Teltonika Networks Wiki

Changes

IPSec Tunnel w/CA Certs Configuration (view source)

Revision as of 20:47, 27 June 2024

1,256 bytes added ,  27 June
no edit summary
Line 62: Line 62:     
- `Generate` Certificate
 
- `Generate` Certificate
 +
<br>
    
[[File:IPSec CA Cert Generating.png|frame|none]]
 
[[File:IPSec CA Cert Generating.png|frame|none]]
Line 255: Line 256:  
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
 
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
 
* Add a new instance called `CA_EX`
 
* Add a new instance called `CA_EX`
−
[Screenshot Here]
+
<br>
    +
[[File:IPSec RUT1 Config Add CA EX.png|frame|none]]
 +
 +
<br>
 
* IPsec Instance General settings configuration as follows:
 
* IPsec Instance General settings configuration as follows:
 
    
 
    
Line 274: Line 278:     
- Remote identifier: `192.168.14.1` // We will use the LAN IP of RUT2 for the Identifier
 
- Remote identifier: `192.168.14.1` // We will use the LAN IP of RUT2 for the Identifier
 +
<br>
   −
[Screenshot Here]
+
[[File:RUT1 IPSec Instance General Settings Configuration.png|frame|none]]
    +
<br>
    
* IPsec Instance Advanced settings configuration as follows:
 
* IPsec Instance Advanced settings configuration as follows:
 
    
 
    
 
- Remote certificate: `RUT2.cert.pem` // Upload RUT2 cert we created earlier.
 
- Remote certificate: `RUT2.cert.pem` // Upload RUT2 cert we created earlier.
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT1 IPSec Instance Advanced Settings Configuration.png|frame|none]]
 +
 
 +
<br>
    
* Connection settings General settings configuration as follows:
 
* Connection settings General settings configuration as follows:
Line 297: Line 307:     
- Key exchange: `IKEv2`
 
- Key exchange: `IKEv2`
−
[Screenshot Here]
+
<br>
    +
[[File:RUT1 IPSec Connection Settings General Settings Configuration.png|frame|none]]
 +
 +
<br>
    
* Connection settings Advanced settings configuration as follows:
 
* Connection settings Advanced settings configuration as follows:
Line 319: Line 332:     
- The rest of the configuration leave as default
 
- The rest of the configuration leave as default
−
[Screenshot Here]
      +
<br>
 +
 +
[[File:RUT1 IPSec Connection Settings Advanced Settings Configuration.png|frame|none]]
 +
 +
<br>
    
* Connection settings Proposal settings configuration as follows:
 
* Connection settings Proposal settings configuration as follows:
Line 335: Line 352:     
- IKE lifetime: `3h`
 
- IKE lifetime: `3h`
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT1 IPSec Proposal Settings Phase1.png|frame|none]]
 +
 
 +
<br>
    
* Phase 2
 
* Phase 2
Line 348: Line 369:     
- IKE lifetime: `3h`
 
- IKE lifetime: `3h`
−
[Screenshot Here]
+
<br>
    +
[[File:RUT1 IPSec Proposal Settings Phase2.png|frame|none]]
 +
 +
<br>
    
* Hit 'Save & Apply'
 
* Hit 'Save & Apply'
 
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
 
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
−
[Screenshot Here]
+
<br>
 +
[[File:RUT1 IPSec Toggle On Save And Apply.png|frame|none]]
    +
<br>
 
* Reboot the device once you have finished.
 
* Reboot the device once you have finished.
   Line 364: Line 390:  
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
 
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
 
* Add a new instance called `CA_EX`
 
* Add a new instance called `CA_EX`
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:IPSec_RUT1_Config_Add_CA_EX.png|frame|none]]
 +
 
 +
<br>
    
* IPsec Instance General settings configuration as follows:
 
* IPsec Instance General settings configuration as follows:
Line 383: Line 413:     
- Remote identifier: `192.168.3.1` // We will use the LAN IP of RUT1 for the Identifier
 
- Remote identifier: `192.168.3.1` // We will use the LAN IP of RUT1 for the Identifier
−
[Screenshot Here]
+
<br>
    +
[[File:RUT2 IPSec Instance General Settings Configuration.png|frame|none]]
 +
 +
<br>
    
* Connection settings Advanced settings configuration as follows:
 
* Connection settings Advanced settings configuration as follows:
 
    
 
    
 
- Remote certificate: `RUT1.cert.pem` // Upload RUT1 cert we created earlier.
 
