Finish'' button.

[[File:Checkpoint-import-5.jpg]]

You should be prompted with a small dialog that states your certificate has been imported. Click the ''Ok'' button.

[[File:Checkpoint-import-6.jpg]]

Now that we have imported the certificate, we need to find it using the Microsoft Management Console Certificate snap-in. Start by going to the Start Menu, select run, enter 'mmc' and click the ''Ok'' button. You should see an empty Microsoft Management Console open. Before we can use the certificate snap-in, we need to add it to the console. Go to the ''File'' menu and select the ''Add/Remove Snap-in'' option.

[[File:Checkpoint-msc-1.jpg]]

Click the ''Add'' button.

[[File:Checkpoint-msc-2.jpg]]

Select the ''Certificates'' snap-in and click the ''Add'' button.

[[File:Checkpoint-msc-3.jpg]]

You only need to add this for your user account, so just leave the default option and click the ''Finish'' button. Then click the ''Close'' and then the ''Ok'' button to get back to the root mmc window.

[[File:Checkpoint-msc-4.jpg]]

You should now see all the certificates viewable by your user account. Browse though the certificates to the Trusted Root Certification Authorities / Certificates container. This will populate all the trusted CA certificates in the right hand list view pane. Browse down until you find the certificate that matches the distinguished name of the certificate you exported from the Checkpoint web interface and double click it.

[[File:Checkpoint-msc-5.jpg]]

A certificate dialog should appear. Navigate to the ''Details'' tab and click the ''Copy to File'' button in the lower right hand corner of the dialog.

[[File:Checkpoint-msc-6.jpg]]

Now we have a Certificate Export Wizard. Click the ''Next'' button.

[[File:Checkpoint-export-1.jpg]]

Next you will be asked to select the file format. Be sure to select the ''Base-64'' encoded X.509 (.CER)'' option. Click the ''Next'' button.

[[File:Checkpoint-export-2.jpg]]

Browse or enter the file name to save you exported certificate as. If you add an extension, it will still add the .cer extension after your entered extension. If you picky about your certificate extensions ( I prefer .crt ), you will need to edit the file name after it is exported.

[[File:Checkpoint-export-3.jpg]]

Now we have a dialog that says you have completed the wizard. Click the ''Finish'' button.

[[File:Checkpoint-export-4.jpg]]

You should now have a usable certificate. That was a lot of work just to sanitize some file content. If anyone has a better suggestion, '''please''' let me know using our handy web site contact form.

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. The ''Host Name or IP Address'' is defined as '''10.1.1.28''' to match the NGX Internet Primary interface address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

=== Client Tab ===

The Firewall Options must be configured. The NAT Traversal setting should be set to ''disable''. Checkpoint claims it support RFC NAT-T but see no evidence of this for remote access connections. Even the official client tunnels UDP over a non standard port despite exposing a NAT-T configuration option.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Hybrid RSA+XAuth''.

===== Local Identity Tab =====

The Local Identification Type should be set to ''Fully Qualified Domain Name'' but leave the corresponding FQDN string blank.

===== Remote Identity Tab =====

The Remote Identification Type should be set to ''IP Address'' or ''Any''.

===== Credentials Tab =====

The Credentials Server Certificate Authority File should be set to the path of the Checkpoint CA certificate you exported and converted.

=== Phase 1 Tab ===

The Exchange Type should be set to ''main'' with all other parameters left to default. Be sure to check the ''Enable Check Point Compatible Vendor ID'' option at the bottom of the Dialog.

=== Policy Tab ===

The IPsec Policy information must be manually configured when communicating with Checkpoint gateways. Create an include Topology entry for each private network behind on the gateway. For our example, a single Topology Entry is defined to include the 10.1.2.0/24 network.

== Known Issues ==

*Nat Traversal ( RFC NAT-T ) is not supported.
*There may be problems with re-keying ISAKMP security associations.

== Resources ==

[[Media:Checkpoint.vpn.txt]]

File:Checkpoint.vpn.txt

2013-01-09T04:50:51Z

Admin: Example client configuration file.

Example client configuration file.

Howto Adtran

2013-01-09T04:49:07Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure an Adtran Netvanta device to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been tested with Adtran products to ensure interoperability. The configuration guild below shows examples from a Netvanta 3120.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client uses the pull configuration method to acquire the following parameters automatically from the gateway.

