WIFITECHBLOG

WiNG How-To Guide Microsoft L2TP/IPSec VPN Client-Configuration

Admin Saturday, February 15, 2014 5:19 AM

1. One (or more) RF Switches are installed and operational on the network.
2. One (or more) Access Ports configured and adopted by the RF Switch.
3. One (or more) WLAN profiles are configured and assigned to adopted radios.
4. A Windows XP workstation is available with Microsoft Internet Explorer or Mozilla Firefox to perform Web UI configuration.
5. One or more Windows XP workstations are available to test and verify IPSec communications.
6. The reader has read the Motorola RFS Series Wireless LAN Switches - WiNG System Reference Guide.

IPSEC VPN Settings:

IPSec configuration on the RF Switch determines which IPSec protocols clients can use,  VPN client addressing, user authentication, session restrictions and which RF Switch virtual interface(s) tunnels can be terminated on. IPSec configuration requires the following configuration steps:

1)  Transform Sets [Section 3.3.1]:

2)  Network Addressing [Section 3.3.2]:

3)  Authentication [Section 3.3.3]:

4)  Crypto Maps [Section 3.3.4]:

Transform Sets:

Transform sets represents a combination of security protocols and algorithms which peers agree to use during IKE negotiations to protect data flows. The transform set must be configured to support the capabilities of the peers connecting to the RF Switch or the security association will fail. The Microsoft L2TP/IPSec VPN client is limited in capability and supports the following encryption and authentication

schemes:

•    Data Encryption Standard – Data Encryption Standard (3DES) provides confidentiality.
•        Secure Hash Algorithm – Secure Hash Algorithm 1(SHA1) with a 160-bit key for data integrity.
•   Transport Mode – Specifies that only the payload of the message is encrypted.
•    Encapsulating Security Payload – Encapsulating Security Payload (ESP) provides confidentiality,  authentication, integrity, and anti-replay for the data.

To support the Microsoft L2TP/IPSec VPN client a transform set will be created on the RF Switch to support ESP- 3DES encryption, SHA-HMAC authentication and Transport tunneling schemes.

Web UI Configuration Example:

The following configuration example will demonstrate how create a transform set using the Web UI:

Network Addressing:

When VPN clients establish a secure VPN connection to the RF Switch they are provided with an IP Address so that they can communicate hosts though the encrypted tunnel. The remote VPN host will have two IP addresses assigned:

1)  An IP addresses assigned to the physical wired, wireless or dial-up interface that provides communications to the local network and/or Internet.

2)  An IP address assigned to a virtual VPN adaptor from the RF Switch that provides secure encrypted remote access into the site. IP Addresses for remote VPN clients are assigned by the RF Switch from a virtual pool of addresses. The virtual pool of addresses local within the RF Switch and are not associated to a VLAN or virtual IP interfaces on the RF Switch.

One or more virtual pool ranges can be defined on the RF Switch as required based on the number remote VPN clients connecting to the RF Switch. Additionally pools may be defined as a single contiguous block of addresses or multiple non-contiguous blocks of addresses as required.

In this example a single contiguous block of addresses 192.168.10.41  192.168.41.254 will be defined on the RF Switch providing support for up to 254 VPN clients. Additionally a Windows Server 2003 using 192.168.10.5 will be designated as a DNS server providing domain name services and seamless Active Directory integration for VPN clients.

Web UI Configuration Example:

The following configuration example will demonstrate how to define a DNS Server and create a virtual pool of addresses using the Web UI: