VPN-Cubed IPsec to GoGrid Free Edition v20091103

Requirements You have a GoGrid account. You have agreed to the terms of service provided for the VPN-Cubed Manager GSIs. Ability to configure a client (whether desktop based or cloud based) to use OpenVPN client software. We will provide pointers and support for the major distributions. You have a compliant IPsec firewall/router networking device which you can configure. CohesiveFT has successfully connected most popular IPsec firewalls to the VPN-Cubed IPsec gateway for GoGrid. 2 Copyright 2009 - CohesiveFT

Getting Help with VPN-Cubed This guide uses Cisco’s Adaptive Security Device Manager UI. Setting up your IPsec Extranet device may have a different user experience than what is shown here. All the information entered in this guide will be same regardless of your UI or cmd line setup. You can either send private requests for help to: support (at) cohesiveft.com or use our community forums at: http://getsatisfaction.com/cohesiveft 3 Copyright 2009 - CohesiveFT

VPN-Cubed IPsec to GoGrid allows you to build a virtual overlay network controlled by a VPN-Cubed Manager in GoGrid, connected to your datacenter via IPsec. A VPN-Cubed IPsec to GoGrid Free Edition topology is built from a VPN-Cubed Manager/ IPsec Gateway appliance in GoGrid that provides a secure and controllable overlay network for your cloud-based servers. Your data center extranet solution (Cisco ASA, Cisco Pix, Juniper Netscreen) will connect to the VPN-Cubed Manager in the cloud, containing the IPsec Gateway module. If a more complex overlay network is needed, multiple topologies can be connected to provide a redundant, geographically distributed network. If you are interested in learning more about more complex VPN-Cubed conﬁgurations contact us at support (at) cohesiveft.com or sales (at) cohesiveft.com. 5 Copyright 2009 - CohesiveFT

Firewall Considerations VPN-Cubed Manager uses the following TCP and UDP ports and they are open on the Manager’s software firewall. If you are interested in locking down these ports to a specific endpoint once you have finished configuration, contact us at support (at) cohesiveft.com. - UDP 1194 For client VPN connections; must be accessible from all servers that will join VPN-Cubed topology as clients. - UDP 1195-1197 For tunnels between manager peers; must be accessible from all peers in a given topology. - TCP 8000 HTTPS admin interface; must be accessible from hosts where you will want to obtain runtime status or configure peering, also needs to be open to and from the managers at least for the peering process, and needs to be accessible when downloading credentials for installation on overlay network clients. - UDP 500 and 4500 These ports are used for IPsec NAT-TRAVERSAL and need to be configured in your IPsec device. If you would like the GoGrid IPsec Gateway to be able to initiate a connection (for example in the event of a broken connection) then you need to allow the public IP address of the gateway to connect to your IPsec device over these ports. - TCP 22 Support and Debugging purposes. 6 Copyright 2009 - CohesiveFT

Launching VPN-Cubed Manager Via GoGrid Launch the “CohesiveFT VPN-Cubed x.x.x - IPsec Free Edition vx.x” GSI listed under Server Images by clicking “+” add server button and select “Web/App” server Find all CohesiveFT VPN-Cubed GoGrid Server Images by filling in the filter field with "VPN-Cubed" string. Click the image of your choice and press Next. 7 Copyright 2009 - CohesiveFT

Launching VPN-Cubed Manager Via GoGrid The resulting popup will ask your a name, description, and public IP. Be sure to use a public IP address from the range GoGrid assigns to you. A list of public IPs is available on your GoGrid account page in the left column. Wait until your server is ready. This could take up to 15 minutes in some cases. 8 Copyright 2009 - CohesiveFT

Logging in and Conﬁguring the Manager Login to the VPN-Cubed Admin - https://MGR_public_ip:8000/ In order to have an encrypted connection to the VPN-Cubed Manager the manager uses HTTPS with a self-signed certiﬁcate generated on each manager individually on boot. You may need to add a security exception in your browser. Log in with a username and password of “vpncubed”. The VPN-Cubed IPsec to GoGrid Free Edition comes pre-loaded with a license. This license restricts the Free Edition Manager to only allow 5 cloud machines to join the overlay network and restricts the cloud subnet to 172.31.1.X. If you are interested in additional client packs (adding more cloud devices to the overlay network) or a different subnet, please contact us at sales (at) cohesiveft.com. 9 Copyright 2009 - CohesiveFT