- Remote certificate: `RUT1.cert.pem` // Upload RUT1 cert we created earlier.
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT2 IPSec Instance Advanced Settings Configuration.png|frame|none]]
 +
 
 +
<br>
    
* Connection settings General settings configuration as follows:
 
* Connection settings General settings configuration as follows:
Line 405: Line 442:     
- Key exchange: `IKEv2`
 
- Key exchange: `IKEv2`
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT2 IPSec Connection Settings General Settings Configuration.png|frame|none]]
    +
<br>
    
* Connection settings Advanced settings configuration as follows:
 
* Connection settings Advanced settings configuration as follows:
Line 427: Line 467:     
- The rest of the configuration leave as default
 
- The rest of the configuration leave as default
−
[Screenshot Here]
+
<br>
    +
[[File:RUT2 IPSec Connection Settings Advanced Settings Configuration.png|frame|none]]
 +
 +
<br>
    
* Connection settings Proposal settings configuration as follows:
 
* Connection settings Proposal settings configuration as follows:
Line 443: Line 486:     
- IKE lifetime: `3h`
 
- IKE lifetime: `3h`
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT2 IPSec Proposal Settings Phase1.png|frame|none]]
 +
 
 +
<br>
    
* Phase 2
 
* Phase 2
Line 456: Line 503:     
- IKE lifetime: `3h`
 
- IKE lifetime: `3h`
−
[Screenshot Here]
+
<br>
    +
[[File:RUT2 IPSec Proposal Settings Phase2.png|frame|none]]
 +
 +
<br>
    
* Hit 'Save & Apply'
 
* Hit 'Save & Apply'
 
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
 
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT2 IPSec Toggle On Save And Apply.png|frame|none]]
 +
 
 +
<br>
    
* Reboot the device once you have finished.
 
* Reboot the device once you have finished.
Line 479: Line 533:  
* SSH into RUT1 device
 
* SSH into RUT1 device
 
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
 
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT1 IPSec Status.png|frame|none]]
    +
<br>
 
* `ping 192.168.14.1` // You should get a response if the tunnel has established properly
 
* `ping 192.168.14.1` // You should get a response if the tunnel has established properly
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT1 Ping To RUT2 Check.png|frame|none]]
 +
 
 +
<br>
    
* SSH into RUT2 device
 
* SSH into RUT2 device
 
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
 
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT2 IPSec Status.png|frame|none]]
 +
 
 +
<br>
    
* `ping 192.168.3.1` // You should get a response if the tunnel has established properly
 
* `ping 192.168.3.1` // You should get a response if the tunnel has established properly
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT2 Ping To RUT1 Check.png|frame|none]]
 +
 
 +
<br>
    
* SSH into RUT1 device
 
* SSH into RUT1 device
Line 499: Line 568:  
* On RUT1 wait 10 seconds then CTRL+C to stop the program
 
* On RUT1 wait 10 seconds then CTRL+C to stop the program
 
* Then use a program like WinSCP to download `Checking_For_ESP_Packets.pcap` from RUT1
 
* Then use a program like WinSCP to download `Checking_For_ESP_Packets.pcap` from RUT1
−
* Open the file in a program called Wireshark and filter for encrypted ESP packets with this `_ws.col.protocol == "ESP"`. You should see ESP packets from both the WAN IPs. You shouldn't be able to see inside the packet because it is now encrypted, but if we decrypted the packets we would see the ICMP packets between the 2 RUT devices.
+
* Open the file in a program called Wireshark and filter for encrypted ESP packets with this '''_ws.col.protocol == "ESP"'''. You should see ESP packets from both the WAN IPs. You shouldn't be able to see inside the packet because it is now encrypted, but if we decrypted the packets we would see the ICMP packets between the 2 RUT devices.
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:Checking Pcap With Wireshark.png|frame|none]]
 +
 
 +
<br>
    
===RUT1 LAN device to RUT2 LAN device Test===
 
===RUT1 LAN device to RUT2 LAN device Test===
Line 527: Line 600:  
* Perform similar steps above for a 2nd device connected to RUT2 LAN
 
* Perform similar steps above for a 2nd device connected to RUT2 LAN
 
* Once both devices are connected to the LAN of RUT1 & RUT2 you should be able to ping the devices from each other.
 
* Once both devices are connected to the LAN of RUT1 & RUT2 you should be able to ping the devices from each other.
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:LAN To LAN Device Ping.png|frame|none]]
    +
<br>
 
* Afterwards make sure to re-enable the firewall for both LAN devices
 
* Afterwards make sure to re-enable the firewall for both LAN devices
Retrieved from "https://wiki.teltonika-networks.com/view/Special:MobileDiff/128144...128169"