Allied Telesis AR440S User manual

C613-16049-00 REV E www.alliedtelesis.com
AlliedWareTM OS
How To |
Introduction
In this How To Note’s example, a headquarters office has VPNs to two branch offices and a
number of roaming VPN clients. The example illustrates the following possible components
that you could use in a corporate network:
zVPNs between a headquarters office and roaming VPN clients, such as travellers’ laptops
zVPNs between a branch office and roaming VPN clients, such as travellers’ laptops
za VPN between a headquarters office and a branch office with a fixed IP address, when the
branch office has an ADSL PPPoA connection to the internet
za VPN between a headquarters office and a branch office with a dynamically assigned IP
address, when the branch office has an ADSL PPPoEoA connection to the internet
zusing software QoS to prioritise voice (VoIP) traffic over the VPNs
Select the solution components that are relevant for your network requirements and
internet connection type.
Contents
Which products and software versions does this information apply to? ................................... 2
Related How To Notes .......................................................................................................................... 2
About IPsec modes: tunnel and transport ......................................................................................... 3
Background: NAT-T and policies .......................................................................................................... 4
How to configure VPNs in typical corporate networks ................................................................. 6
Before you start ............................................................................................................................... 7
How to configure the headquarters VPN access concentrator ........................................... 8
How to configure the AR440S router at branch office
1 ..................................................... 16
How to configure the AR440S router at branch office 2 ..................................................... 24
Configure VPNs in a Corporate Network, with
Optional Prioritisation of VoIP

Page 2 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
How to make voice traffic high priority ........................................................................................... 30
How to prioritise outgoing VoIP traffic from the headquarters router ............................ 31
How to prioritise outgoing VoIP traffic from the branch office
1 router ......................... 33
How to prioritise outgoing VoIP traffic from the branch office 2 router ......................... 35
How to test your VPN solution ......................................................................................................... 36
Configuration scripts for headquarters and branch offices ......................................................... 37
Before you use these scripts ....................................................................................................... 37
Headquarters VPN access concentrator's configuration ..................................................... 38
Branch office
1 AR440S configuration—the PPPoA site with VPN client access
and a fixed IP address ............................................................................................................ 43
Branch office 2 AR440S configuration—the PPPoEoA site with a dynamically
assigned IP address ................................................................................................................. 48
Extra configuration scripts for lab testing the VPN solution ...................................................... 52
ISP's PPPoE access concentrator configuration ...................................................................... 52
Hotel's NAT gateway firewall configuration ............................................................................ 53
Which products and software versions does this
information apply to?
The information provided in this document applies to the following products:
zAR400 Series routers
zAR750S and AR770S routers
zRapier and Rapier i Series switches
zAT-8800 Series switches
running software version 2.6.6 and above. However, prioritising the voice traffic requires
Software Quality of Service, which is available with version 2.7.
1 and above.
On the roaming VPN clients, we tested this solution with Microsoft®Windows Virtual
Private Network.
This How To Note shows how to prioritise VoIP traffic at the offices, but does not show how
to set up the VoIP facility itself on your VPN client PCs. You need to find suitable PC
software to provide that.
Related How To Notes
Allied Telesis offers How To Notes with a wide range of VPN solutions, from quick and
simple solutions for connecting home and remote offices, to advanced multi-feature setups.
Notes also describe how to create a VPN between an Allied Telesis router and equipment
from a number of other vendors.
For a complete list of VPN How To Notes, see the Overview of VPN Solutions in How To Notes
in the How To Library at www.alliedtelesis.com/resources/literature/howto.aspx.

