IPsec configuration examples: Difference between revisions
no edit summary
No edit summary |
|||
| (4 intermediate revisions by 2 users not shown) | |||
| Line 11: | Line 11: | ||
'''Prerequisites''': | '''Prerequisites''': | ||
* Two RUTxxx routers of any type (excluding [[RUT850]]) | * Two RUTxxx routers of any type (excluding [[RUT850]]) | ||
* | * At least one router must have a Public Static or Public Dynamic IP address | ||
* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers | * At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers | ||
* (Optional) A second end device to configure and test remote LAN access | * (Optional) A second end device to configure and test remote LAN access | ||
| Line 21: | Line 21: | ||
[[File:Configuration examples ipsec scheme 1.png]] | [[File:Configuration examples ipsec scheme 1.png]] | ||
The figure | The figure above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via the Internet. | ||
---- | ---- | ||
'''Configuration scheme 2''': | '''Configuration scheme 2''': | ||
| Line 43: | Line 43: | ||
* Login to the router's WebUI and go to '''Services → VPN → IPsec'''. Enter a custom name (for this example we use ''RUT1'') for the IPsec instance click the "Add" button: | * Login to the router's WebUI and go to '''Services → VPN → IPsec'''. Enter a custom name (for this example we use ''RUT1'') for the IPsec instance click the "Add" button: | ||
[[File: | [[File:Ipsec1.png|alt=|1126x1126px]] | ||
---- | ---- | ||
* Click the "Edit" button located next to the newly created instance: | * Click the "Edit" button located next to the newly created instance: | ||
[[File: | [[File:Ipsec2.png|alt=|1129x1129px]] | ||
---- | ---- | ||
* You will be redirected to the instance's configuration window. From here we will discuss how to configure both instances (''RUT1'' and ''RUT2''). Creating a second instance is analogous to how we created the first one - just login to the second router and repeat the first two steps. Although not mandatory, we recommend that you use a distinct name for the second instance (for this example we use ''RUT2'') for easier management purposes. <br> The specifics of both configurations are described in the figure below: | * You will be redirected to the instance's configuration window. From here we will discuss how to configure both instances (''RUT1'' and ''RUT2''). Creating a second instance is analogous to how we created the first one - just login to the second router and repeat the first two steps. Although not mandatory, we recommend that you use a distinct name for the second instance (for this example we use ''RUT2'') for easier management purposes. <br> The specifics of both configurations are described in the figure below: | ||
[[File: | [[File:Ipsec3.png|alt=|1150x1150px]] | ||
* Below are explanations of the parameters highlighted in the figure above. Other parameters (not highlighted) are defaults. You can find descriptions for these parameters in the '''[[VPN#IPsec|VPN manual page, IPsec section]]''' | * Below are explanations of the parameters highlighted in the figure above. Other parameters (not highlighted) are defaults. You can find descriptions for these parameters in the '''[[VPN#IPsec|VPN manual page, IPsec section]]''' | ||
** '''Enable''' - enables the IPsec instance | **'''Enable''' - enables the IPsec instance | ||
** ''' | ** '''Remote Endpoint''' - the Public IP address of the opposite router, leaving empty will force IPSec to only accept connections. | ||
** '''Pre shared key''' - a shared password used for authentication between the peers. The value of this field must match on both instances | ** '''Pre shared key''' - a shared password used for authentication between the peers. The value of this field must match on both instances | ||
** ''' | **'''Local Identifier''' - private IP address of your router. | ||
** '''Remote | **'''Remote Identifier''' - private IP of the opposite router. | ||
** ''' | ** '''Local subnet''' - routers local subnet. | ||
** '''Remote subnet''' - opposite routers subnet. | |||
'''NOTE''': remember to replace certain parameter values (like IP addresses) with your own relevant data. | '''NOTE''': remember to replace certain parameter values (like IP addresses) with your own relevant data. | ||
---- | ---- | ||
* The last step in configuring the IPsec instances is ''' | * The last step in configuring the IPsec instances is '''Proposal settings'''. Make sure they match with the Phase settings ('''both Phase 1 and Phase 2''') of the incoming connection: | ||
[[File: | [[File:Ipsec4.png|alt=|1572x1572px]] | ||
When you're finished with the configuration, don't forget to click the "Save" button. | When you're finished with the configuration, don't forget to click the "Save" button. | ||
===Remote LAN access=== | <!--===Remote LAN access=== | ||
---- | ---- | ||
Once your IPsec tunnel is operational, you can configure remote access to LAN devices via the tunnel as referenced in ''[[IPsec_configuration_examples#Configuration_overview_and_prerequisites|configuration scheme 2]]''. This section provides a description on how to do just that. | Once your IPsec tunnel is operational, you can configure remote access to LAN devices via the tunnel as referenced in ''[[IPsec_configuration_examples#Configuration_overview_and_prerequisites|configuration scheme 2]]''. This section provides a description on how to do just that. | ||
| Line 86: | Line 84: | ||
'''NOTE''': make sure to add a new entry in the Static Routes table when you configure custom routes. You can configure existing routes, but take note that this may cause backup WAN to function improperly or not at all. | '''NOTE''': make sure to add a new entry in the Static Routes table when you configure custom routes. You can configure existing routes, but take note that this may cause backup WAN to function improperly or not at all. | ||
--> | |||
==Testing the setup== | ==Testing the setup== | ||