Amer Networks E5Web GUI - Manual (Page 600)

• Set up the Rules (a 2-way tunnel requires 2 rules).
9.4.3. Roaming Clients
An employee who is on the move who needs to access a central corporate server from a
notebook computer from different locations is a typical example of a roaming client. Apart from
the need for secure VPN access, the other major issue with roaming clients is that the mobile
user's IP address is often not known beforehand. To handle the unknown IP address the cOS Core
can dynamically add routes to the routing table as tunnels are established.
Dealing with Unknown IP addresses
If the IP address of the client is not known beforehand then the Clavister Security Gateway needs
to create a route in its routing table dynamically as each client connects. In the example below
this is the case and the IPsec tunnel is configured to dynamically add routes.
If clients are to be allowed to roam in from everywhere, irrespective of their IP address, then the
Remote Network needs to be set to all-nets (IP address: 0.0.0.0/0) which will allow all existing
IPv4-addresses to connect through the tunnel.
When configuring VPN tunnels for roaming clients it is usually not necessary to add to or modify
the algorithm proposal lists that are pre-configured in cOS Core.
PSK based client tunnels
The following example shows how a PSK based tunnel can be set up.
Example 9.4. Setting up a PSK based VPN tunnel for roaming clients
This example describes how to configure an IPsec tunnel at the head office Clavister Security
Gateway for roaming clients that connect to the office to gain remote access. The head office
network uses the 10.0.1.0/24 network span with external gateway IP wan_ip.
InControl
Follow the same steps used for the Web Interface below.
Web Interface
A. Create a pre-shared key for IPsec authentication:
1. Go to: Objects > Key Ring > Add > Pre-Shared Key
2. Now enter:
• Name: Enter a name for the key, for example SecretKey
• Shared Secret: Enter a secret passphrase
• Confirm Secret: Enter the secret passphrase again
3. Click OK
B. Configure the IPsec tunnel:
Chapter 9: VPN
600