Description:

This document describes how to set up an IKEv2 connection between the LANCOM Advanced VPN Client and a LANCOM R&S®Unified Firewall (referred to here as the United Firewall).

The certificate module was updated in LCOS FX 10.7, therefore the corresponding menus differ compared to older LCOS FX versions. The configuration of a certificate-based IKEv2 connection between the Advanced VPN Client and a Unified Firewall as of LCOS FX 10.7 is described in the following article:

Setting up a certificate-based IKEv2 VPN connection between the LANCOM Advanced VPN Client and a LANCOM R&S®Unified Firewall (as of LCOS FX 10.7)


 

Requirements:


Scenario:

1) The Unified Firewall is connected directly to the Internet and has a public IPv4 address:


 2) The Unified Firewall is connected to the Internet via an upstream router:


Procedure:

The setup for scenarios 1 and 2 are basically the same. Scenario 2 additionally requires port and protocol forwarding to be set up on the upstream router (see section 6).


1) Creating the CA and VPN certificates on the Unified Firewall:

1.1) Connect to the configuration interface of the Unified Firewall, go to the menu Certificate Management → Certificates and click on the "+" icon to create a new routing entry.

1.2) The first step is to create a Certification Authority (CA) for VPN connections.

1.3) Then click the Create button.

1.4) Click on the "+" icon to create a VPN certificate for the LANCOM Advanced VPN Client:

1.5) Then click the Create button.

1.6) Click on the "+" icon to create a certificate for the Unified Firewall:

1.7) Then click the Create button.

1.8) The newly created VPN certificates are listed below the newly created VPN certification authority (see following figure).



2) Creating the VPN connection on the Unified Firewall:

2.1) Navigate to the menu VPN → IPsec settings.

2.2) Activate IPsec.

2.3) Switch to VPN → IPsec Connections and click on the "+" icon to create a new IPsec connection.

2.4) Save the following parameters:

If you have created your own template or security profile, you can use these here.

2.5) Open the Tunnels tab.

2.6) Change to the Authentication tab and enter the following parameters:

2.7) Click on Create to save the configuration.

2.8) Click the icon to create a new VPN host.

2.9) Save the following parameters:

2.10) In the VPN host click on the "connection" icon and, to open the firewall objects, click on the network object that the object (the site-to-site connection) should access.

2.11) Use the "+" sign to assign the required protocols to the VPN host.

A Unified Firewall uses a deny-all strategy. You therefore have to explicitly allow communication.

2.12) Finally, implement the configuration changes by clicking Activate in the firewall.

2.13) Change to the menu VPN → IPsec → Connections and, on the newly created Advanced VPN Client connection, click on the Export connection button.

2.14) Enter a password to be used to encrypt the exported ZIP archive.

2.15) In the Gateway field, enter the public IP or DNS address of the Unified Firewall (in this case 81.81.81.81).

2.16) As Key password you enter the one entered in step 1.4 as the Private Key Password for the VPN certificate for the LANCOM Advanced VPN Client.

2.17) Set any transport password.

2.18) Click Export and save the ZIP file on your computer.



3) Export the VPN certificate for the LANCOM Advanced VPN Client:

3.1) Change to the menu Certificate Management → Certificates and, for the VPN certificate for the LANCOM Advanced VPN Client, click the Export button.

3.2) Set that PKCS 12 format.

3.3) Enter the password for the Private Key Password entered in step 1.4.

3.4) Set any transport password. You will need this in step 4.1 to unzip the ZIP file.

3.5) Click Export and save the certificate file on your PC.

3.6) This concludes the configuration steps on the Unified Firewall.



4) Import the VPN client certificate into the LANCOM Advanced VPN Client:

4.1) Unzip the ZIP file on your PC and copy the *.p12 file to a directory of your choice.

4.2) In the LANCOM Advanced VPN Client, open the option Configuration → Certificates.

4.3) Create a new certificate configuration using the Add button.

4.4) Enter a name for the new certificate configuration.



5) Import the *.ini file and the configuration of the VPN connection into the LANCOM Advanced VPN Client:

5.1) Unzip the ZIP file exported in step 2.13.

5.2) In the LANCOM Advanced VPN Client open the option Configuration → Profiles and click Add/import.

5.3) Select the option Profile import.

5.4) Set the PATH to the VPN profile file.

5.5) Click on Finish to conclude the import.

5.6) Select the imported profile and then click Next.

5.7) Switch to the menu IPsec general settings and set IKEv2 authentication to the value Certificate.

5.8) You need to set the Certificate configuration to the certificate configuration created in step 4.3.

5.9) This concludes the configuration. Close the dialogs of the LANCOM Advanced VPN Client with OK.

5.10) When establishing the connection, the PIN to enter is the Private Key Password of the Client certificate.



6) Setting up port and protocol forwarding on a LANCOM router (scenario 2 only):

IPSec requires the use of the UDP ports 500 and 4500 as well as the protocol ESP. These must be forwarded to the Unified Firewall.

Forwarding the UDP ports 500 and 4500 automatically causes the ESP protocol to be forwarded.

If you are using a router from another manufacturer, ask them about appropriate procedure.

If the UDP ports 500 and 4500 and the ESP protocol are forwarded to the Unified Firewall, an IPSec connection to the LANCOM router can only be used if it is encapsulated in HTTPS (IPSec-over-HTTPS). Otherwise, no IPSec connection will be established.

6.1) Open the configuration for the router in LANconfig and switch to the menu item IP-Router → Masq. → Port forwarding table.

6.2) Save the following parameters:

6.3) Create a further entry and specify the UDP port 4500.

6.4) Write the configuration back to the router.