Changes

IPSec Tunnel w/CA Certs Configuration (view source)

Revision as of 17:27, 28 June 2024

3,596 bytes added ,  Friday at 17:27
no edit summary
Line 5: Line 5:  
In computing, '''Internet Protocol Security''' ('''IPsec''') is a secure network protocol suite of IPv4 that authenticates and encrypts the packets of data sent over an IPv4 network. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to use during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). Internet Protocol security (IPsec) uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data-origin authentication, data integrity, data confidentiality (encryption), and replay protection.
 
In computing, '''Internet Protocol Security''' ('''IPsec''') is a secure network protocol suite of IPv4 that authenticates and encrypts the packets of data sent over an IPv4 network. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to use during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). Internet Protocol security (IPsec) uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data-origin authentication, data integrity, data confidentiality (encryption), and replay protection.
   −
This article provides an extensive configuration example with details on how to create a tunnel connection authenticating with CA Certs between two IPsec instances, both of which configured on RUTxxx routers.
+
This article provides an extensive configuration example with details on how to create a tunnel connection authenticating with X.509 Certs between two IPsec instances, both of which configured on RUTxxx routers.
    
==Configuration overview and prerequisites==
 
==Configuration overview and prerequisites==
Line 43: Line 43:  
The following are the settings used for this example, but values should be changed depending on your specific needs:
 
The following are the settings used for this example, but values should be changed depending on your specific needs:
   −
- File Type: CA
+
- File Type: '''''CA'''''
−
- Key Size: 1024
  −
- Name (CN): CAIPSec // This can be whatever name you choose.
  −
- Subject Information: Toggled On // It is recommended to fill out at least Country Code, State/Province and Organization Name.
  −
- Country Code (CC): US // Fill your country code
  −
- State or Province Name (ST): TX // Fill your State/Province name
  −
- Locality Name (L): CAIPSec // Fill your locality name, or at least a recognizable name for your CA
  −
- Organization Name (O): CAIPSec // Fill your Organization name
  −
- Organizational Unit Name (OU): CAIPSEC // Fill your specific Unit Name
  −
- `Generate` Certificate
     −
[Screenshot Here]
+
- Key Size: '''''1024'''''
   −
After you hit Generate the CA cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.key.pem under *Keys* and a CAIPSec.req.pem under *Certificate requests*.
+
- Name (CN): '''''CAIPSec''''' // This can be whatever name you choose.
   −
[Screenshot Here]
+
- Subject Information: '''''Toggled On''''' // It is recommended to fill out at least Country Code, State/Province and Organization Name.
    +
- Country Code (CC): '''''US''''' // Fill your country code
    +
- State or Province Name (ST): '''''TX''''' // Fill your State/Province name
 +
 +
- Locality Name (L): '''''CAIPSec''''' // Fill your locality name, or at least a recognizable name for your CA
 +
 +
- Organization Name (O): '''''CAIPSec''''' // Fill your Organization name
 +
 +
- Organizational Unit Name (OU): '''''CAIPSEC''''' // Fill your specific Unit Name
 +
 +
- '''''Generate''''' Certificate
 +
<br>
 +
 +
[[File:IPSec CA Cert Generating.png|frame|none]]
 +
 +
<br>
 +
After you hit Generate the CA cert you should see a confirmation notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.key.pem under *Keys* and a CAIPSec.req.pem under *Certificate requests*.
 +
<br>
 +
 +
[[File:IPSec CA Cert Generating Confirmation.png|frame|none]]
 +
[[File:IPSec CA Cert Generating Manager Check.png|frame|none]]
 +
 +
<br>
 
Next we need to sign the CAIPSec CA. We will be Self-Signing our own CA.
 
Next we need to sign the CAIPSec CA. We will be Self-Signing our own CA.
−
Under the `Certificate signing` configure as follows:
+
Under the '''Certificate signing''' configure as follows:
 +
 
 +
- Signed Certificate Name: '''''CAIPSec'''''
 +
 
 +
- Type of Certificate to Sign: '''''Certificate Authority'''''
 +
 
 +
- Certificate Request File: '''''CAIPSec.req.pem'''''
 +
 
 +
- Days Valid: '''''3650''''' // For this example we will use 3650 days, but you can configure this to be longer if needed. I would caution against too long of a CA.
 +
 
 +
- Certificate Authority Key: '''''CAIPSec.key.pem'''''
 +
 
 +
- Leave the rest of the configuration default
 +
 
 +
- '''''Sign'''''
 +
<br>
   −
- Signed Certificate Name: CAIPSec
+
[[File:IPSec CA Cert Signing.png|frame|none]]
−
- Type of Certificate to Sign: Certificate Authority
  −
- Certificate Request File: CAIPSec.req.pem
  −
- Days Valid: 3650 // For this example we will use 3650 days, but you can configure this to be longer if needed. I would caution against too long of a CA.
  −
- Certificate Authority Key: CAIPSec.key.pem
  −
- Leave the rest of the configuration alone
  −
- `Sign`
      +
<br>
 
After you hit *Sign* the CA cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.cert.pem under *Certificates*.
 