*IP Address
*IP Netmask
*DNS Servers
*WINS Servers

== Gateway Configuration ==

This example assumes you have knowledge of the Netvanta gateway web configuration interface. For more information, please consult your gateway product documentation.

=== Interfaces ===

Two network interfaces are configured. The Internet Primary interface has a static public IP address of 10.1.1.27 which faces the internet. The internal interface has a static private IP address of 10.1.2.27 which faces the internal private network. The default gateway is configured as 10.1.1.1 via the WAN interface.

=== User Authentication ===

Before users can authenticate, individual accounts must be created. To configure these accounts, navigate to the System / Passwords page using the left hand menu.

[[File:Adtran-nav-1.png]]

==== Add VPN User Accounts ====

To add user accounts, enter the following information and then type ''add'' for each user.

*Username = User account name
*Password = User account password
*Confirm Password = User account password

[[File:Adtran-pic-1a.png]]

==== Enable AAA Authentication ====

Before the user accounts can be used for VPN connections, you will need to enable AAA authentication. Make sure this option is checked and press ''Apply'' when finished.

[[File:Adtran-pic-1b.png]]

=== VPN Configuration ===

The VPN settings must be defined before a user can connect to the Netvanta Gateway. To configure these settings, navigate to the Data / VPN / VPN Peer page using the left hand menu.

[[File:Adtran-nav-2.png]]

==== Enable VPN Support ====

Before the users can connect, you will need to enable VPN support. Make sure this option is checked and press ''Apply'' when finished.

[[File:Adtran-pic-2a.png]]

==== Create a VPN Peer ====

A VPN Peer needs to be defined. This will specify the parameters used for the remote access VPN connection. To add a VPN peer definition, click the ''Create New VPN Peer'' button.

[[File:Adtran-pic-2b.png]]

Enter the following parameters and click ''Apply'' when finished.

*Name = client vpn
*VPN Interface = Public
*Peer Type = Mobile Peer

[[File:Adtran-pic-2c.png]]

==== Define the VPN Peer Configuration ====

The Peer configuration needs to be defined. Enter the following parameters and click ''Apply'' when finished.

IKE Configuration
*XAUTH Enabled = Local Userlist
*Respond Mode = Aggressive
*Nat Traversal = Allow V1 / Allow V2
*Local ID = IP Address / 10.1.1.27 ( matches the Netvanta public interface address )

IPSec Configuration
*PFS = Disabled
*Encryption / Hash = ESP : AES 256 / MD5
*Lifetime = 3600 seconds

[[File:Adtran-pic-3a.png]]

An IKE attribute definition needs to be added. This sets the Phase1 policy negotiation parameters. Enter the following parameters and click ''Add'' when finished.

IPSec Configuration
*Encryption / Hash = AES 256bit / MD5
*Authentication = Preshared Key
*DH Group = 2
*Lifetime = 28800 seconds

[[File:Adtran-pic-3b.png]]

A Remote ID definition needs to be added. This specifies the ID parameters used to match a VPN client to this peer definition. Enter the following parameters and press ''Add'' when finished.

*Remote ID Type = Domain Name
*Domain Name = client.shrew.net ( or an alternate client ID value )
*Preshared key = mypresharedkey ( replace this with your real psk )
*Allow XAUTH = ''Enabled''
*Nat Traversal = Allow V1 / Allow V2

[[File:Adtran-pic-3c.png]]

The Remote Addressing parameters need to be defined. These settings will be negotiated by the client during Mode Config. Enter the following parameters and press ''Apply'' when finished.

NOTE : The IP Address Range defines addresses that will be assigned to client virtual network adapters. It is important to use a range that does not overlap any private network that exists behind the Netvanta gateway.

*IP Address Range = 10.2.27.1 - 10.2.27.254 ( or your preferred range )
*Primary DNS Server = ''optional''
*Secondary DNS Server = ''optional''
*Primary WINS Server = ''optional''
*Secondary WINS Server = ''optional''

[[File:Adtran-pic-3d.png]]

==== Define the VPN Peer Policies ====

VPN Peer Policies need to be defined for each network the VPN Client will need to connect to. For the purposes of this document, we will assume the client need to connect to a single private network defined as 10.1.2.0/24. Click the ''Add New VPN Selector'' button.

