Howto Zywall - Revision history

Admin: /* Resources */

2013-01-09T05:27:20Z

Resources

Admin: /* Known Issues */

2012-09-06T03:05:49Z

Known Issues

Admin: /* Known Issues */

2012-09-06T03:04:38Z

Known Issues

Admin: /* Known Issues */

2012-09-06T03:03:49Z

Known Issues

Admin: /* Configure Xauth User Accounts */

2012-09-06T03:03:33Z

Configure Xauth User Accounts

Admin: /* Add a Network Policy */

2012-09-06T03:03:07Z

Add a Network Policy

Admin: /* Configuring VPN Rules */

2012-09-06T03:02:37Z

Configuring VPN Rules

Admin: /* Known Issues */

2012-09-06T02:33:32Z

Known Issues

Admin: /* Introduction */

2012-09-06T02:33:05Z

Introduction

Admin: Created page with "== Introduction == The Sonicwall products are not yet supported by the Shrew Soft VPN Client. {{TracNotice|{{PAGENAME}}}}[mgrooms@dev ~/wiki]$ cat HowTo_Zywall.trac.after ..."

2012-09-06T02:31:56Z

Created page with "== Introduction == The Sonicwall products are not yet supported by the Shrew Soft VPN Client. {{TracNotice|{{PAGENAME}}}}[mgrooms@dev ~/wiki]$ cat HowTo_Zywall.trac.after ..."

New page

== Introduction ==

The Sonicwall products are not yet supported by the Shrew Soft VPN Client.

{{TracNotice|{{PAGENAME}}}}[mgrooms@dev ~/wiki]$ cat HowTo_Zywall.trac.after

=== Introduction ===

This guide provides information that can be used to configure a Zywall device to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been tested with Zywall products to ensure interoperability.

=== Overview ===

The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. No automatic configuration is possible at this time due to limitations in the Zywall firmware.

=== Gateway Configuration ===

This example assumes you have knowledge of the Zywall web configuration interface. For more information, please consult your Zywall product documentation.

==== Interfaces ====

Two network interfaces are configured. The WAN interface has a static public IP address of 10.1.1.23 which faces the internet. The LAN interface has a static private IP address of 10.1.2.23 which faces the internal private network. The default gateway is configured as 1.1.1.3 via the WAN interface.

==== Configuring VPN Rules ====

A Gateway Policy must be configured to define the IKE phase1 negotiation parameters. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[Image(http://www.shrew.net/static/howto/Zywall/nav-1a.jpg)]]

Click on the following Add Gateway Icon + symbol on the right hand side of the VPN Rules header.

[[Image(http://www.shrew.net/static/howto/Zywall/nav-1b.jpg)]]

Define the following parameters.

*Property
**Name = vpnclient_gateway
**NAT Traversal = Checked
*Authentication Key
**Pre-Shared Key = mypresharedkey
**Local ID Type = IP
**Content = 0.0.0.0
**Peer ID Type = DNS
**Content = client.domain.com
*Extended Authentication = Checked
**Server Mode = Selected

When finished, click Apply.

[[Image(http://www.shrew.net/static/howto/Zywall/pic-1.jpg)]]

==== Add a Network Policy ====

A Network Policy must be configured to define the IPsec policy and IKE phase2 negotiation parameters. Click on the following Add Network Policy Icon + symbol on the right hand side of the Gateway Policy row.

[[Image(http://www.shrew.net/static/howto/Zywall/nav-2.jpg)]]

Define the following parameters.

*Property
**Active = Checked
**Name = vpnclient_policy1
*Gateway Policy Information
**Gateway Policy = vpnclient_gateway
*Local Network
**Address Type = Subnet Address
**Starting IP Address = 10.1.2.0
**Ending IP / Address Subnet = 255.255.255.0
**Local Port
**Start 0
**End 0
*Remote Network
**Address Type = Single Address
**Starting IP Address = 0.0.0.0
**Ending IP / Address Subnet = 0.0.0.0
**Remote Port
**Start 0
**End 0
*IPsec Proposal
**Encapsulation Mode = Tunnel
**Active Protocol = ESP
**Encryption Algorithm = 3DES
**Authentication Algorithm = MD5
**SA Life Time ( Seconds ) = 3600
**Perfect Forward Security = NONE
**Enable Replay Protection = Checked
**Enable Multiple Proposals = Checked

When finished, click Apply.