After you hit *Sign* the CA cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.cert.pem under *Certificates*.
 +
<br>
   −
[Screenshot Here]
+
[[File:IPSec CA Cert Generating Confirmation2.png|frame|none]]
 +
<br>
    
====Generating Rut1 Client Cert====
 
====Generating Rut1 Client Cert====
Line 82: Line 107:  
The following are the settings used for this example, but values should be changed depending on your specific needs:
 
The following are the settings used for this example, but values should be changed depending on your specific needs:
   −
- File Type: Client
+
- File Type: '''''Client'''''
−
- Key Size: 1024
+
 
−
- Name (CN): RUT1 // This can be whatever name you choose.
+
- Key Size: '''''1024'''''
−
- Subject Information: Toggled On // It is recommended to fill out at least Country Code, State/Province and Organization Name.
+
 
−
- Country Code (CC): US // Fill your country code
+
- Name (CN): '''''RUT1''''' // This can be whatever name you choose.
−
- State or Province Name (ST): TX // Fill your State/Province name
+
 
−
- Locality Name (L): RUT1 // Fill your locality name, or at least a recognizable name for your CA
+
- Subject Information: '''''Toggled On''''' // It is recommended to fill out at least Country Code, State/Province and Organization Name.
−
- Organization Name (O): RUT1 // Fill your Organization name
+
 
−
- Organizational Unit Name (OU): RUT1 // Fill your specific Unit Name
+
- Country Code (CC): '''''US''''' // Fill your country code
−
- `Generate` Certificate
+
 
 +
- State or Province Name (ST): '''''TX''''' // Fill your State/Province name
 +
 
 +
- Locality Name (L): '''''RUT1''''' // Fill your locality name, or at least a recognizable name for your CA
 +
 
 +
- Organization Name (O): '''''RUT1''''' // Fill your Organization name
 +
 
 +
- Organizational Unit Name (OU): '''''RUT1''''' // Fill your specific Unit Name
   −
[Screenshot Here]
+
- '''''Generate''''' Certificate
 +
<br>
    +
[[File:IPSec RUT1 Cert Generating.png|frame|none]]
 +
 +
<br>
 
After you hit Generate the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT1.key.pem under *Keys* and a RUT1.req.pem under *Certificate requests*.
 
After you hit Generate the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT1.key.pem under *Keys* and a RUT1.req.pem under *Certificate requests*.
 +
<br>
    +
[[File:IPSec RUT1 Cert Generating Confirmation.png|frame|none]]
 +
 +
<br>
    
Next we need to sign the RUT1 cert.
 
Next we need to sign the RUT1 cert.
 
Under the `Certificate signing` configure as follows:
 
Under the `Certificate signing` configure as follows:
   −
- Signed Certificate Name: RUT1
+
- Signed Certificate Name: '''''RUT1'''''
−
- Type of Certificate to Sign: Client Certificate
+
 
−
- Certificate Request File: RUT1.req.pem
+
- Type of Certificate to Sign: '''''Client Certificate'''''
−
- Days Valid: 3650
+
 
−
- Certificate Authority File: CAIPSec.cert.pem
+
- Certificate Request File: '''''RUT1.req.pem'''''
−
- Certificate Authority Key: CAIPSec.key.pem
+
 
 +
- Days Valid: '''''3650'''''
 +
 
 +
- Certificate Authority File: '''''CAIPSec.cert.pem'''''
 +
 
 +
- Certificate Authority Key: '''''CAIPSec.key.pem'''''
 +
 
 
- Leave the rest of the configuration alone
 
- Leave the rest of the configuration alone
−
- `Sign`
      +
- '''''Sign'''''
 +
<br>
 +
 +
[[File:IPSec RUT1 Cert Signing.png|frame|none]]
 +
 +
<br>
 
After you hit *Sign* the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT1.cert.pem under *Certificates*.
 
