0
edits
Changes
Template:Networking rut configuration example l2tp over ipsec work use case default gateway (view source)
Revision as of 17:52, 13 May 2020
, 17:52, 13 May 2020Created page with "<table class="nd-othertables_2"> <tr> <th width=325; style="border-bottom: 1px solid white;></th> <th width=820; style="border-bottom: 1px solid white;" ro..."
<table class="nd-othertables_2">
<tr>
<th width=325; style="border-bottom: 1px solid white;></th>
<th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
[[File:Networking_rutxxx_VPN_between_HQ_topology_v2.png|border|class=tlt-border|750px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
{|align=center
|__TOC__
|}
</td>
</tr>
</table>
==Configuration overview and prerequisites==
'''Prerequisites''':
* One RUTxxx routers of any type (excluding [[RUT850]])
* A Public Static or Public Dynamic IP addresses
* At least one end device with Windows 10
<br>
The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address ('''''RUT955''''') acts as the '''L2TP/IPsec server''' and the '''Windows 10 device''' acts as '''client'''. L2TP connects the networks of '''RUT955''' and '''Windows 10 client''', IPsec provides the encryption for the L2TP tunnel.
When the scheme is realized, home workers will be able to reach corporation’s internal network with all internal systems, allowing working from home to be possible. All of the home workers LAN and WAN traffic is going to go through that tunnel.
==Configuring HQ corporation router==
===L2TP===
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2> [[File:Networking_rut955_configuration_examples_l2tp_over_ipsec_windows_10_1_v2.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Login to the router's WebUI and navigate to the '''Services → VPN → L2TP''' page and do the following:
<ol>
<li>Select '''Role: Server'''.</li>
<li>Enter a '''custom configuration name'''.</li>
<li>Click the '''Add New''' button.</li>
<li>Click the '''Edit''' button next to the newly created L2TP instance.</li>
</ol>
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rut955_configuration_examples_l2tp_over_ipsec_windows_10_2_v2.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
<ol>
<li>'''Enable''' the L2TP instance.</li>
<li>Enter a '''User name''' and '''Password''' for authentication for the client.</li>
<li>Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
<li>Don't forget to '''Save''' the changes.</li>
</ol>
</td>
</tr>
</table>
===IPsec===
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_3_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Go to the '''Services → VPN → IPsec''' page and do the following:
<ol>
<li>Enter a custom name for the IPsec instance.</li>
<li>Click the '''Add''' button.</li>
<li>Click the '''Edit''' button next to the newly created instance.</li>
</ol>
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_4_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
In the '''IPsec Configuration''' page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):
<ol>
<li>'''Enable''' the instance.</li>
<li>Select '''Type: Transport''' and '''Save''' changes.</li>
</ol>
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_5_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
After saving the changes, you will be redirected back to the main IPsec page. While there, locate the '''Pre-shared Keys''' section and do the following:
<ol>
<li>Click the '''Add''' button.</li>
<li>Enter your '''Pre-shared key'''.</li>
<li>Enter '''%any''' under '''Secret's ID selector'''.</li>
<li>Click the '''Save''' button.</li>
</ol>
</td>
</tr>
</table>
===Firewall===
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_16_v2.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Go to the '''Network → Firewall → General Settings''' and press edit next to the L2TP zone forwarding rule:
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_17_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Allow L2TP forward to '''WAN''' and click the '''Save''' button:
</td>
</tr>
</table>
==Home worker’s computer==
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;"></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_6_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Type '''VPN settings''' in the Windows search bar:
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;"></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_7_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Click the '''Add a VPN connection''' button:
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;"></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_8_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Configure the following parameters:
<ol>
<li>Select '''VPN provider: Windows (built-in)'''.</li>
<li>Enter a custom '''Connection name'''.</li>
<li>Enter the router's WAN IP address into the '''Server name or address''' field.</li>
<li>Select '''VPN type: L2TP/IPsec with pre-shared key'''.</li>
<li>Enter the '''Pre-shared key''' exactly as it was specified on the router.</li>
<li>Select '''Type of sign-in info: User name and password'''.</li>
<li>Enter the '''User name''' and '''Password''' exactly as they were specified on the router.</li>
<li>Click '''Save'''</li>
</ol>
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;"></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_9_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
After you are redirected back to the VPN settings page, locate your new connection and click the Connect button. If the connection was successful, you should see the word "connected" appear under the connection name:
</td>
</tr>
</table>
==Results==
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_10_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Home worker should now be able to access HQ network resources.
To verify the connection you can ping some internal HQ server and if you get a reply, you have successfully connected to HQ‘s internal network.