Page 3 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
About IPsec modes: tunnel and transport
This solution uses two types of VPN:
zIPsec tunnel mode, for the headquarters office to branch office VPNs. These are site-to-
site (router-to-router) VPNs.
zIPsec transport mode with L2TP, for the roaming Windows VPN clients.
The following figure shows the protocol stacks for the tunnel mode VPN and the transport
mode VPN for the connection type PPPoA.
In this How To Note, branch office
1 uses PPPoA. The other offices in this How To Note use
different connection types and therefore have different stacks below IP. Branch office 2 uses
PPP over virtual Ethernet over ATM, and headquarters simply uses IP over an actual Ethernet
WAN connection.
IP
IPsec
IP
PPP
ATM
ADSL
statically-defined
interface ppp0
tunnel mode:
policy “hq”
IPsec payload L2TP
IPsec
IP
PPP
ATM
ADSL
statically-defined
interface ppp0
transport mode:
policy “roaming”
using L2TP server
definition
PPP IPsec payload (dynamic
PPP using template)
IP
Tunnel mode - for site-to-site VPNs Transport mode - for roaming clients
encrypted
by IPsec
vpn-protocol-stack.eps

Page 4 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
Background: NAT-T and policies
NAT-T NAT Traversal (NAT-T) can be enabled on any of our IPsec VPN links. It automatically allows
IPsec VPNs to traverse any NAT gateways that may be in the VPN path. This is likely to occur
with the VPNs from the roaming VPN clients—they are likely to use a LAN at a remote site
that is behind a NAT gateway.
NAT-T may also be applicable for a site-to-site VPN, if one of the routers is behind a NAT
gateway, such as some ADSL devices. Note that AR44xS series routers provide an ADSL
interface, which removes the need for a separate ADSL device. Therefore, the examples in
this How To Note do not include NAT-T for the site-to-site VPNs.
The following figure shows how the addresses in the IPsec headers change as a packet from a
roaming client traverses NAT gateways in the VPN pathway. The figure illustrates IPsec
transport mode with L2TP.
NAT gateway
Dest Addr
IP
PPP
L2TP
IPsec
IP
ETH
Source Addr
192.168.143.1
N/A
N/A
N/A
192.168.200.1
192.168.140.27
N/A
N/A
N/A
200.200.200.1
N/A N/A
Encrypted
192.168.200.1
roaming VPN
client
192.168.200.254
211.211.211.1
hotel
Dest Addr
IP
PPP
L2TP
IPsec
IP
ETH
Source Addr
192.168.143.1
N/A
N/A
N/A
211.211.211.1
192.168.140.27
N/A
N/A
N/A
200.200.200.1
N/A N/A
Encrypted
Internet
headquarters
VPN access
concentrator
Dest Addr
IP
ETH
Source Addr
192.168.143.1
N/A
192.168.140.27
N/A
200.200.200.1
192.168.140.254
192.168.140.27
hotel
headquarters
vpn-nat-t.eps

Page 5 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
Policies and
interfaces
It is useful to keep in mind that you apply firewall rules and IPsec policies to interfaces in the
following different ways:
zFirewall rules can be applied on either private or public interfaces. The rules are matched
against traffic that comes into the interface to which they were applied. Rules applied to
private interfaces are typically quite different to rules applied to public interfaces.
zIPsec policies are applied only on the public interface. The policy definitions, and any active
Security Associations (SAs), are considered for both incoming and outgoing traffic on that
interface.