After you hit *Sign* the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT1.cert.pem under *Certificates*.
 +
<br>
 +
 +
[[File:IPSec RUT1 Cert Manager Check.png|frame|none]]
   −
[Screenshot Here]
+
<br>
    
====Generating Rut2 Client Cert====
 
====Generating Rut2 Client Cert====
Line 123: Line 177:  
The following are the settings used for this example, but values should be changed depending on your specific needs:
 
The following are the settings used for this example, but values should be changed depending on your specific needs:
   −
- File Type: Client
+
- File Type: '''''Client'''''
−
- Key Size: 1024
+
 
−
- Name (CN): RUT2 // This can be whatever name you choose.
+
- Key Size: '''''1024'''''
−
- Subject Information: Toggled On // It is recommended to fill out at least Country Code, State/Province and Organization Name.
  −
- Country Code (CC): US // Fill your country code
  −
- State or Province Name (ST): TX // Fill your State/Province name
  −
- Locality Name (L): RUT2 // Fill your locality name, or at least a recognizable name for your CA
  −
- Organization Name (O): RUT2 // Fill your Organization name
  −
- Organizational Unit Name (OU): RUT2 // Fill your specific Unit Name
  −
- `Generate` Certificate
     −
[Screenshot Here]
+
- Name (CN): '''''RUT2''''' // This can be whatever name you choose.
   −
After you hit Generate the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT2.key.pem under *Keys* and a RUT1.req.pem under *Certificate requests*.
+
- Subject Information: '''''Toggled On''''' // It is recommended to fill out at least Country Code, State/Province and Organization Name.
    +
- Country Code (CC): '''''US''''' // Fill your country code
    +
- State or Province Name (ST): '''''TX''''' // Fill your State/Province name
 +
 +
- Locality Name (L): '''''RUT2''''' // Fill your locality name, or at least a recognizable name for your CA
 +
 +
- Organization Name (O): '''''RUT2''''' // Fill your Organization name
 +
 +
- Organizational Unit Name (OU): '''''RUT2''''' // Fill your specific Unit Name
 +
 +
- '''''Generate''''' Certificate
 +
<br>
 +
 +
[[File:IPSec RUT2 Cert Generating.png|frame|none]]
 +
 +
<br>
 +
After you hit Generate the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT2.key.pem under *Keys* and a RUT2.req.pem under *Certificate requests*.
 +
<br>
 +
 +
[[File:IPSec RUT2 Cert Generating Confirmation.png|frame|none]]
 +
 +
<br>
 
Next we need to sign the RUT2 cert.
 
Next we need to sign the RUT2 cert.
 
Under the `Certificate signing` configure as follows:
 
Under the `Certificate signing` configure as follows:
   −
- Signed Certificate Name: RUT2
+
- Signed Certificate Name: '''''RUT2'''''
−
- Type of Certificate to Sign: Client Certificate
+
 
−
- Certificate Request File: RUT2.req.pem
+
- Type of Certificate to Sign: '''''Client Certificate'''''
−
- Days Valid: 3650
+
 
−
- Certificate Authority File: CAIPSec.cert.pem
+
- Certificate Request File: '''''RUT2.req.pem'''''
−
- Certificate Authority Key: CAIPSec.key.pem
+
 
 +
- Days Valid: '''''3650'''''
 +
 
 +
- Certificate Authority File: '''''CAIPSec.cert.pem'''''
 +
 
 +
- Certificate Authority Key: '''''CAIPSec.key.pem'''''
 +
 
 
- Leave the rest of the configuration alone
 
- Leave the rest of the configuration alone
−
- `Sign`
      +
- '''''Sign'''''
 +
<br>
 +
 +
[[File:IPSec RUT2 Cert Signing.png|frame|none]]
 +
 +
<br>
 
After you hit *Sign* the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT2.cert.pem under *Certificates*.
 
After you hit *Sign* the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT2.cert.pem under *Certificates*.
 +
<br>
   −
[Screenshot Here]
+
[[File:IPSec RUT2 Cert Manager Check.png|frame|none]]
    +
<br>
 
====Download/Import Certs====
 
====Download/Import Certs====
 
----
 
----
Line 162: Line 243:  
* Login to the router's WebUI and go to '''System → Administration → Certificates -> Certificates Manager'''
 
* Login to the router's WebUI and go to '''System → Administration → Certificates -> Certificates Manager'''
 
* Download CAIPSec.cert.pem, RUT1.cert.pem, RUT1.key.pem, RUT2.cert.pem & RUT2.key.pem
 
* Download CAIPSec.cert.pem, RUT1.cert.pem, RUT1.key.pem, RUT2.cert.pem & RUT2.key.pem
−
* Go to '''System → Administration → Certificates -> Root CA'''. Toggle `On`. Select `CAIPSec.cert.pem` -> `Upload` & then `Save`
+
* Go to '''System → Administration → Certificates -> Root CA'''. Toggle '''On'''. Select '''CAIPSec.cert.pem''' -> '''Upload''' & then '''Save'''
    
Next moving to RUT2
 
Next moving to RUT2
Line 168: Line 249:  
* Login to the router's WebUI and go to '''System → Administration → Certificates -> Certificates Manager'''
 