[[File:Adtran-pic-4a.png]]

Define the VPN Selector Entry. Enter the following parameters and click ''Apply'' when finished.

*Filter Type = Permit
*Protocol = any

Source DATA
*Type = IP Address
*Address = 10.1.2.0
*Netmask = 255.255.255.0

Destination Data
*Type = IP Address
*Address = 10.2.27.0
*Netmask = 255.255.255.0

[[File:Adtran-pic-4b.png]]

After the new VPN Selector Entry has been added, you will notice that it is placed at the bottom of the list. There is a default policy to Deny all traffic which will be above the entry you just added. We need to move it above the deny policy so it will take precedent. Click the Up Arrow Icon to the left of the Permit policy.

[[File:Adtran-pic-4c.png]]

Now the order should be correct.

[[File:Adtran-pic-4d.png]]

Please keep in mind, that a Policy of <Private Internal Subnet> to <Any> will send all traffic through the VPN-Tunnel hence this will break internet access for the internal clients. The following two options are more common cases:

*<Private Internal Subnet> to <VPN Client Subnet> this would be 10.1.2.0/24 to 10.2.27.0/24

*<Any> to <VPN client Subnet> this would be "Any" to 10.2.27.0/24

=== Client Configuration ===

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

==== General Tab ====

The Remote Host section must be configured. The ''Host Name or IP Address'' is defined as '''10.1.1.27''' to match the Netvanta public interface address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

==== Phase 1 Tab ====

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' to match the Netvanta IKE attributes definition.

==== Authentication Tab ====

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.

===== Local Identity Tab =====

The Local Identification Type should be set to ''Fully Qualified Domain Name'' using the value "client.shrew.net" to match the Netvanta allowed Remote ID setting.

===== Remote Identity Tab =====

The Remote Identification Type should be set to ''IP Address'' with the "Use a discovered remote host address" option enabled.

===== Credentials Tab =====

The Credentials Pre Shared Key is defined to match the match the Netvanta Gateway Remote ID Preshared Key value.

==== Policy Tab ====

The IPsec Policy information must be manually configured when communicating with Adtran gateways. Create an include Topology entry for each private network behind on the gateway. For our example, a single Topology Entry is defined to include the 10.1.2.0/24 network.

== Credits ==

Many thanks to Adtran who donated a Netvanta 3120 appliance for testing and to create this documentation.

== Resources ==

[[Media:Adtran.vpn.txt]]

Howto Adtran

2013-01-09T04:48:50Z

Admin: /* Resources */

Howto Adtran

2013-01-09T04:48:35Z

Admin: /* Resources */

File:Adtran.vpn.txt

2013-01-09T04:48:13Z

Admin: Example client configuration file.

Example client configuration file.

Howto Adtran

2013-01-09T04:47:11Z

Admin: /* Resources */

Howto m0n0wall

2013-01-09T04:44:18Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure m0n0wall running pb25 or later to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been reported to inter-operate correctly with m0n0wall.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client will use the pull configuration method to acquire the following parameters automatically from m0n0wall.

*IP Address

== Gateway Configuration ==

This example assumes you have knowledge of m0n0wall web configuration interface. For more information, please consult the [http://doc.m0n0.ch/handbook/ m0n0wall handbook].

#Log into your m0n0wall and go to the IPsec: Mobile clients page.
#Configure the settings as shown in the following picture:
[[File:monowall_1.png]] 
You '''must''' use aggressive mode, as only IP addresses can be used as identifiers in main mode.
# Click "Save", then go to the IPsec: Pre-shared keys page.
# Add a new key for each mobile user (use different keys, and at least 8 characters!). Use the e-mail address of the corresponding user as the identifier.
# Go to the IPsec: Tunnels page, check "Enable IPsec" and click "Save".

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. The ''Host Name or IP Address'' is defined to match the m0n0wall public ip address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

The Local Host section must also be configured. The ''Address Method'' should be set to ''use an existing adapter and current address''. This will make is so that you can still see all the computers on your m0n0wall network, but you will not physically be a part of that network.

=== Client Tab ===

The Firewall section must be configured. The ''Keep-alive packet rate'' should be set to 30. The ''IKE Fragmentation'' should be set to ''disable''.

The Other Options must also be configured. The ''Enable Client Login Banner'' should be ''unchecked''.