Generate Keys on VPN-Cubed Manager Again, the IPsec to GoGrid Free Edition Manager comes pre- conﬁgured to the purchased specs (how many managers it can peer with, how many clientpacks are available, how many ipsec links are available, and the default subnet in GoGrid of 172.31.1.X). Click “Generate New” under SSl Certs and Keys in the left column. Enter a security token in the second ﬁeld. This can be anything and is used for client pack generation and manager peering. Click “Generate keys” link. Key generator will be started in the background, and you can refresh screen to observe progress. This process will generate the client credentials that will be loaded onto the devices you wish to connect to the VPN-Cubed overlay network. 10 Copyright 2009 - CohesiveFT

Peering the Manager - Important Step! Manager Peering is a user experience artifact that will be removed in future versions of the VPN-Cubed IPsec to GoGrid Free Edition. In more complex VPN-Cubed deployments users can peer two VPN- Cubed Managers together to create a redundant, highly available and secure cloud connectivity solution. For more information on custom enterprise conﬁgurations contact us at sales@cohesiveft.com. Select “this instance” and click “Save changes” You should then get a status page showing that the managers routing is conﬁgured and started. 11 Copyright 2009 - CohesiveFT

VPN-Cubed Manager Status The VPN-Cubed Manager is ready to setup an IPsec Tunnel. The VPN-Cubed Manager will show no other links to other managers, no connected clients, no subnets available, and no detected tunnel data. Click “IPsec” under Peering left menu heading. On the resulting IPsec page note the Configuration Settings needed for configuration. Click “Define new remote endpoint.” 12 Copyright 2009 - CohesiveFT

VPN-Cubed Manager Setup: Define a New Remote Enpoint Enter descriptive name for the Endpoint configuration, this can be anything. Occasionally there is another router between the IPsec firewall and the Internet. Enter the public facing IP address of either the IPsec device or router between GoGrid and the IPsec device (see picture below). Enter a Pre-shared Key and keep a record of that key to be entered into the IPsec device. In this example we use “VPNCubedRocks” for obvious reasons. If your IPsec device is behind a router, enter the external IP interface of the IPsec device (see picture below). Click “create.” One the resulting page click “New subnet.” 13 Copyright 2009 - CohesiveFT

VPN-Cubed Manager Setup: Setup a Subnet Enter the subnet to be used for the GoGrid instances. In this example we used 192.168.3.0/24. Click “create.” Your VPN-Cubed Manager IPsec setup is complete. The next steps will detail setting the IPsec connection from your extranet device. Once the IPsec connection is live, this guide will detail how to add clients to the created overlay network. Note the “Conﬁguration Settings” values, you will need these to correctly conﬁgure your extranet device. 14 Copyright 2009 - CohesiveFT

Configuring the IPsec Extranet Device: Adding Network Objects Note: As mentioned earlier these screenshots are from a Cisco ASA extranet device. Your setup user experience may differ slightly. The first step in configuring any IPsec extranet device is to add the appropriate Network Objects. The screenshot to the right shows all the objects that need to be added. Their details are below: - gg_inside: 172.31.1.0, inside NAT of your AWS subnet gg - gg_test_client: 172.31.1.5, a initial AWS test IP for IPsec gg connectivity - inside-network: 192.168.3.0, inside interface network of extranet device - inside_network_test_client: 192.168.3.2: initial inside test IP for IPsec connectivity - outside_network: 192.168.1.0, outside interface network of extranet device - outsideinterface: 192.168.1.148, address of outside interface of extranet device - vpncubed_mgr: 75.101.190.42, public IP address of the VPN- Cubed Manager - vpncubed_mgr_inside: 171.31.1.1, inside tunnel test for use before connecting clients (VPN-Cubed IPsec to GoGrid Test Gateway) 15 Copyright 2009 - CohesiveFT