* Login to the router's WebUI and go to '''System → Administration → Certificates -> Certificates Manager'''
 
* Import Certificate File *Browse* and import CAIPSec.cert.pem, RUT1.cert.pem, RUT2.cert.pem & RUT2.key.pem
 
* Import Certificate File *Browse* and import CAIPSec.cert.pem, RUT1.cert.pem, RUT2.cert.pem & RUT2.key.pem
−
* Go to '''System → Administration → Certificates -> Root CA'''. Toggle `On`. Select `CAIPSec.cert.pem` -> `Upload` & then `Save`
+
* Go to '''System → Administration → Certificates -> Root CA'''. Toggle '''On'''. Select '''CAIPSec.cert.pem''' -> '''Upload''' & then '''Save'''
    
===IPSec RUT1 Config===
 
===IPSec RUT1 Config===
Line 174: Line 255:     
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
 
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
−
* Add a new instance called `CA_EX`
+
* Add a new instance called '''CA_EX'''
−
[Screenshot Here]
+
<br>
    +
[[File:IPSec RUT1 Config Add CA EX.png|frame|none]]
 +
 +
<br>
 
* IPsec Instance General settings configuration as follows:
 
* IPsec Instance General settings configuration as follows:
 
    
 
    
−
- Remote endpoint: `192.168.1.14` // This should be RUT2 WAN IP. You should be able to ping this IP from RUT1 WAN IP.
+
    - Remote endpoint: '''''192.168.1.14''''' // This should be RUT2 WAN IP. You should be able to ping this IP from RUT1 WAN IP.
−
- Authentication method: `X.509`
+
 
−
- Key: `RUT1.key.pem` // Browse and import the RUT1.key.pem we created & downloaded earlier.
+
    - Authentication method: '''''X.509'''''
−
- Key decryption passphrase: Leave blank // This is only needed if an additional password was added to the cert, which we did not do in our earlier steps.
+
 
−
- Local certificate: `RUT1.cert.pem` // Browse and import the RUT1.cert.pem we created & downloaded earlier.
+
    - Key: '''''RUT1.key.pem''''' // Browse and import the RUT1.key.pem we created & downloaded earlier.
−
- CA certificate: `CAIPSec.cert.pem` // Browse and import the CAIPSec.cert.pem we created & downloaded earlier.
  −
- Local identifier: `192.168.3.1` // We will use the LAN IP of RUT1 for the Identifier
  −
- Remote identifier: `192.168.14.1` // We will use the LAN IP of RUT2 for the Identifier
  −
[Screenshot Here]
      +
    - Key decryption passphrase: Leave blank // This is only needed if an additional password was added to the cert, which we did not do in our earlier steps.
   −
* Connection settings Advanced settings configuration as follows:
+
    - Local certificate: '''''RUT1.cert.pem''''' // Browse and import the RUT1.cert.pem we created & downloaded earlier.
 +
 
 +
    - CA certificate: '''''CAIPSec.cert.pem''''' // Browse and import the CAIPSec.cert.pem we created & downloaded earlier.
 +
 
 +
    - Local identifier: '''''192.168.3.1''''' // We will use the LAN IP of RUT1 for the Identifier
 +
 
 +
    - Remote identifier: '''''192.168.14.1''''' // We will use the LAN IP of RUT2 for the Identifier
 +
<br>
 +
 
 +
[[File:RUT1 IPSec Instance General Settings Configuration.png|frame|none]]
 +
 
 +
<br>
 +
 
 +
* IPsec Instance Advanced settings configuration as follows:
 
    
 
    
−
- Remote certificate: `RUT2.cert.pem` // Upload RUT2 cert we created earlier.
+
    - Remote certificate: '''''RUT2.cert.pem''''' // Upload RUT2 cert we created earlier.
 +
<br>
 +
 
 +
[[File:RUT1 IPSec Instance Advanced Settings Configuration.png|frame|none]]
    +
<br>
    
* Connection settings General settings configuration as follows:
 
* Connection settings General settings configuration as follows:
   −
- Mode: `Start` // start loads a connection and brings
+
    - Mode: '''''Start''''' // start loads a connection and brings it up immediately. For more configuration information please reference *auto* here (https://wiki.strongswan.org/projects/strongswan/wiki/Connsection)
−
it up immediately. For more configuration information please reference *auto* here (https://wiki.strongswan.org/projects/strongswan/wiki/Connsection)
+
 
−
- Type: `Tunnel`
+
    - Type: '''''Tunnel'''''
−
- Default route: `off` // Only use this if you want your default route to be out this tunnel.
+
 
−
- Local subnet: `192.168.3.0/24` // RUT1 LAN subnet we want access to through the tunnel
+
    - Default route: '''''off''''' // Only use this if you want your default route to be out this tunnel.
−
- Remote subnet: `192.168.14.0/24` // RUT2 LAN subnet we want access to through the tunnel
+
 