=== Name Resolution Tab ===

The WINS /DNS section must be configured. The ''Enable WINS'' and ''Enable DNS'' should be ''unchecked''.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mututal PSK''.

==== Local Identity Sub-Tab ====

The Local Identity parameters are defined as ''Identification Type'' with a ''User Fully Qulaified Domain Name'' "email address" to match the m0n0wall configuration.

==== Remote Identity Sub-Tab ====

The Remote Identity parameters are defined as ''Identification Type'' with a ''IP Address'' of ''Use a discovered remote host address''.

==== Credentials Sub-Tab ====

The Credentials ''Pre Shared Key'' is defined as "Pre-shared key" to match the m0n0wall configuration.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' and the ''Cipher Algorithm'' is set to ''3des'' and the ''Hash Algorithm'' is set to ''sha1'' and the ''Key Life Time limit'' is set to ''54600'' to match the m0n0wall configuration.

=== Phase 2 Tab ===

The Proposal section must be configured. The ''Transform Algorithm'' is set to ''esp-3des'' and the ''HMAC Algorithm'' is set to ''sha1'' and the ''PFS Exchange'' is set to ''group 2'' and the ''Key Life Time limit'' is set to ''28800'' to match the m0n0wall configuration.

=== Policy Tab ===

The IPsec Policy information must be manually configured when communicating with m0n0wall gateways. Be sure to ''unckeck'' both ''Maintain Persistent Secure Associations'' and ''Obtain Topology Automatically or Tunnel All''. Create an include Topology entry for each IPsec Policy network created on the gateway. For our example, a single Topology Entry is defined to include the 10.1.2.0/24 network.

=== Known Issues ===

None reported.

=== Resources ===

[[Media:M0n0wall.vpn.txt]]

=== Credits ===

This guide was submitted by Chris Andrist.

Howto m0n0wall

2013-01-09T04:43:48Z

Admin:

== Introduction ==

This guide provides information that can be used to configure m0n0wall running pb25 or later to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been reported to inter-operate correctly with m0n0wall.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client will use the pull configuration method to acquire the following parameters automatically from m0n0wall.

*IP Address

== Gateway Configuration ==

This example assumes you have knowledge of m0n0wall web configuration interface. For more information, please consult the [http://doc.m0n0.ch/handbook/ m0n0wall handbook].

#Log into your m0n0wall and go to the IPsec: Mobile clients page.
#Configure the settings as shown in the following picture:
[[File:monowall_1.png]] 
You '''must''' use aggressive mode, as only IP addresses can be used as identifiers in main mode.
# Click "Save", then go to the IPsec: Pre-shared keys page.
# Add a new key for each mobile user (use different keys, and at least 8 characters!). Use the e-mail address of the corresponding user as the identifier.
# Go to the IPsec: Tunnels page, check "Enable IPsec" and click "Save".

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. The ''Host Name or IP Address'' is defined to match the m0n0wall public ip address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

The Local Host section must also be configured. The ''Address Method'' should be set to ''use an existing adapter and current address''. This will make is so that you can still see all the computers on your m0n0wall network, but you will not physically be a part of that network.

=== Client Tab ===

The Firewall section must be configured. The ''Keep-alive packet rate'' should be set to 30. The ''IKE Fragmentation'' should be set to ''disable''.

The Other Options must also be configured. The ''Enable Client Login Banner'' should be ''unchecked''.

=== Name Resolution Tab ===

The WINS /DNS section must be configured. The ''Enable WINS'' and ''Enable DNS'' should be ''unchecked''.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mututal PSK''.

==== Local Identity Sub-Tab ====

The Local Identity parameters are defined as ''Identification Type'' with a ''User Fully Qulaified Domain Name'' "email address" to match the m0n0wall configuration.

==== Remote Identity Sub-Tab ====

The Remote Identity parameters are defined as ''Identification Type'' with a ''IP Address'' of ''Use a discovered remote host address''.

==== Credentials Sub-Tab ====

The Credentials ''Pre Shared Key'' is defined as "Pre-shared key" to match the m0n0wall configuration.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' and the ''Cipher Algorithm'' is set to ''3des'' and the ''Hash Algorithm'' is set to ''sha1'' and the ''Key Life Time limit'' is set to ''54600'' to match the m0n0wall configuration.

