How to Configure a Remote Management Tunnel for a CloudGen Firewall

If the managed CloudGen Firewall cannot directly reach the Barracuda Firewall Control Center, it must connect via a remote management tunnel. The remote firewall uses the certificate keys exchanged at deployment to authenticate to the Control Center. Since it is not recommended to use an external IP address as a management IP, the remote firewall is assigned a Virtual IP (VIP) in the local network. The VIP is used to connect to the remote firewall from the local network. Depending on whether the VIP is a subnet of the local network or a separate network, you will need access rule and route entries on the border firewall and an access rule on the CC firewall. If the remote firewall is using a IPv6 IP address to connect, the Control Center must have a global unicast IPv6 address.

Open

• Only IPv4 traffic can be sent through the management tunnel.

• Use an available network or subnet to be used for the VIP addresses.

• (IPv4 only) You need the external IPv4 address of the border firewall.

• (IPv6 only) The Control Center must be reachable through an IPv6 global unicast address.

• Firewalls in a HA cluster must have the public IP address configured on box level.

1. Go to CONFIGURATION > Configuration Tree > Multi-Range > Global Settings > VIP Networks.

2. In the left menu, select VIP Networks.

3. Click Lock.

4. In the VIP Networks table, add an entry for the network range. Configure the following settings for the entry:  

   • Name – A name for the network range.    

   • Network Address – Enter the VIP network address. E.g., 10.0.11.0

   • Netmask – Select the netmask. E.g., 24-Bit
     

     Open

     

5. (optional) In the left menu, click VPN Settings.

6. (optional) The VPN Settings are set to sensible default values. If necessary, you can change these settings:

   Click here for VPN Settings ....

   Pending Session Limitation – Only five CloudGen Firewalls are allowed to initiate management tunnels at the same time. Connection attempts exceeding the limit are blocked. This features makes sure that the Control Center is not overloaded due to too many management tunnel requests. Use Tunnels for Authentication (rarely used) – Registers the tunnel network and credentials so that all traffic going through the management tunnel is treated as traffic from an authenticated user. You can use this criteria to create access rules in the CC firewall. To improve startup speed, disable this feature. You can see these virtual management tunnel users on the box level of the Control Center in FIREWALL > Users. Prebuild Cookies on Startup – Prebuilds cookies when the VPN service is started. This might slow the VPN service startup but increases the speed of tunnel builds. This setting also prevents high system loads on firewalls with a large number of VPN tunnels. High system load caused by the VPN service can occur if a large number of VPN tunnels are established simultaneously after a unit reboot or ISP outage.

7. (optional) In the left menu, click on Rekey/Alive Rates. The rekey/alive rates are set to sensible default values. If necessary, you can change these settings:

   Click here for Rekey/Alive Rates ...

   Server enforces Limits – Specifies that the VPN service of the Control Center enforces the key limits. If disabled, the firewall enforces the limits. Key Time Limit [Minutes] – The rekey period. Key Byte Limit [Mbytes] – The rekey period after specified amount of Mbytes. Tunnel Probing [Seconds] – The interval in which keepalive packets sent to the remote tunnel end. Tunnel Timeout [Seconds] – The length of time after which a tunnel is considered down if an answer has not been received by the vpnc process. Enter a smaller value for the Tunnel Timeout than the Tunnel Probing value. The timeout starts after a keepalive packet is sent. Retransmissions are sent additionally within this period.

8. Click OK.

9. Click Send Changes and Activate.

Per default the CC-VPN service only listens on IPv4 addresses. You must add the IPv6 addresses manually.

1. Log into the box level of your Control Center.

2. Go to CONFIGURATION > Configuration Tree > Box > Network.

3. Click Lock.

4. In the left menu, click IP Configuration.

5. Scroll down to IP Version 6.

6. Make sure, IPv6 is enabled.

7. In the IPv6 Shared Networks and IPs section, introduce the IPv6 network containing your IP addresses.

8. In the Shared IPs in this Network box, add the listening IPv6 addresses.

9. Click OK.

10. Click Send Changes and Activate.

11. Go to CONTROL > Box.

12. In the Network section of the left menu, click Activate new network configuration. The Network Activation window opens.

13. Click Failsafe.

1. Log into the box level of your Control Center.

2. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > CCVPN > Service Properties.

3. Click Lock. 

4. Click + to add an IPv6 address to the Explicit IPv6 IPs to the list.

5. Double click the IPv6 in the list.
   

   Open

   

6. Click Send Changes and Activate.

One external IP address must be available on the box layer of the remote firewall to ensure that the management tunnel can be initiated even if the services hosted on the firewall are down. If you are using IPv4 dynamic Internet connection, skip this step.

1. Go to CONFIGURATION > Configuration Tree > Multi-Range > your range > your cluster > your managed CloudGen Firewall > Network.

2. In the left menu, select IP Configuration.

3. Click Lock.

4. Click + in the Additional Local IPs section. The IP Address Configuration window opens.

5. Configure the additional local IP address:

   • Interface – Select the interface for the Internet connection

   • IP Address – Enter the external IPv4 address for the managed firewall.

   • Responds to Ping – Select Yes. 

   • Default Gateway – Enter the default gateway supplied by your ISP.

6. In the left menu, expand Configuration Mode and click Switch to Advanced View.

7. Click + in the Additional IPv6 Addresses section. The Additional IPv6 Addresses window opens.

8. Configure the additional local IPv6 address:

   • Interface – Select the interface for the Internet connection.

   • IP Address – Enter the external IPv6 address for the managed firewall. 

   • Associated Netmask – Enter the netmask.

   • Responds to Ping – Select Yes. 

9. Click OK.

10. In the left menu, click Routing and verify that a default IPv6 route exists. For more information, see How to Configure IPv6 Gateway Routes.

11. Click Send Changes and Activate.