−
- Key exchange: `IKEv2`
+
    - Local subnet: '''''192.168.3.0/24''''' // RUT1 LAN subnet we want access to through the tunnel
−
[Screenshot Here]
      +
    - Remote subnet: '''''192.168.14.0/24''''' // RUT2 LAN subnet we want access to through the tunnel
 +
 +
    - Key exchange: '''''IKEv2'''''
 +
<br>
 +
 +
[[File:RUT1 IPSec Connection Settings General Settings Configuration.png|frame|none]]
 +
 +
<br>
    
* Connection settings Advanced settings configuration as follows:
 
* Connection settings Advanced settings configuration as follows:
   −
- Force encapsulation: `On`
+
    - Force encapsulation: '''''On'''''
−
- Local Firewall: `On`
  −
- Remote Firewall: `On`
  −
- Inactivity: `3600` // This is in seconds. Can be changed depending on how often you want the tunnel to be checked for data passing.
  −
- Dead peer detection: `On`
  −
- DPD action: `Restart`
  −
- DPD delay: `30` // This is in seconds.
  −
- DPD Timeout: `150` // This is in seconds.
  −
- The rest of the configuration leave as default
  −
[Screenshot Here]
      +
    - Local Firewall: '''''On'''''
 +
 +
    - Remote Firewall: '''''On'''''
 +
 +
    - Inactivity: '''''3600''''' // This is in seconds. Can be changed depending on how often you want the tunnel to be checked for data passing.
 +
 +
    - Dead peer detection: '''''On'''''
 +
 +
    - DPD action: '''''Restart'''''
 +
 +
    - DPD delay: '''''30''''' // This is in seconds.
 +
 +
    - DPD Timeout: '''''150''''' // This is in seconds.
 +
 +
    - The rest of the configuration leave as default
 +
 +
<br>
 +
 +
[[File:RUT1 IPSec Connection Settings Advanced Settings Configuration.png|frame|none]]
 +
 +
<br>
    
* Connection settings Proposal settings configuration as follows:
 
* Connection settings Proposal settings configuration as follows:
Line 225: Line 342:  
* Phase 1
 
* Phase 1
 
- Proposals // It is VERY important that these settings match between both RUT1 & RUT2
 
- Proposals // It is VERY important that these settings match between both RUT1 & RUT2
−
   - Encryption: `AES 128`
+
   - Encryption: '''''AES 128'''''
−
   - Authentication: `SHA1`
+
 
−
   - DH group: `MODP1536`
+
   - Authentication: '''''SHA1'''''
−
- Force crypto proposal: `Off`
+
 
−
- IKE lifetime: `3h`
+
   - DH group: '''''MODP1536'''''
−
[Screenshot Here]
+
 
 +
  - Force crypto proposal: '''''Off'''''
 +
 
 +
  - IKE lifetime: '''''3h'''''
 +
<br>
 +
 
 +
[[File:RUT1 IPSec Proposal Settings Phase1.png|frame|none]]
 +
 
 +
<br>
    
* Phase 2
 
* Phase 2
 
- Proposals // It is VERY important that these settings match between both RUT1 & RUT2
 
- Proposals // It is VERY important that these settings match between both RUT1 & RUT2
−
   - Encryption: `AES 128`
+
   - Encryption: '''''AES 128'''''
−
  - Hash: `SHA1`
  −
  - PFS group: `MODP1536`
  −
- Force crypto proposal: `Off`
  −
- IKE lifetime: `3h`
  −
[Screenshot Here]
      +
  - Hash: '''''SHA1'''''
   −
* Hit 'Save & Apply'
+
  - PFS group: '''''MODP1536'''''
−
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
  −
[Screenshot Here]
      +
  - Force crypto proposal: '''''Off'''''
 +
 +
  - IKE lifetime: '''''3h'''''
 +
<br>
 +
 +
[[File:RUT1 IPSec Proposal Settings Phase2.png|frame|none]]
 +
 +
<br>
 +
 +
* Hit '''''Save & Apply'''''
 +
* Toggle the CA_EX tunnel on and hit '''''Save & Apply''''' once more
 +
<br>
 +
[[File:RUT1 IPSec Toggle On Save And Apply.png|frame|none]]
 +
 +
<br>
 
* Reboot the device once you have finished.
 