=== Phase 2 Tab ===

The Proposal section must be configured. The ''Transform Algorithm'' is set to ''esp-3des'' and the ''HMAC Algorithm'' is set to ''sha1'' and the ''PFS Exchange'' is set to ''group 2'' and the ''Key Life Time limit'' is set to ''28800'' to match the m0n0wall configuration.

=== Policy Tab ===

The IPsec Policy information must be manually configured when communicating with m0n0wall gateways. Be sure to ''unckeck'' both ''Maintain Persistent Secure Associations'' and ''Obtain Topology Automatically or Tunnel All''. Create an include Topology entry for each IPsec Policy network created on the gateway. For our example, a single Topology Entry is defined to include the 10.1.2.0/24 network.

=== Known Issues ===

None reported.

=== Resources ===

[[File://M0n0wall.vpn.txt]]

=== Credits ===

This guide was submitted by Chris Andrist.

Howto m0n0wall

2013-01-09T04:41:15Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure m0n0wall running pb25 or later to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been reported to inter-operate correctly with m0n0wall.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client will use the pull configuration method to acquire the following parameters automatically from m0n0wall.

*IP Address

== Gateway Configuration ==

This example assumes you have knowledge of m0n0wall web configuration interface. For more information, please consult the [http://doc.m0n0.ch/handbook/ m0n0wall handbook].

#Log into your m0n0wall and go to the IPsec: Mobile clients page.
#Configure the settings as shown in the following picture:
[[File:monowall_1.png]] 
You '''must''' use aggressive mode, as only IP addresses can be used as identifiers in main mode.
# Click "Save", then go to the IPsec: Pre-shared keys page.
# Add a new key for each mobile user (use different keys, and at least 8 characters!). Use the e-mail address of the corresponding user as the identifier.
# Go to the IPsec: Tunnels page, check "Enable IPsec" and click "Save".

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. The ''Host Name or IP Address'' is defined to match the m0n0wall public ip address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

The Local Host section must also be configured. The ''Address Method'' should be set to ''use an existing adapter and current address''. This will make is so that you can still see all the computers on your m0n0wall network, but you will not physically be a part of that network.

=== Client Tab ===

The Firewall section must be configured. The ''Keep-alive packet rate'' should be set to 30. The ''IKE Fragmentation'' should be set to ''disable''.

The Other Options must also be configured. The ''Enable Client Login Banner'' should be ''unchecked''.

=== Name Resolution Tab ===

The WINS /DNS section must be configured. The ''Enable WINS'' and ''Enable DNS'' should be ''unchecked''.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mututal PSK''.

==== Local Identity Sub-Tab ====

The Local Identity parameters are defined as ''Identification Type'' with a ''User Fully Qulaified Domain Name'' "email address" to match the m0n0wall configuration.

==== Remote Identity Sub-Tab ====

The Remote Identity parameters are defined as ''Identification Type'' with a ''IP Address'' of ''Use a discovered remote host address''.

==== Credentials Sub-Tab ====

The Credentials ''Pre Shared Key'' is defined as "Pre-shared key" to match the m0n0wall configuration.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' and the ''Cipher Algorithm'' is set to ''3des'' and the ''Hash Algorithm'' is set to ''sha1'' and the ''Key Life Time limit'' is set to ''54600'' to match the m0n0wall configuration.

=== Phase 2 Tab ===

The Proposal section must be configured. The ''Transform Algorithm'' is set to ''esp-3des'' and the ''HMAC Algorithm'' is set to ''sha1'' and the ''PFS Exchange'' is set to ''group 2'' and the ''Key Life Time limit'' is set to ''28800'' to match the m0n0wall configuration.

=== Policy Tab ===

The IPsec Policy information must be manually configured when communicating with m0n0wall gateways. Be sure to ''unckeck'' both ''Maintain Persistent Secure Associations'' and ''Obtain Topology Automatically or Tunnel All''. Create an include Topology entry for each IPsec Policy network created on the gateway. For our example, a single Topology Entry is defined to include the 10.1.2.0/24 network.

=== Known Issues ===

None reported.

=== Resources ===

[[File:M0n0wall.vpn.txt]]

=== Credits ===

This guide was submitted by Chris Andrist.

Howto m0n0wall

2013-01-09T04:39:49Z

Admin: /* Resources */

== Introduction ==

This guide provides information that can be used to configure m0n0wall running pb25 or later to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been reported to inter-operate correctly with m0n0wall.