Conﬁguring the IPsec Extranet Device: VPN Wizard Create a new VPN Tunnel. The Cisco ASA used in this guide does this through a VPN Wizard. If you are using another facility to create your IPsec Tunnel, make sure to enter the same information we enter in the following slides. Choose a Site-to-Site Tunnel Type. Click “Next” 16 Copyright 2009 - CohesiveFT

Conﬁguring the IPsec Extranet Device: VPN Wizard Enter the VPN-Cubed Managerʼs IP address in the “Peer IP Address” ﬁeld. Enter the same “Pre-Shared Key” entered from slide 12 (our example used “VPNCubedRocks”). Click “Next” 17 Copyright 2009 - CohesiveFT

Conﬁguring the IPsec Extranet Device: VPN Wizard Choose your Key Exchange Policy (IKE). Make sure it is the same as the one used in the VPN-Cubed Manager setup. On slide 12 we used “AES-256.” Click “Next” 18 Copyright 2009 - CohesiveFT

Conﬁguring the IPsec Extranet Device: VPN Wizard Setting up Hosts and Networks. The following information will setup a test tunnel to your VPN-Cubed Manager. After the tunnel is up and running you can return to this step and change the Source and Destination information to open up more trafﬁc between your IPsec extranet device and the cloud. To open up your network to the overlay network at GoGrid, select the “inside-network” in the Source section and select “ gg_inside” in the Destination section. The screenshot shows how to setup a test connection using “inside_network_test_client” as the Source and “vpncubed_mgr_inside” as the Destination. Click “Next” 19 Copyright 2009 - CohesiveFT

IPsec Extranet Device: Session Details Make sure the IPsec VPN session is up and running. Goto Monitoring > VPN Statistics > Sessions You should be able to see the session under LAN-to-LAN Click “Details” 21 Copyright 2009 - CohesiveFT

VPN-Cubed Manager: Check the IPsec Status To check the status of your IPsec connection from the VPN-Cubed Manager click on “Runtime Status.” Your should see a “detected” IPsec tunnel under IPsec status. If you do not see your IPsec Tunnel listed, it is not correctly conﬁgured. Double check that you have entered all the information correctly in both the VPN-Cubed Manager and your IPsec device. If you are having difﬁculties please email support (at) cohesiveft.com Now that the IPsec Tunnel is up and running clients in GoGrid can be added to the overlay networkʼs secure VLAN extension of your Datacenter. 23 Copyright 2009 - CohesiveFT

Client Conﬁguration: Install Client Credentials In the context of VPN-Cubed, “client” means devices which will be conﬁgured as members of the overlay network. These network members will usually be servers running at GoGrid. In more advanced editions of VPN-Cubed this includes desktop based client machines. Note the “Client Download” username and password on Status screen on every manager (username is “clientpack”). In VPN-Cubed Admin on any manager, go to Client Packs and pick a client pack. A client pack can run on a single client at a time. If you shut down or disconnect client from the topology, you can reuse its client pack. You have access to 5 client packs. 24 Copyright 2009 - CohesiveFT

Client Configuration: Install Client Credentials TWO PHILOSOPHIES FOR INSTALLATION a) Download credentials to your trusted amin machine via the VPN-Cubed Manager “Client Packs” link. SCP them into the client machines, and then SSH into the client machines to complete the configuration. b) SSH into the client machine and download the credentials from its command line using the following URL: wget -no-check-certificate https://clientpack:**PASSWORD**@{Manager_IP}:8000/credentials/{name_of_clientpack}.tar.gz NOTE: The clientpack:password combination is on the status screen of each of the vpn-cubed managers. 25 Copyright 2009 - CohesiveFT

Installing OpenVPN on Linux devices You can either install OpenVPN on physical servers or virtual servers you already possess to connect those devices to the VPN-Cubed overlay network. Extract clientpack contents to /etc/openvpn directory (consult OpenVPN documentation for your OS if not found). Edit the vpncubed.conf add the managers you want this client to connect to in priority at the bottom of the file: remote MANAGER_IP_ADDRESS 1194 You do not need to configure each client to try all managers in a given topology. The order of remote commands matters - client will try to connect to the first remote endpoint, if not successful - to the second, and so on. You may want to evenly distributed clients among managers by varying the order of "remote" commands on each client. 26 Copyright 2009 - CohesiveFT