* Reboot the device once you have finished.
   Line 254: Line 388:     
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
 
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
−
* Add a new instance called `CA_EX`
+
* Add a new instance called '''CA_EX'''
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:IPSec_RUT1_Config_Add_CA_EX.png|frame|none]]
 +
 
 +
<br>
    
* IPsec Instance General settings configuration as follows:
 
* IPsec Instance General settings configuration as follows:
 
    
 
    
−
- Remote endpoint: `192.168.1.3` // This should be RUT1 WAN IP. You should be able to ping this IP from RUT2 WAN IP.
+
    - Remote endpoint: '''''192.168.1.3''''' // This should be RUT1 WAN IP. You should be able to ping this IP from RUT2 WAN IP.
−
- Authentication method: `X.509`
  −
- Key: `RUT2.key.pem` // Browse and import the RUT2.key.pem we created & downloaded earlier.
  −
- Key decryption passphrase: Leave blank // This is only needed if an additional password was added to the cert, which we did not do in our earlier steps.
  −
- Local certificate: `RUT2.cert.pem` // Browse and import the RUT1.cert.pem we created & downloaded earlier.
  −
- CA certificate: `CAIPSec.cert.pem` // Browse and import the CAIPSec.cert.pem we created & downloaded earlier.
  −
- Local identifier: `192.168.14.1` // We will use the LAN IP of RUT2 for the Identifier
  −
- Remote identifier: `192.168.3.1` // We will use the LAN IP of RUT1 for the Identifier
  −
[Screenshot Here]
      +
    - Authentication method: '''''X.509'''''
 +
 +
    - Key: '''''RUT2.key.pem''''' // Browse and import the RUT2.key.pem we created & downloaded earlier.
 +
 +
    - Key decryption passphrase: Leave blank // This is only needed if an additional password was added to the cert, which we did not do in our earlier steps.
 +
 +
    - Local certificate: '''''RUT2.cert.pem''''' // Browse and import the RUT1.cert.pem we created & downloaded earlier.
 +
 +
    - CA certificate: '''''CAIPSec.cert.pem''''' // Browse and import the CAIPSec.cert.pem we created & downloaded earlier.
 +
 +
    - Local identifier: '''''192.168.14.1''''' // We will use the LAN IP of RUT2 for the Identifier
 +
 +
    - Remote identifier: '''''192.168.3.1''''' // We will use the LAN IP of RUT1 for the Identifier
 +
<br>
 +
 +
[[File:RUT2 IPSec Instance General Settings Configuration.png|frame|none]]
 +
 +
<br>
    
* Connection settings Advanced settings configuration as follows:
 
* Connection settings Advanced settings configuration as follows:
 
    
 
    
−
- Remote certificate: `RUT1.cert.pem` // Upload RUT1 cert we created earlier.
+
    - Remote certificate: '''''RUT1.cert.pem''''' // Upload RUT1 cert we created earlier.
 +
<br>
 +
 
 +
[[File:RUT2 IPSec Instance Advanced Settings Configuration.png|frame|none]]
    +
<br>
    
* Connection settings General settings configuration as follows:
 
* Connection settings General settings configuration as follows:
   −
- Mode: `Start` // start loads a connection and brings
+
    - Mode: '''''Start''''' // start loads a connection and brings it up immediately. For more configuration information please reference *auto* here (https://wiki.strongswan.org/projects/strongswan/wiki/Connsection)
−
it up immediately. For more configuration information please reference *auto* here (https://wiki.strongswan.org/projects/strongswan/wiki/Connsection)
+
 
−
- Type: `Tunnel`
+
    - Type: '''''Tunnel'''''
−
- Default route: `off` // Only use this if you want your default route to be out this tunnel.
+
 
−
- Local subnet: `192.168.14.0/24` // RUT2 LAN subnet we want access to through the tunnel
+
    - Default route: '''''off''''' // Only use this if you want your default route to be out this tunnel.
−
- Remote subnet: `192.168.3.0/24` // RUT1 LAN subnet we want access to through the tunnel
  −
- Key exchange: `IKEv2`
  −
[Screenshot Here]
      +
    - Local subnet: '''''192.168.14.0/24''''' // RUT2 LAN subnet we want access to through the tunnel
 +
 +
    - Remote subnet: '''''192.168.3.0/24''''' // RUT1 LAN subnet we want access to through the tunnel
 +
 +
    - Key exchange: '''''IKEv2'''''
 +
<br>
 +
 +
[[File:RUT2 IPSec Connection Settings General Settings Configuration.png|frame|none]]
 +
 +
<br>
    
* Connection settings Advanced settings configuration as follows:
 
* Connection settings Advanced settings configuration as follows:
   −
- Force encapsulation: `On`
+
    - Force encapsulation: '''''On'''''
−
- Local Firewall: `On`
+
 
−
- Remote Firewall: `On`
+
    - Local Firewall: '''''On'''''
−
- Inactivity: `3600` // This is in seconds. Can be changed depending on how often you want the tunnel to be checked for data passing.
+
 
−
- Dead peer detection: `On`
+
    - Remote Firewall: '''''On'''''
−
- DPD action: `Restart`
+
 
−
- DPD delay: `30` // This is in seconds.
+
    - Inactivity: '''''3600''''' // This is in seconds. Can be changed depending on how often you want the tunnel to be checked for data passing.
−
- DPD Timeout: `150` // This is in seconds.
+
 
−
- The rest of the configuration leave as default
+
    - Dead peer detection: '''''On'''''
−
[Screenshot Here]
+
 
 +
    - DPD action: '''''Restart'''''
 +
 
 +
    - DPD delay: '''''30''''' // This is in seconds.
 +
 
 +
    - DPD Timeout: '''''150''''' // This is in seconds.
 +
 
 +
    - The rest of the configuration leave as default
 +
<br>
 +
 
 +
[[File:RUT2 IPSec Connection Settings Advanced Settings Configuration.png|frame|none]]
    +
<br>
    
* Connection settings Proposal settings configuration as follows:
 
* Connection settings Proposal settings configuration as follows:
Line 305: Line 475:  
* Phase 1
 
* Phase 1
 
- Proposals // It is VERY important that these settings match between both RUT1 & RUT2
 
- Proposals // It is VERY important that these settings match between both RUT1 & RUT2
−
   - Encryption: `AES 128`
+
   - Encryption: '''''AES 128'''''
−
   - Authentication: `SHA1`
+
 
−
   - DH group: `MODP1536`
+
   - Authentication: '''''SHA1'''''
−
- Force crypto proposal: `Off`
+
 
−
- IKE lifetime: `3h`
+
   - DH group: '''''MODP1536'''''
−
[Screenshot Here]
+
 
 +
  - Force crypto proposal: '''''Off'''''
 +
 
 +
  - IKE lifetime: '''''3h'''''
 +
<br>
 +
 
 +
[[File:RUT2 IPSec Proposal Settings Phase1.png|frame|none]]
 +
 
 +
<br>
    
* Phase 2
 
* Phase 2
 
- Proposals // It is VERY important that these settings match between both RUT1 & RUT2
 
- Proposals // It is VERY important that these settings match between both RUT1 & RUT2
−
   - Encryption: `AES 128`
+
   - Encryption: '''''AES 128'''''
−
   - Hash: `SHA1`
+
 
−
   - PFS group: `MODP1536`
+
   - Hash: '''''SHA1'''''
−
- Force crypto proposal: `Off`
+
 
−
- IKE lifetime: `3h`
+
   - PFS group: '''''MODP1536'''''
−
[Screenshot Here]
+
 
 +
  - Force crypto proposal: '''''Off'''''
    +
  - IKE lifetime: '''''3h'''''
 +
<br>
   −
* Hit 'Save & Apply'
+
[[File:RUT2 IPSec Proposal Settings Phase2.png|frame|none]]
−
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
+
 
−
[Screenshot Here]
+
<br>
 +
 
 +
* Hit '''''Save & Apply'''''
 +
* Toggle the CA_EX tunnel on and hit '''''Save & Apply''''' once more
 +
<br>
 +
 
 +
[[File:RUT2 IPSec Toggle On Save And Apply.png|frame|none]]
 +
 
 +
<br>
    
* Reboot the device once you have finished.
 
* Reboot the device once you have finished.
Line 330: Line 519:     
==Testing configuration==
 
==Testing configuration==
 +
----
 +
 +
===RUT1 to RUT2 Test===
 
----
 
----
   Line 335: Line 527:  
That each RUT device can ping the other's LAN IP. In this case 192.168.3.1 for RUT1 & 192.168.14.1 for RUT2.
 
That each RUT device can ping the other's LAN IP. In this case 192.168.3.1 for RUT1 & 192.168.14.1 for RUT2.
 
And that LAN device on RUT1 can ping LAN device on RUT2.
 
And that LAN device on RUT1 can ping LAN device on RUT2.
−
  −
===RUT1 to RUT2 Test===
  −
----
   
   
 
   
 
* First make sure each device has been rebooted at least once after you have finished configuring the previous steps.
 
