netasq防火墙配置手册

IPSec VPN Remote access (Client to site) using Pre-shared keys DiagramRequirementConfigurationHead office Netasq IPS Firewall Configuration for IPSec VPN User creationConfiguring access policy for user/user groupConfiguring PSK for usersCreating mobile peerAdding VPN Tunnel (Mobile) configurationIPSec VPN Client ConfigurationVerifying the communicationDIAGRAMRequirementZoom Technologies wants to provide access to resources like printers, shared folder or the computer itself of the head office to its executives who go around places. For this requirement Zoom Technologies has to implement IPSec Client to Site VPN.To fulfill this requirement the client who will try to access the resources at head office need to establish a IPSec Tunnel to Head office Netasq IPS Firewall using a IPSec client software installed on PC/Laptop/Netbook.The configuration is done on two placesasq IPS Firewall2.IPSec Client software installation on client PC/Laptop/Net-bookConfigurationConfiguration of Netasq IPS Firewall at Head office1.Access the firewall and navigate to Users and click on it to expand users menu2.Click on Users below users menu123.Click on to add a new user4.Enter ID, username and email address5.Click on Apply456.Click on Access privileges option under users menu67. Click on ACCESS POLICY8. Click on Add89.Double click to change it to10.Select the user from the user – user group list11.Change the IPSec column from to12.Click Apply9 101113.Click on Save when prompted for121.Expand VPN2.Click IPSec VPN3.Click on Identification Tab215.Enter the Email id of the user (should be same email-id as of the user that we created earlier)6.Enable the Enter the key in ASCII characters checkbox7.Enter Password and confirm the same8.Click OK4910.Click Save when prompted1011.Click Yes, activate the policy to active the changes in the policy1112. Click Peers tab13. Click Add14. Click New anonymous (mobile) peer141315.Enter a name for the mobile peer16.Click Next151617.Select Pre-shared key(PSK) as the PEER AUTHENTICATION method18.Click Next171819.Click Next20.Click Finish21.Click on Encryption Policy – Tunnels22.Click on Anonymous - Mobile Users tab2223.Click Add24.Click New Policy25.Select the Mobile peer from the mobile peer used drop down list26.Click under LOCAL RESOURCES list27.Select the network/host that should be accessible from the VPN (example: Network_in)28.Click Finish to close the VPN policy creation wizard23242526272929.Click Apply to save the configuration3030.Click Save when prompted3131.Click Yes, activate the policy32.Create the following filter policy32Client configuration1.Access the Shrew Soft VPN Client Access Manager2.Click Add button13.In the general tab4.Select disabled in the auto configuration menu45.Select Use an existing adapter and current address6.Enter the IP address (WAN/Out/Public) of the Netasq IPS firewall which connects toward internet657. Click on Client Tab8. Select IKE Fragmentation as disable9.10. Click on Name Resolution11. Disable Enable WINS checkbox12.9813. Click on Authentication tab14. Select the authentication method as mutual PSK15. Select the Identification Type as User Fully Qualified Domain Name in the Local Identity16. Enter the user’s Email -id in the UFQDN String17. Click Remote Identity18. Leave the Identification Type as Any in Remote Identity tab (if it is not any, change it to any)181719. Click on Credentials tab20. Enter the PSK in the Pre-shared Key text box21. Click on Phase 1 tab22. Select the following parametersExchange Type: aggressive DH Exchange: group 2 Cipher Algorithm : aes Cipher Key Length: 128 Hash Algorithm: sha1 Key life time limit: 21600 Key life data limit: 0Enable Check Point Compatible vendor ID: disabled192023. Click on24. Select the following settingsTransform Algorithmesp -aes Transform Key Length128 HMAC Algorithmsha1 PFS Exchangegroup 2 Compress Algorithmdisabled Key Life Time Limit3600 Key Life Data limit25. Click on policy Tab26. Uncheck Obtain Topology Automatically or Tunnel All27. Enable Maintain Persistent Security Associations checkbox28. Select Policy Generation Level as require29.2930.Select the type as include31.Enter the network address and subnet mask of the network accessible through VPN32.33.Click save to complete the configuration of the client3334.Enter the Name to VPN Connections and click on the empty white space35.Click Connect to open the connect dialog window353436.Click connect to open IPSec VPN3637.You should see the following message if the tunnel is enabled successfully38.Click network tab3739.You should be able to see the following screen39。