Description:

This article describes how to set up a certificate-based IKEv2 VPN connection between two LANCOM R&S®Unified Firewalls.

The certificate module was updated in LCOS FX 10.7, therefore the corresponding menus differ compared to older LCOS FX versions. The configuration of a certificate-based IKEv2 connection between two Unified Firewalls as of LCOS FX 10.7 is described in the following article:

Setting up a certificate-based IKEv2 VPN connection between two LANCOM R&S®Unified Firewalls (as of LCOS FX 10.7)



Rquirements:


Scenario:

1) The Unified Firewall is connected directly to the Internet and has a public IPv4 address:


2) The Unified Firewall is connected to the Internet via an upstream router:



Procedure:

The setup for scenarios 1 and 2 are basically the same. Scenario 2 additionally requires port and protocol forwarding to be set up on the upstream router (see section 3).


1) Configuration steps on the Unified Firewall at the headquarters:

1.1) Creating and exporting the certificates:

1.1.1) Use a browser to connect to the Unified Firewall, switch to the menu Certificate Management → Certificates and click on the “+” icon to create a new certificate. 

1.1.2) First, create a CA (Certificate Authority). Modify the following parameters for it and then click Create:

1.1.3) Next, create a VPN certificate for the headquarters. Modify the following parameters for it and then click Create:

1.1.4) Next, create a VPN certificate for the branch office. Modify the following parameters for it and then click Create:

1.1.5) Under Certificate management, go to the certificate of the branch office and click the export button.

1.1.6) As the format, select the option PKCS #12 , enter the passwords and click on Export:

1.1.7) Under Certificate management, go to the certificate of the headquarters and click the export button.

1.1.8) As the format, select the option PEM and click on Export.


1.2) Setting up the VPN connection:

1.2.1) Go to the menu VPN → IPsec → IPsec settings.

1.2.2) Use the slider to enable the IPsec functionality and click on Save.

1.2.3) Switch to the menu VPN → IPsec → Connections and click on the “+” icon to create a new VPN connection.

1.2.4) Modify the following parameters:

1.2.5) Go to the Tunnels tab and modify the following parameters:

1.2.6) Go to the Authentication tab, adjust the following parameters and click Create:

1.2.7) Click the button to create a VPN network.

1.2.8) Modify the following parameters and click Create:


1.3) Enable communication via the VPN connection in the firewall:

1.3.1) On the desktop, click the VPN network created in step 1.2.8, select the connection tool, and click the network object for which communications should be enabled.

1.3.2) Select the required protocols on the right-hand side and add them using the “+” icon.

 

1.3.3) Click Create to create the firewall rule.

1.3.4) This concludes the configuration of the Unified Firewall at the headquarters. Finally, implement the changes on the Desktop by clicking Activate.



2) Configuration steps on the Unified Firewall at the branch office:

2.1) Importing the certificates:

2.1.1) Use a browser to connect to the branch-office Unified Firewall, switch to the menu Certificate Management → Certificates and click on the icon for importing a certificate.

2.1.2) Under Certificate file, select the branch-office certificate, enter the passwords and click on Import:

2.1.3) Import a further certificate. Under Certificate file, select the certificate for the headquarters and click on Import:

There is no need to enter passwords here, because exporting the headquarters certificate does not require passwords to be set.

2.1.4) After importing the certificates, the Certificate management should look like this.


2.2) Setting up the VPN connection:

2.2.1) Go to the menu VPN → IPsec → IPsec settings.

2.2.2) Use the slider to enable the IPsec functionality and click on Save.

2.2.3) Switch to the menu VPN → IPsec → Connections and click on the “+” icon to create a new VPN connection.

2.2.4) Modify the following parameters:

2.2.5) Go to the Tunnels tab and modify the following parameters:

2.2.6) Go to the Authentication tab, adjust the following parameters and click Create:

2.2.7) Click the button Click to create a VPN network.

2.2.8) Modify the following parameters and click Create:


2.3) Enable communication via the VPN connection in the firewall:

2.3.1) On the desktop, click the VPN network created in step 2.2.8, select the connection tool, and click the network object for which communications should be enabled.

2.3.2) Select the required protocols on the right-hand side and add them using the “+” icon.

 

2.3.3) Click Create to create the firewall rule.

2.3.4) This concludes the configuration of the Unified Firewall at the headquarters. Finally, implement the changes on the Desktop by clicking Activate.



3) Setting up port and protocol forwarding on a LANCOM router (scenario 2 only):

IPsec requires the use of the UDP ports 500 and 4500 as well as the protocol ESP. These must be forwarded to the Unified Firewall.

Forwarding the UDP ports 500 and 4500 automatically causes the ESP protocol to be forwarded.

If you are using a router from another manufacturer, approach them for information about the appropriate procedure.

If the UDP ports 500 and 4500 and the ESP protocol are forwarded to the Unified Firewall, an IPsec connection to the LANCOM router can only be used if it is encapsulated in HTTPS (IPsec-over-HTTPS). Otherwise, no IPsec connection will be established.

3.1) Open the configuration for the router in LANconfig and switch to the menu item IP router → Masq. → Port forwarding table.

3.2) Enter the following parameters:

3.3) Create a further entry and specify the UDP port 4500.

3.4) Write the configuration back to the router.