* First make sure each device has been rebooted at least once after you have finished configuring the previous steps.
−
* SSH into RUT1 device.
+
* SSH into RUT1 device
−
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
+
* '''''ipsec statusall''''' // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:RUT1 IPSec Status.png|frame|none]]
 +
 
 +
<br>
 +
* '''''ping 192.168.14.1''''' // You should get a response if the tunnel has established properly
 +
<br>
 +
 
 +
[[File:RUT1 Ping To RUT2 Check.png|frame|none]]
 +
 
 +
<br>
   −
* `ping 192.168.14.1` // You should get a response if the tunnel has established properly.
+
* SSH into RUT2 device
−
[Screenshot Here]
+
* '''''ipsec statusall''''' // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
 +
<br>
   −
* SSH into RUT2 device.
+
[[File:RUT2 IPSec Status.png|frame|none]]
−
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
  −
[Screenshot Here]
     −
* `ping 192.168.3.1` // You should get a response if the tunnel has established properly.
+
<br>
−
[Screenshot Here]
+
 
 +
* '''''ping 192.168.3.1''''' // You should get a response if the tunnel has established properly
 +
<br>
 +
 
 +
[[File:RUT2 Ping To RUT1 Check.png|frame|none]]
 +
 
 +
<br>
    
* SSH into RUT1 device
 
* SSH into RUT1 device
−
* `opkg update`
+
* '''''opkg update'''''
−
* `opkg install tcpdump`
+
* '''''opkg install tcpdump'''''
−
* `tcpdump -i any -w Checking_For_ESP_Packets.pcap`
+
* '''''tcpdump -i any -w Checking_For_ESP_Packets.pcap'''''
 
* SSH into RUT2 device
 
* SSH into RUT2 device
 
* On RUT2 ping the LAN ip for RUT1 and leave that running. In our example that would be `ping 192.168.3.1`
 
* On RUT2 ping the LAN ip for RUT1 and leave that running. In our example that would be `ping 192.168.3.1`
 
* On RUT1 wait 10 seconds then CTRL+C to stop the program
 
* On RUT1 wait 10 seconds then CTRL+C to stop the program
−
* Then use a program like WinSCP to download `Checking_For_ESP_Packets.pcap` from RUT1
+
* Then use a program like WinSCP to download '''Checking_For_ESP_Packets.pcap''' from RUT1
−
* Open the file in a program called Wireshark and filter for encrypted ESP packets with this `_ws.col.protocol == "ESP"`. You should see ESP packets from both the WAN IPs. You shouldn't be able to see inside the packet because it is now encrypted, but if we decrypted the packets we would see the ICMP packets between the 2 RUT devices.
+
* Open the file in a program called Wireshark and filter for encrypted ESP packets with this '''_ws.col.protocol == "ESP"'''. You should see ESP packets from both the WAN IPs. You shouldn't be able to see inside the packet because it is now encrypted, but if we decrypted the packets we would see the ICMP packets between the 2 RUT devices.
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:Checking Pcap With Wireshark.png|frame|none]]
 +
 
 +
<br>
    
===RUT1 LAN device to RUT2 LAN device Test===
 
===RUT1 LAN device to RUT2 LAN device Test===
 
----
 
----
 +
 +
Here we will confirm that LAN devices behind either RUTxxx devices are able to communicate with each other.
    
* Attach a Windows/MacOS/Linux PC via ethernet or wifi to RUT1 LAN. Remove or disable any other active interfaces on your PC.
 
* Attach a Windows/MacOS/Linux PC via ethernet or wifi to RUT1 LAN. Remove or disable any other active interfaces on your PC.
 
* Disable the firewall. Examples for each OS as follows.
 
* Disable the firewall. Examples for each OS as follows.
 
   * Windows 10/11
 
   * Windows 10/11
−
     1. Press `Windows-Key + R`
+
     1. Press '''''Windows-Key + R'''''
−
     2. Type `control` and hit enter
+
     2. Type '''''control''''' and hit enter
 
     3. Navigate to Firewall Settings -> System and Security -> Windows Defender Firewall
 
     3. Navigate to Firewall Settings -> System and Security -> Windows Defender Firewall
 
     4. On the left sidebar, click "Turn Windows Defender Firewall on or off"
 
     4. On the left sidebar, click "Turn Windows Defender Firewall on or off"
Line 385: Line 595:  
   * Linux (Ubuntu)
 
   * Linux (Ubuntu)
 
     1. Open a Terminal window
 
     1. Open a Terminal window
−
     2. `sudo ufw disable`
+
     2. '''''sudo ufw disable'''''
 
* Perform similar steps above for a 2nd device connected to RUT2 LAN
 
* Perform similar steps above for a 2nd device connected to RUT2 LAN
 
* Once both devices are connected to the LAN of RUT1 & RUT2 you should be able to ping the devices from each other.
 
* Once both devices are connected to the LAN of RUT1 & RUT2 you should be able to ping the devices from each other.
−
[Screenshot Here]
+
<br>
 +
 
 +
[[File:LAN To LAN Device Ping.png|frame|none]]
    +
<br>
 
* Afterwards make sure to re-enable the firewall for both LAN devices
 
* Afterwards make sure to re-enable the firewall for both LAN devices
Retrieved from "https://wiki.teltonika-networks.com/view/Special:MobileDiff/128038...128199"

Navigation menu