Road Warriors - Setup Remote Access

Intro

Remote access to the company’s infrastructure is one of most important and critical services exposed to the internet. IPsec Mobile Clients offer mobile users (formerly known as Road Warriors) a solution that is easy to setup and compatible with most current devices.

With this guide we will show you how to configure the server side on Ixolate with the different authentication methods e.g.

• EAP-MSCHAPv2
• Mutual-PSK + XAuth
• Mutual-RSA + XAuth
• …

Sample Setup

All configuration examples are based on the following setup, please read this carefully as all guides depend on it.

Company Network with Remote Client

nwdiag {

span_width = 90; node_width = 180; Internet [shape = “cisco.cloud”]; fileserver [label=“File Server”,shape=“cisco.fileserver”,address=“192.168.1.10”]; fileserver – switchlan;

network LAN {
switchlan [label=“”,shape = “cisco.workgroup_switch”]; label = “ LAN“; address =“192.168.1.x/24”; fw1 [address=“192.168.1.1/24”];

}

network WAN {
label = “ WAN“; fw1 [shape = “cisco.firewall”, address=“172.18.0.164”]; Internet;

}

network Remote {
Internet; laptop [address=“172.10.10.55 (WANIP),10.10.0.1 (IPsec)”,label=“Remote User”,shape=“cisco.laptop”];

}

}

Company Network

Firewall Rules Mobile Users

To allow IPsec Tunnel Connections, the following should be allowed on WAN.

• Protocol ESP
• UDP Traffic on Port 500 (ISAKMP)
• UDP Traffic on Port 4500 (NAT-T)

To allow traffic passing to your LAN subnet you need to add a rule to the IPsec interface.

VPN compatibility

In the next table you can see the existing VPN authentication mechanisms and which client operating systems support it, with links to their configurations. For Linux testing was done with Ubuntu 18.4 Desktop and network-manager-strongswan and libcharon-extra-plugins installed. As Android does not support IKEv2 yet we added notes for combinations with strongSwan app installed to have a broader compatibility for all systems. Mutual RSA and PSK without XAuth requires L2TP, since this legacy technology is very error prone we will not cover it here.

VPN combinations

List of examples