[[Image(http://www.shrew.net/static/howto/Zywall/pic-2.jpg)]]

==== Configure Xauth User Accounts ====

Xauth user accounts can be created locally on the Zywall appliance. Navigate to the following screen using the pane on the left hand side of the browser interface.

[[Image(http://www.shrew.net/static/howto/Zywall/nav-3.jpg)]]

Define the following parameters for each remote access user.

*Active = Checked
*Username = [ user name ]
*Password = [ user password ]

When finished, click Apply.

[[Image(http://www.shrew.net/static/howto/Zywall/pic-3.jpg)]]

=== Client Configuration ===

The client configuration in this example is less than ideal due to limitations of the Zywall. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.

=== General Tab ===

The Remote Host section must be configured. This ''Host Name or IP Address'' is defined as 10.1.2.23 to match the Zywall WAN interface address. The Auto Configuration option is set to disabled as Zywall does not support automatic client configuration.

Each remote access client must be assigned a unique Virtual Adapter IP address. Please see the known issues section of this document for more details. In this example we define an address of 10.2.23.2 with a netmask as 255.255.255.0 for a single client. Each subsequent client would be assigned the next address in the network. For example, the next is assigned 10.2.23.3, the next 10.2.23.4, etc ...

=== Phase 1 Tab ===

The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' to match the Zywall Gateway Policy definition.

=== Authentication Tab ===

The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.

==== Local Identity Tab ====

The Local Identity parameters are defined as ''Fully Qualified Domain Name'' with a ''FQDN String'' of "client.domain.com" to match the Zywall Gateway Policy definition.

==== Remote Identity Tab ====

The Remote Identity parameters are set to IP Address with the Use a discovered remote host address option checked to match the Zywall Gateway Policy definition.

==== Credentials Tab ====

The Credentials ''Pre Shared Key'' is defined as "mypresharedkey" to match the match the Zywall Gateway Policy definition.

=== Policy Tab ===

The IPsec Policy configuration must be manually configured when communicating with Zywall gateways. A single Topology Entry is defined to include the 10.1.2.0/24 network.

=== Known Issues ===

Building a client configuration for Zywall appliances can be problematic as they have no support for address assignment via modecfg. There are two options available to work around this shortcoming.

1) Select the "Use a virtual adapter and assigned address" method. Each client that connects to the gateway will need to have a unique virtual address manually configured. If more that one client connects to the gateway simultaneously using the same address, it will have conflicts and one of them will stop working unexpectedly.

2) Select the "Use an existing adapter and current address" option under the General tab. This also works with my Zywall but will has some severe limitations in a production environment ...

a) Two clients cannot use the same public adapter address simultaneously when connecting to the Zywall gateway. This can happen easily if two clients exist behind different SOHO firewalls and receive the same address via DHCP. Essentially, this creates a similar problem to using option (1) and configuring identical virtual adapter address for more than one client.

b) The Zywall needs to be the default gateway for the network it protects or NAT all inbound IPsec traffic that passes to the private network. Otherwise, the return traffic destined to the client will go out your default gateway instead of being seen by the Zywall.

c) The client cannot use a public adapter address that exists in any private network protected by the Zywall. If this happens, you will end up with a very confused gateway that doesn't know which direction to pass the traffic. This can easily happen, again, if the client exists behind a SOHO firewall that uses an IP pool that maps to one of your internal networks.

