Dear Astaro Users,
due to an increasing number of support requests
related to the SSH client and a missing VPN howto,
we apologize for that, I'll try to explain in
a short form how to set it up.
I assume that most users want to use X.509
On the firewall:
1. Create a signing CA in IPSEC/CA MANAGEMENT
2. Create a firewall CSR (Certificate Signing Request) Identifier should be the IP address, because it is static.
and a user CSR, Identifier here could be the
email address.
3. checkmark the firewall CSR and choose "issue cert from CSR"
4. checkmark the users CSR an do the same
5. checkmark the users certificate and select "export as PKCS12"
6. goto LOCALKEYS and select the firewalls certificate
7. goto IPSECCONNECTIONS configure your connection,
make sure that the type is ROADWARRIOR and that
you know exactly the parameters of your choosen
policy.
SSH Sentinel:
(please be merciful, I write that from memory)
1. is to import the users PKCS12 certificate,
choose the TAB Key Management, right click on
host keys, import certificate. Select your
exported user certificate.
The PKCS12 format contains all needed information
as well as the verification CA, so there is no
need to export the firewalls signing CA itself!
Very important: Click on "apply" (hopefully the
button is named like that in the English
version :-)) I am sure you know what I mean!
2. Go Back to the configuration Tab and configure
your connection using the new installed certificate.
3. Select properties->the first settings button and
make sure that you exactly use the same params, as
configured in your used Astaro policy.
4. Select the TAB "Advanced" and click on the
first settings button and again use the same params
used in the Astaro policy.
5. Apply all changes.
6. Run diagnostics
If it is succesfull note that
the firewall doesn't interpret informational messages
send by the SSH client, so the fireall will have after
the diagnostic a valid ipsec connection.
To enable the connection, do a right click on the
SSH icon in the icon tray an select "select VPN", select
your VPN connection and, if the IPSEC monitor was
opened before, you can see after a successful authentication
the activated tunnel.
The fireall itself sets automatically packet flters
to allow ANY ACCESS to the network to which the
Security Association (SA) belongs to.
So far for now!
read you
o|iver
[size="1"][ 18 June 2002, 14:11: Message edited by: oliver.desch ][/size]
This thread was automatically locked due to age.