Page 6 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
How to configure VPNs in typical corporate
networks
This section describes a typical corporate network using secure VPN. The network consists
of a headquarters (HQ) router and two branch office routers. The headquarters router is
acting as a VPN Access Concentrator, and allows for VPN access from either of the branch
office sites or from roaming laptop VPN clients. The network is illustrated in the following
figure.
Branch office
1 uses the PPPoA ADSL link type, and branch office 2 uses the PPPoEoA ADSL
link type. We have done this to illustrate these two commonly used ADSL link types. For
information about the ADSL link type you need, see your ADSL provider.
This How To Note gives you the commands for configuring each of the following:
1. The headquarters VPN access concentrator router, which includes:
zan ethernet connection to the Internet
za fixed Internet address. This means that the branch offices and the roaming VPN
clients have a known target for the headquarters end of the VPN
zVPN access to and from branch office 1 . This can be initiated from the headquarters
or branch office end. This is a site-to-site VPN and uses IPsec tunnel mode (see
"Background: NAT-T and policies" on page 4).
zVPN access from branch office 2. This can only be initiated from the branch office end,
because the branch office has a dynamically-assigned IP address. This also uses IPsec
tunnel mode.
zVPN client access from roaming users on Windows 2000 and Windows XP. This is
provided by using IPsec transport mode with L2TP (see "About IPsec modes: tunnel
and transport" on page 3)
zoptionally, prioritisation of voice (VoIP) traffic for these VPN clients by using Software
Quality of Service (SQoS). If the VPN clients use VoIP to establish voice calls via the
headquarters network, this helps maintain voice quality.
VLAN 1
192.168.141.254
222.222.222.1 222.222.222.254 200.200.200.254 192.168.140.254
211.211.211.1
192.168.200.254
physical address: 192.168.200.1
VPN tunnel address frompool: 192.168.143.1
211.211.211.254
200.200.200.1
ISP’s
router
headquarters
VPN access
concentrator
corporate
LAN
hotel’s NAT gateway
roaming VPN client
branch office 1
VPN router
branch office 2
dynamically
assigned
VLAN 1
192.168.142.254
Telco’s ADSL
exchange
Pool ofaddresses available
for roaming clients:
192.168.143.1-50
vpn-corporate.eps

Page 7 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
2. The branch office 1 router, which provides:
zan ADSL PPPoA Internet connection. Note that the PPPoA connection requires an
ATM DSLAM
zVPN access to headquarters using IPsec tunnel mode
zincoming VPN client access from roaming users
za fixed Internet address so that roaming VPN clients have a known target for the
branch office end of the VPN
3. The branch office 2 router, which provides:
zan ADSL PPPoEoA Internet connection
zVPN access to headquarters using IPsec tunnel mode
za dynamically assigned Internet address, as used by many ISPs.
Color coding For your convenience, the configurations are color-coded:
Before you start
Don’t forget to check you have the following when planning your secure VPN network:
1. ISAKMP shared key
2. Fixed public IP addresses to use where appropriate
3. The IP subnets to use on private LANs at the branch and headquarters sites
4. The range of IP addresses to use in the IP pools for allocating to the remote users
5. Usernames and passwords for the remote users
6. IP addresses from which SSH connections can be made to the routers (if applicable)
7. Connection parameters for the ADSL connections at the branch offices
8. VPN client PCs set up, as described in the How To Notes in "Related How To Notes" on
page 2.
headquarters
branch office 1
branch office 2

Headquarters
Page 8 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
How to configure the headquarters VPN access
concentrator
Before you begin to configure your router, ensure that it is running the appropriate software
release, patch and GUI files and has no configuration.
set inst=pref rel=<rel-file> pat=<patch-file> gui=<gui-file>
set conf=none
disable system security
restart reboot
Note: A software QoS extension to this configuration, to prioritise VoIP traffic over the
VPNs, is available in "How to prioritise outgoing VoIP traffic from the headquarters router" on
page 31.
Name the router
set system name=HQ
Define a security officer.
add user=secoff pass=<your-secoff-password> priv=securityofficer
lo=yes telnet=yes
Do not forget your “secoff” password.
Enable security mode so that VPN keys are stored securely, and other security features are
enabled.
enable system security
Once security mode is enabled, you need to log in as a security officer to enter most
configuration-altering commands.
login secoff
password: <your-secoff-password>
It is important to keep this security officer username and password secure, and to consider
proper handover of it in the event of IT staff changes.
Also, we recommend you leave a “manager” privilege user defined because this may provide
backup access if the security officer password is lost. Do not leave the manager password at
the factory default—change it to a password in keeping with your company's security policy.
set user=manager password=<your-company-policy-password>
When security mode is enabled, router configuration access times out after inactivity to
prevent unauthorised access. The default timeout is 60 seconds, but you may temporarily
raise it to 600 seconds if desired.
set user securedelay=600
1. Configure general system and user settings