=== Resources ===

*[http://www.shrew.net/static/howto/Zywall/zywall.vpn Example Client configuration]

← Older revision		Revision as of 05:27, 9 January 2013
Line 146:		Line 146:
	== Resources ==		== Resources ==

−	[~~http~~:~~//www.shrew.net/static/howto/Zywall/~~zywall.vpn ~~Example Client configuration~~]	+	[[Media:zywall.vpn.txt]]

@@ Line 140: / Line 140: @@
 # Select the "Use a virtual adapter and assigned address" method. Each client that connects to the gateway will need to have a unique virtual address manually configured. If more that one client connects to the gateway simultaneously using the same address, it will have conflicts and one of them will stop working unexpectedly.
 # Select the "Use an existing adapter and current address" option under the General tab. This also works with my Zywall but will has some severe limitations in a production environment ...
-## Two clients cannot use the same public adapter address simultaneously when connecting to the Zywall gateway. This can happen easily if two clients exist behind different SOHO firewalls and receive the same address via DHCP. Essentially, this creates a similar problem to using  option (1) and configuring identical virtual adapter address for more than one client.
+#: a) Two clients cannot use the same public adapter address simultaneously when connecting to the Zywall gateway. This can happen easily if two clients exist behind different SOHO firewalls and receive the same address via DHCP. Essentially, this creates a similar problem to using  option (1) and configuring identical virtual adapter address for more than one client.
-## The Zywall needs to be the default gateway for the network it protects or NAT all inbound IPsec traffic that passes to the private network. Otherwise, the return traffic destined to the client will go out your default gateway instead of being seen by the Zywall.
+#: b) The Zywall needs to be the default gateway for the network it protects or NAT all inbound IPsec traffic that passes to the private network. Otherwise, the return traffic destined to the client will go out your default gateway instead of being seen by the Zywall.
-## The client cannot use a public adapter address that exists in any private network protected by the Zywall. If this happens, you will end up with a very confused gateway that doesn't know which direction to pass the traffic. This can easily happen, again, if the client exists behind a SOHO firewall that uses an IP pool that maps to one of your internal networks.
+#: c) The client cannot use a public adapter address that exists in any private network protected by the Zywall. If this happens, you will end up with a very confused gateway that doesn't know which direction to pass the traffic. This can easily happen, again, if the client exists behind a SOHO firewall that uses an IP pool that maps to one of your internal networks.
 == Resources ==
 [http://www.shrew.net/static/howto/Zywall/zywall.vpn Example Client configuration]

@@ Line 140: / Line 140: @@
 # Select the "Use a virtual adapter and assigned address" method. Each client that connects to the gateway will need to have a unique virtual address manually configured. If more that one client connects to the gateway simultaneously using the same address, it will have conflicts and one of them will stop working unexpectedly.
 # Select the "Use an existing adapter and current address" option under the General tab. This also works with my Zywall but will has some severe limitations in a production environment ...
-# Two clients cannot use the same public adapter address simultaneously when connecting to the Zywall gateway. This can happen easily if two clients exist behind different SOHO firewalls and receive the same address via DHCP. Essentially, this creates a similar problem to using  option (1) and configuring identical virtual adapter address for more than one client.
+## Two clients cannot use the same public adapter address simultaneously when connecting to the Zywall gateway. This can happen easily if two clients exist behind different SOHO firewalls and receive the same address via DHCP. Essentially, this creates a similar problem to using  option (1) and configuring identical virtual adapter address for more than one client.
-#  The Zywall needs to be the default gateway for the network it protects or NAT all inbound IPsec traffic that passes to the private network. Otherwise, the return traffic destined to the client will go out your default gateway instead of being seen by the Zywall.
+## The Zywall needs to be the default gateway for the network it protects or NAT all inbound IPsec traffic that passes to the private network. Otherwise, the return traffic destined to the client will go out your default gateway instead of being seen by the Zywall.
-#  The client cannot use a public adapter address that exists in any private network protected by the Zywall. If this happens, you will end up with a very confused gateway that doesn't know which direction to pass the traffic. This can easily happen, again, if the client exists behind a SOHO firewall that uses an IP pool that maps to one of your internal networks.
+## The client cannot use a public adapter address that exists in any private network protected by the Zywall. If this happens, you will end up with a very confused gateway that doesn't know which direction to pass the traffic. This can easily happen, again, if the client exists behind a SOHO firewall that uses an IP pool that maps to one of your internal networks.
 == Resources ==
 [http://www.shrew.net/static/howto/Zywall/zywall.vpn Example Client configuration]

@@ Line 141: / Line 141: @@
 # Select the "Use an existing adapter and current address" option under the General tab. This also works with my Zywall but will has some severe limitations in a production environment ...
 # Two clients cannot use the same public adapter address simultaneously when connecting to the Zywall gateway. This can happen easily if two clients exist behind different SOHO firewalls and receive the same address via DHCP. Essentially, this creates a similar problem to using  option (1) and configuring identical virtual adapter address for more than one client.
-# The Zywall needs to be the default gateway for the network it protects or NAT all inbound IPsec traffic that passes to the private network. Otherwise, the return traffic destined to the client will go out your default gateway instead of being seen by the Zywall.
+#  The Zywall needs to be the default gateway for the network it protects or NAT all inbound IPsec traffic that passes to the private network. Otherwise, the return traffic destined to the client will go out your default gateway instead of being seen by the Zywall.
-# The client cannot use a public adapter address that exists in any private network protected by the Zywall. If this happens, you will end up with a very confused gateway that doesn't know which direction to pass the traffic. This can easily happen, again, if the client exists behind a SOHO firewall that uses an IP pool that maps to one of your internal networks.
+#  The client cannot use a public adapter address that exists in any private network protected by the Zywall. If this happens, you will end up with a very confused gateway that doesn't know which direction to pass the traffic. This can easily happen, again, if the client exists behind a SOHO firewall that uses an IP pool that maps to one of your internal networks.
 == Resources ==
 [http://www.shrew.net/static/howto/Zywall/zywall.vpn Example Client configuration]

@@ Line 88: / Line 88: @@
 Xauth user accounts can be created locally on the Zywall appliance. Navigate to the following screen using the pane on the left hand side of the browser interface.
-[[Image(http://www.shrew.net/static/howto/Zywall/nav-3.jpg)]]
+[[File:Zywall-nav-3.jpg]]
 Define the following parameters for each remote access user.
@@ Line 98: / Line 98: @@
 When finished, click Apply.
-[[Image(http://www.shrew.net/static/howto/Zywall/pic-3.jpg)]]
+[[File:Zywall-pic-3.jpg]]
 == Client Configuration ==

@@ Line 47: / Line 47: @@
 A Network Policy must be configured to define the IPsec policy and IKE phase2 negotiation parameters. Click on the following Add Network Policy Icon + symbol on the right hand side of the Gateway Policy row.
-[[Image(http://www.shrew.net/static/howto/Zywall/nav-2.jpg)]]
+[[File:Zywall-nav-2.jpg]]
 Define the following parameters.
@@ Line 82: / Line 82: @@
 When finished, click Apply.
-[[Image(http://www.shrew.net/static/howto/Zywall/pic-2.jpg)]]
+[[File:Zywall-pic-2.jpg]]
 === Configure Xauth User Accounts ===

@@ Line 19: / Line 19: @@
 A Gateway Policy must be configured to define the IKE phase1 negotiation parameters. Navigate to the following screen using the pane on the left hand side of the browser interface.
-[[Image(http://www.shrew.net/static/howto/Zywall/nav-1a.jpg)]]
+[[File:Zywall-nav-1a.jpg]]
 Click on the following Add Gateway Icon + symbol on the right hand side of the VPN Rules header.
-[[Image(http://www.shrew.net/static/howto/Zywall/nav-1b.jpg)]]
+[[File:Zywall-nav-1b.jpg]]
 Define the following parameters.
@@ Line 41: / Line 41: @@
 When finished, click Apply.
-[[Image(http://www.shrew.net/static/howto/Zywall/pic-1.jpg)]]
+[[File:Zywall-pic-1.jpg]]
 === Add a Network Policy ===

