How to Configure OSPF Routing over TINA VPN

To dynamically learn OSPF-propagated routes from a remote location connected via TINA VPN tunnel, VPN next hop interfaces are used to create an intermediary network.

You must complete this configuration on both the local and the remote CloudGen Firewalls by using the respective values below:

	Example values for the local firewall	Example values for the remote firewall
VPNR Next Hop Interface Index	1	1
VPN Next Hop Interface IP Address	192.168.20.1/24	192.168.20.2/24
Box Shared IP	192.168.20.1	192.168.20.2
VPN Local Networks	empty	empty
VPN Remote Networks	empty	empty
Router ID	192.168.20.1	192.168.20.2

Before You Begin

A free /24 subnet (e.g., 192.168.20.0/24) for the intermediary network is required.

Step 1. Add a VPN Next Hop Interface

Add a VPN next hop interface using a /24 subnet (e.g., 192.168.20.0/24).

Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > VPN Settings.
Click Lock.
In the left menu, select Routed VPN.
Next to the Next Hop Interface Configuration table, click Add.
In the VPN Interface Properties window, configure the following settings and then click OK.
- In the VPN Interface Index field, enter a number between 0 and 999. E.g., 11
- In the IP Addresses field, enter the VPN interface IP address including the subnet. E.g., 192.168.20.1/24 for the local CloudGen Firewall, or 192.168.20.2/24 for the remote firewall.
- In the Multicast Addresses field, enter the OSPF multicast addresses: 224.0.0.5 224.0.0.6
- Click OK. The interface is now listed in the Next Hop Interface Configuration table.
Click Send Changes and Activate.

Step 2. Add the VPN Next Hop Interface IP Address to the Firewall Listening IP Addresses

Introduce the IP address of the VPN next hop interface on the firewall.

CloudGen Firewalls installed using version 8.0.2 (or higher) do not require the interface IP address to be added to the Shared Networks table as this is handled by the host firewall ruleset.

Go to CONFIGURATION > Configuration Tree > Box > Network.
In the left menu, select IP Configuration.
Click Lock.
In the Shared Networks and IPs section, click +. The Shared Network and IPs window opens.
1. Select the virtual Interface.
2. In the Network Address field, enter the network the virtual interface resides in.
3. In the Shared IPs in this Network table, click + and add the IP address of the VPN next hop interface.
4. Click OK.
Click Send Changes and Activate.

Step 3. Configure the TINA Site-to-Site VPN Tunnels

You can configure the VPN tunnel using the GTI Editor for managed CloudGen Firewalls, or using the Site-to-Site configuration dialog if you are using standalone CloudGen Firewalls.

In the GTI Editor

Edit the VPN tunnel to remove the local and remote networks and add the VPN next hop interface ID.

Go to the global/range/cluster GTI Editor.
Click Lock.
Click on the VPN tunnel, and click on the first Transport to edit the VPN tunnel configuration. For more information, see How to Create a VPN Tunnel with the VPN GTI Editor.
Remove all Local Networks from the remote and local VPN services.
Enter the VPN next hop interface ID for the remote and local VPN services. E.g., 11
Click OK.
Click Send Changes and Activate.

Standalone CloudGen Firewalls

On both the remote and local firewalls, configure a TINA VPN tunnel with the VPN Interface Index. Leave the local and remote networks empty.

Log into the local CloudGen Firewall.
Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > Site to Site.
Click Lock.
Right-click in the TINA Tunnels tab and select New TINA tunnel. The TINA tunnel window opens.
Enter a Name.
Configure the Transport, Encryption and Authentication settings as well as the Local and Remote public IP addresses. For more information, see How to Create a TINA VPN Tunnel between CloudGen Firewalls.
Exchange the Peer Identification keys.
In the Remote Networks tab, enter the VPN Interface Index number that you created in the VPN Interface Configuration in step 1. E.g. 11
Click OK.
Click Send Changes and Activate.