Headquarters
Page 9 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
Give a fixed public address to the interface eth0, which is the Internet connection interface.
You can replace eth0 with ppp0 if you use a leased line.
enable ip
add ip int=eth0 ip=200.200.200.1
Give a fixed private address to the interface vlan 1 , which connects the router to the
headquarters LAN.
add ip int=vlan1 ip=192.168.140.254
Set the default route. The next hop is the gateway address provided by the ISP.
add ip rou=0.0.0.0 mask=0.0.0.0 int=eth0 next=200.200.200.254
If desired, set up the router as a DHCP server for the headquarters LAN.
create dhcp policy=hq lease=7200
add dhcp policy=hq rou=192.168.140.254
add dhcp policy=hq subn=255.255.255.0
create dhcp range=hq_hosts policy=hq ip=192.168.140.16 num=32
ena dhcp
If you need remote management access, we strongly recommend that you use Secure Shell
(SSH). You should not telnet to a secure gateway.
To configure SSH, define appropriate RSA encryption keys, then enable the SSH server.
create enco key=2 type=rsa length=1024 description="host key"
format=ssh
create enco key=3 type=rsa length=768 description="server key"
format=ssh
enable ssh server serverkey=3 hostkey=2
Enable the user who connects via SSH to log in as secoff, by adding the secoff user as an SSH
user. Also, you may choose to restrict access so that it is only permitted from particular
addresses.
add ssh user=secoff password=<secoff-password>
ipaddress=<trusted-remote-ip-address>
mask=<subnet-mask-of-trusted-hosts>
disable telnet server
Secure Shell is a more secure, encrypted method of remote management access than telnet.
If you need to use telnet, even though it is insecure, you should restrict access by defining
2. Configure IP for internet access
3. Configure remote management access, if desired

Headquarters
Page 10 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
remote security officers (RSOs). RSO definitions specify trusted remote addresses for
security officer users.
add user rso ip=<ipadd>[-<ipadd>]
enable user rso
enable telnet server
If desired, set the router to send log messages to a syslog server.
create log output=2 destination=syslog server=<syslog-server-address>
syslogformat=extended
add log out=2 filter=1 sev=>3
If desired, you can configure SNMP to inform you or your service provider of network
events, such as the LAN interface of the router going down. We recommend SNMPv3 for
security reasons. For details, see How To Configure SNMPv3 On Allied Telesis Routers and
Managed Layer 3 Switches. This How To Note is available from www.alliedtelesis.com/
resources/literature/howto.aspx.
You need to configure dynamic PPP over L2TP to accept incoming Windows VPN client
connections.
Create an IP pool to allocate unique internal payload addresses to incoming VPN clients.
create ip pool=roaming ip=192.168.143.1-192.168.143.50
Define a PPP template. This defines authentication and uses the IP pool of addresses.
create ppp template=1
set ppp template=1 bap=off ippool=roaming authentication=chap echo=10
lqr=off
Configure L2TP. When the router successfully negotiates an L2TP tunnel connection from
any remote peer, it then creates a PPP interface over that tunnel, using the PPP parameters
defined by the PPP template. If you intend to prioritise voice traffic (see page 30), also turn
on TOS (type of service) reflection, so that DSCP marked VoIP packets can be classified for
prioritisation at the PPP level.
enable l2tp
enable l2tp server=both
add l2tp ip=1.1.1.1-255.255.255.254 ppptemplate=1 tos=on
Add your approved roaming VPN client usernames.
add user=roaming1 pass=roaming1 lo=no telnet=no
add user=roaming2 pass=roaming2 lo=no telnet=no
If desired, you can instead use a RADIUS authentication server.
add radius server=<radius-server-address> secret=<secret-key>
4. Capture status information remotely, if desired
5. Configure dynamic PPP over L2TP connections