Launching OpenVPN on Linux devices Start openvpn. On Linux OSs this is done using the /etc/init.d/openvpn start command. Your client will get a virtual IP address that corresponds to the clientpack it received. WARNING: If you accidentally give the same client credentials to 2 different devices you will notice the two clients popping off and on the overlay network inside the VPN-Cubed manager Status screen. Only one device can have a set of credentials in the same topology at a time. Adjust local firewall on the client if necessary (on Linux, your tunnel device name will be tun0). Verify connectivity by pinging the Manager at itʼs overlay network address of 172.31.0.1. Usually the manager whose "remote" line appears first in /etc/openvpn/vpncubed.conf will be pingable first, other managers will become pingable once they learn about new client. After adding 1 or more clients to the overlay network you should see a very similar manager status screen to the one displayed on the following page. The key elements of the display to look for are the connections to that managerʼs peer, all showing the local processes are running and the link as up. You should see the clients listed in the client table at the bottom, connected to the appropriate manager. If this is not the case please check the items listed on the “Troubleshooting” page of this document. 27 Copyright 2009 - CohesiveFT

Install OpenVPN on Windows: XP Desktop, Vista Desktop, Win2k Instances You can either install OpenVPN on physical servers or virtual servers you already possess to connect those devices to the VPN-Cubed overlay network. For XP download and install: http://openvpn.net/release/openvpn-2.0.9- install.exe For Vista OR Win2k GSIs download and install: http://openvpn.net/release/ openvpn-2.1_rc15-install.exe On Vista you will need to have admin privileges to install the software. You will have to install a client pack on the Windows desktop machine and put the client pack files in Program FilesOpenVpnconfig RENAME vpncubed.conf to vpncubed.ovpn !!!! Edit the vpncubed.ovpn add the managers you want this client to connect to in priority at the bottom of the file: remote MANAGER_IP_ADDRESS 1194 In the case of a desktop machine outside of the GoGrid cloud you will need to use the GoGrid Public IP for the managers you connect to. You do not need to configure each client to try all managers in a given topology. The order of remote commands matters - client will try to connect to the first remote endpoint, then to the second, and so on. You may want to distribute clients among managers by varying the order of "remote" commands on each client. 28 Copyright 2009 - CohesiveFT

Launch OpenVPN on Windows devices Start openvpn. On Windows XP and Vista this can be done through the Services tool or via the command line “openvpn vpncubed.ovpn”. On Vista if you run it from the command line you will need to know how to start a command line with administrative privileges. Details here: http:// www.howtogeek.com/howto/windows-vista/run-a-command-as-administrator- from-the-windows-vista-run-box/ Alternatively, start the OpenVPN service from the Services tool. On Vista and Win2k GSIs OpenVPN also has a graphical tool - OpenVPN GUI. Your client will get a virtual IP address that corresponds to the clientpack it received. WARNING: If you accidentally give the same client credentials to 2 different devices you will notice the two clients popping off and on the overlay network inside the VPN-Cubed manager Status screen. Only one device can have a set of credentials in the same topology at a time. Adjust local firewall on the client if necessary. Verify connectivity by pinging the Manager at itʼs overlay network address of 172.31.0.1. Usually, the manager whose "remote" line appears first in /etc/ openvpn/vpncubed.conf will be pingable first, other managers will become pingable once they learn about new client. After adding 1 or more clients to the overlay network you should see a very similar manager status screen to the one displayed on the following page. 29 Copyright 2009 - CohesiveFT

Client Conﬁguration: 3 clients in the overlay network The key elements of the display to look for are the connections to that managerʼs peer, both showing the local processes are running and the link as up. You should see the clients listed in the client table at the bottom, connected to the appropriate manager. If this is not the case please check the items listed on the “Troubleshooting” page of this document. 31 Copyright 2009 - CohesiveFT

VPN-Cubed IPsec to GoGrid Free Edition v20091103

by Franklin72

Accessibility

Categories

Upload Details

Usage Rights

Statistics

VPN-Cubed IPsec to GoGrid Free Edition v20091103 Presentation Transcript