@@ Line 1: / Line 1: @@
 == Introduction ==
 This guide provides information that can be used to configure a Zywall device  to support IPsec VPN client connectivity. The Shrew Soft VPN Client has been tested with Zywall products to ensure interoperability.
-=== Overview ===
+== Overview ==
 The configuration example described below will allow an IPsec VPN client to communicate with a single remote private network. No automatic configuration is possible at this time due to limitations in the Zywall firmware.
-=== Gateway Configuration ===
+== Gateway Configuration ==
 This example assumes you have knowledge of the Zywall web configuration interface. For more information, please consult your Zywall product documentation.
-==== Interfaces ====
+=== Interfaces ===
 Two network interfaces are configured. The WAN interface has a static public IP address of 10.1.1.23 which faces the internet. The LAN interface has a static private IP address of 10.1.2.23 which faces the internal private network. The default gateway is configured as 1.1.1.3 via the WAN interface.
-==== Configuring VPN Rules ====
+=== Configuring VPN Rules ===
 A Gateway Policy must be configured to define the IKE phase1 negotiation parameters. Navigate to the following screen using the pane on the left hand side of the browser interface.
@@ Line 51: / Line 43: @@
 [[Image(http://www.shrew.net/static/howto/Zywall/pic-1.jpg)]]
- ==== Add a Network Policy ====
+=== Add a Network Policy ===
 A Network Policy must be configured to define the IPsec policy and IKE phase2 negotiation parameters. Click on the following Add Network Policy Icon + symbol on the right hand side of the Gateway Policy row.
@@ Line 92: / Line 84: @@
 [[Image(http://www.shrew.net/static/howto/Zywall/pic-2.jpg)]]
-==== Configure Xauth User Accounts ====
+=== Configure Xauth User Accounts ===
 Xauth user accounts can be created locally on the Zywall appliance. Navigate to the following screen using the pane on the left hand side of the browser interface.
@@ Line 108: / Line 100: @@
 [[Image(http://www.shrew.net/static/howto/Zywall/pic-3.jpg)]]
-=== Client Configuration ===
+== Client Configuration ==
 The client configuration in this example is less than ideal due to limitations of the Zywall. Open the Access Manager application and create a new site configuration. Configure the settings listed below in the following tabs.
- === General Tab ===
+=== General Tab ===
 The Remote Host section must be configured. This ''Host Name or IP Address'' is defined as 10.1.2.23 to match the Zywall WAN interface address. The Auto Configuration option is set to disabled as Zywall does not support automatic client configuration.
@@ Line 118: / Line 110: @@
 Each remote access client must be assigned a unique Virtual Adapter IP address. Please see the known issues section of this document for more details. In this example we define an address of 10.2.23.2 with a netmask as 255.255.255.0 for a single client. Each subsequent client would be assigned the next address in the network. For example, the next is assigned 10.2.23.3, the next 10.2.23.4, etc ...
- === Phase 1 Tab ===
+=== Phase 1 Tab ===
 The Proposal section must be configured. The ''Exchange Type'' is set to ''aggressive'' and the ''DH Exchange'' is set to ''group 2'' to match the Zywall Gateway Policy definition.
- === Authentication Tab ===
+=== Authentication Tab ===
 The client authentication settings must be configured. The Authentication Method is defined as ''Mutual PSK + XAuth''.
- ==== Local Identity Tab ====
+==== Local Identity Tab ====
 The Local Identity parameters are defined as ''Fully Qualified Domain Name'' with a ''FQDN String'' of "client.domain.com" to match the Zywall Gateway Policy definition.
- ==== Remote Identity Tab ====
+==== Remote Identity Tab ====
 The Remote Identity parameters are set to IP Address with the Use a discovered remote host address option checked to match the Zywall Gateway Policy definition.
- ==== Credentials Tab ====
+==== Credentials Tab ====
 The Credentials ''Pre Shared Key'' is defined as "mypresharedkey" to match the match the Zywall Gateway Policy definition.
- === Policy Tab ===
+=== Policy Tab ===
 The IPsec Policy configuration must be manually configured when communicating with  Zywall gateways. A single Topology Entry is defined to include the 10.1.2.0/24 network.
-=== Known Issues ===
+== Known Issues ==
 Building a client configuration for Zywall appliances can be problematic as they have no support for address assignment via modecfg. There are two options available to work around this shortcoming.
@@ Line 156: / Line 148: @@
    c) The client cannot use a public adapter address that exists in any private network protected by the Zywall. If this happens, you will end up with a very confused gateway that doesn't know which direction to pass the traffic. This can easily happen, again, if the client exists behind a SOHO firewall that uses an IP pool that maps to one of your internal networks.
-=== Resources ===
+== Resources ==
-*[http://www.shrew.net/static/howto/Zywall/zywall.vpn Example Client configuration]
+[http://www.shrew.net/static/howto/Zywall/zywall.vpn Example Client configuration]