== Overview ==

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. The client will use the pull configuration method to acquire the following parameters automatically from m0n0wall.

*IP Address

== Gateway Configuration ==

This example assumes you have knowledge of m0n0wall web configuration interface. For more information, please consult the [http://doc.m0n0.ch/handbook/ m0n0wall handbook].

#Log into your m0n0wall and go to the IPsec: Mobile clients page.
#Configure the settings as shown in the following picture:
[[File:monowall_1.png]] 
You '''must''' use aggressive mode, as only IP addresses can be used as identifiers in main mode.
# Click "Save", then go to the IPsec: Pre-shared keys page.
# Add a new key for each mobile user (use different keys, and at least 8 characters!). Use the e-mail address of the corresponding user as the identifier.
# Go to the IPsec: Tunnels page, check "Enable IPsec" and click "Save".

== Client Configuration ==

The client configuration in this example is straight forward. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. The ''Host Name or IP Address'' is defined to match the m0n0wall public ip address. The ''Auto Configuration'' mode should be set to ''ike config pull''.

The Local Host section must also be configured. The ''Address Method'' should be set to ''use an existing adapter and current address''. This will make is so that you can still see all the computers on your m0n0wall network, but you will not physically be a part of that network.

=== Client Tab ===

The Firewall section must be configured. The ''Keep-alive packet rate'' should be set to 30. The ''IKE Fragmentation'' should be set to ''disable''.

The Other Options must also be configured. The ''Enable Client Login Banner'' should be ''unchecked''.

=== Name Resolution Tab ===

The WINS /DNS section must be configured. The ''Enable WINS'' and ''Enable DNS'' should be ''unchecked''.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mututal PSK''.

==== Local Identity Sub-Tab ====

The Local Identity parameters are defined as ''Identification Type'' with a ''User Fully Qulaified Domain Name'' "email address" to match the m0n0wall configuration.

==== Remote Identity Sub-Tab ====

The Remote Identity parameters are defined as ''Identification Type'' with a ''IP Address'' of ''Use a discovered remote host address''.

==== Credentials Sub-Tab ====

The Credentials ''Pre Shared Key'' is defined as "Pre-shared key" to match the m0n0wall configuration.

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' and the ''Cipher Algorithm'' is set to ''3des'' and the ''Hash Algorithm'' is set to ''sha1'' and the ''Key Life Time limit'' is set to ''54600'' to match the m0n0wall configuration.

=== Phase 2 Tab ===

The Proposal section must be configured. The ''Transform Algorithm'' is set to ''esp-3des'' and the ''HMAC Algorithm'' is set to ''sha1'' and the ''PFS Exchange'' is set to ''group 2'' and the ''Key Life Time limit'' is set to ''28800'' to match the m0n0wall configuration.

=== Policy Tab ===

The IPsec Policy information must be manually configured when communicating with m0n0wall gateways. Be sure to ''unckeck'' both ''Maintain Persistent Secure Associations'' and ''Obtain Topology Automatically or Tunnel All''. Create an include Topology entry for each IPsec Policy network created on the gateway. For our example, a single Topology Entry is defined to include the 10.1.2.0/24 network.

=== Known Issues ===

None reported.

=== Resources ===

*[File:Monowall.vpn.txt Example Client configuration]

=== Credits ===

This guide was submitted by Chris Andrist.

File:M0n0wall.vpn.txt

2013-01-09T04:38:25Z

Admin: Admin uploaded a new version of "File:M0n0wall.vpn.txt": Reverted to version as of 04:35, 9 January 2013

Example client configuration.

File:M0n0wall.vpn.txt

2013-01-09T04:38:01Z

Admin: Admin uploaded a new version of "File:M0n0wall.vpn.txt": Example configuration file for M0n0wall

Example client configuration.

File:M0n0wall.vpn.txt

2013-01-09T04:35:29Z

Admin: Example client configuration.

Example client configuration.

MediaWiki:Sidebar

2013-01-01T01:30:48Z

Admin: Created page with " * navigation ** mainpage|mainpage-description ** recentchanges-url|recentchanges ** randompage-url|randompage ** helppage|help * SEARCH * TOOLBOX * LANGUAGES"

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
** helppage|help
* SEARCH
* TOOLBOX
* LANGUAGES