</td>
</tr>
</table>
<tr>
<th width=325; style="border-bottom: 1px solid white;></th>
<th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
[[File:Networking_rutxxx_VPN_between_HQ_topology_v2.png|border|class=tlt-border|750px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
{|align=center
|__TOC__
|}
</td>
</tr>
</table>
==Configuration overview and prerequisites==
'''Prerequisites''':
* One RUTxxx routers of any type (excluding [[RUT850]])
* A Public Static or Public Dynamic IP addresses
* At least one end device with Windows 10
<br>
The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address ('''''RUT955''''') acts as the '''L2TP/IPsec server''' and the '''Windows 10 device''' acts as '''client'''. L2TP connects the networks of '''RUT955''' and '''Windows 10 client''', IPsec provides the encryption for the L2TP tunnel.
When the scheme is realized, home workers will be able to reach corporation’s internal network with all internal systems, allowing working from home to be possible. All of the home workers LAN and WAN traffic is going to go through that tunnel.
==Configuring HQ corporation router==
===L2TP===
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2> [[File:Networking_rut955_configuration_examples_l2tp_over_ipsec_windows_10_1_v2.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Login to the router's WebUI and navigate to the '''Services → VPN → L2TP''' page and do the following:
<ol>
<li>Select '''Role: Server'''.</li>
<li>Enter a '''custom configuration name'''.</li>
<li>Click the '''Add New''' button.</li>
<li>Click the '''Edit''' button next to the newly created L2TP instance.</li>
</ol>
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rut955_configuration_examples_l2tp_over_ipsec_windows_10_2_v2.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
<ol>
<li>'''Enable''' the L2TP instance.</li>
<li>Enter a '''User name''' and '''Password''' for authentication for the client.</li>
<li>Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
<li>Don't forget to '''Save''' the changes.</li>
</ol>
</td>
</tr>
</table>
===IPsec===
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_3_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Go to the '''Services → VPN → IPsec''' page and do the following:
<ol>
<li>Enter a custom name for the IPsec instance.</li>
<li>Click the '''Add''' button.</li>
<li>Click the '''Edit''' button next to the newly created instance.</li>
</ol>
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_4_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
In the '''IPsec Configuration''' page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):
<ol>
<li>'''Enable''' the instance.</li>
<li>Select '''Type: Transport''' and '''Save''' changes.</li>
</ol>
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_5_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
After saving the changes, you will be redirected back to the main IPsec page. While there, locate the '''Pre-shared Keys''' section and do the following:
<ol>
<li>Click the '''Add''' button.</li>
<li>Enter your '''Pre-shared key'''.</li>
<li>Enter '''%any''' under '''Secret's ID selector'''.</li>
<li>Click the '''Save''' button.</li>
</ol>
</td>
</tr>
</table>
===Firewall===
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_16_v2.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Go to the '''Network → Firewall → General Settings''' and press edit next to the L2TP zone forwarding rule:
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_17_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Allow L2TP forward to '''WAN''' and click the '''Save''' button:
</td>
</tr>
</table>
==Home worker’s computer==
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;"></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_6_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Type '''VPN settings''' in the Windows search bar:
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;"></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_7_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Click the '''Add a VPN connection''' button:
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;"></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_8_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Configure the following parameters:
<ol>
<li>Select '''VPN provider: Windows (built-in)'''.</li>
<li>Enter a custom '''Connection name'''.</li>
<li>Enter the router's WAN IP address into the '''Server name or address''' field.</li>
<li>Select '''VPN type: L2TP/IPsec with pre-shared key'''.</li>
<li>Enter the '''Pre-shared key''' exactly as it was specified on the router.</li>
<li>Select '''Type of sign-in info: User name and password'''.</li>
<li>Enter the '''User name''' and '''Password''' exactly as they were specified on the router.</li>
<li>Click '''Save'''</li>
</ol>
</td>
</tr>
</table>
----
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;"></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_9_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
After you are redirected back to the VPN settings page, locate your new connection and click the Connect button. If the connection was successful, you should see the word "connected" appear under the connection name:
</td>
</tr>
</table>
==Results==
<table class="nd-othertables_2">
<tr>
<th width=525; style="border-bottom: 1px solid white;></th>
<th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_10_v1.png|border|class=tlt-border|550px|right]]</th>
</tr>
<tr>
<td style="border-bottom: 1px solid white>
Home worker should now be able to access HQ network resources.
To verify the connection you can ping some internal HQ server and if you get a reply, you have successfully connected to HQ‘s internal network.
</td>
</tr>
</table>