Example - Client-to-Site IKEv2 IPsec VPN with Username/Password Authentication

Use an IPsec IKEv2 client-to-site VPN to let mobile workers connect securely to your Barracuda CloudGen Firewall with a standard compliant IKEv2 VPN client.

Open

Although any standard-compliant IPsec IKEv2 client should be able to connect via IPsec, Barracuda Networks recommends using the following clients:

• Windows 8.1/Windows 10 native IKEv2 IPsec VPN client

• Windows 10 Mobile 10.0.14393 or newer

• Native Android IPsec VPN Client

• Set up the VPN certificates for external CA. For more information, see How to Set Up External CA VPN Certificates.

• Configure MS-Chapv2 authentication. For more information, see How to Configure MS-CHAP Authentication. For RADIUS-based authentication, this step is not required.

• Identify the subnet and gateway address to use for the VPN service in your network (e.g., 192.168.6.0/24 and 192.168.6.254).

• Identify the IPv4 and IPv6 addresses the VPN service is listening on. If you are using a dynamic WAN IP, see How to Configure VPN Access via a Dynamic WAN IP Address.

1. Get the corresponding root certificate (or create a new one) that should be used to issue a VPN server certificate.

   The root certificate must be considered as trusted on the client device (e.g., by importing it into the Trusted Root Certification Authorities Certificate Store on Windows).

2. Create a new VPN server certificate by using the CA from above with the following requirements:

   • Hostname of the VPN server that is entered on the client must be contained in the subjectAltName field of the certificate.

   • Required Key Usage fields:

     • Non-Repudiation, Digital Signature, Key Encipherment

   • Required EKU fields:

     • IP Security IKE Intermediate / IP Security End Identity in xCA (OID 1.3.6.1.5.5.8.2.2)

   1. • Server Authentication (OID 1.3.6.1.5.5.7.3.1)

You should now have a root certificate in CER or PEM format and a VPN certificate in PKCS12, CRT, or PEM format.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > VPN Settings.

2. Click Lock.  

3. In the left menu, select Root Certificates.

4. Right-click the table and click Import CER from File or Import PEM from File, depending on the format of your root certificate. 

5. Select and upload the root certificate created in Step 1.

6. In the left menu, select Service Certificates.

7. Right-click the table and click the Import Certificate menu item matching your VPN server certificate.

8. Select and upload the VPN certificate created in Step 1. 

9. In the left menu, select Service Keys. 

10. Right-click the table and select New Key.

11. Enter a Key Name.

12. Select the Key Length.

13. Click OK.

14. Click Send Changes and Activate.

All VPN clients will receive an IP address from the VPN client network with a static gateway. You can choose the gateway IP address freely from the subnet.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > VPN Settings.

2. Click Lock

3. In the left menu, select Client Networks.

4. Right-click the table and select New Client Network. The Client Network window opens.

5. In the Client Network window, configure the following settings:

   • Advertise Route – Select check box to include the VPN network in the OSPF or BGP network.

   • Name – Enter a descriptive name for the network. 

   • Network Address – Enter the base network address for the VPN clients.

   • Gateway – Enter the gateway network address.

   • Type – Select routed (Static Route). VPN clients are assigned an address via DHCP (fixed or dynamic) in a separate network reserved for the VPN. A static route on the firewall leads to the local network.

6. Click OK.

7. Click Send Changes and Activate.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > Client to Site.

2. Click Lock.

3. Click the External CA tab.

4. Clear the Hide Advanced Configuration check box. 
   

5. Click the IPsec sub-tab. 
   

6. In the IKEv2 Phase 1 (default) section, double-click on the Phase 1 encryption settings. The Change IPsec Phase 1 window opens.

7. Configure the IPsec Phase I encryption settings:

   • Encryption – Select AES256.

   • Hash Meth – Select SHA.

   • DH-Group – Select Group 2.

8. (optional) Set the IPsec Phase 1 Lifetime settings: 

   • Time – Enter 3600

   • Minimum – Enter 1200

   • Maximum – Enter 4800

9. Click OK.
   

10. Right-click in the IKEv2 Phase 2 table and select New IKEv2 Phase II. The IPsec IKEv2 Phase II windows opens.

11. Enter a Name.

12. Configure the IPsec phase 2 encryption settings: 

    • Encryption – Select AES256.

    • Hash Meth – Select SHA.

    • DH-Group – Select Group 2.

13. (optional) Set the IPsec Phase 2 Lifetime settings: 

    • Time – Enter 3600

    • Minimum – Enter 1200

    • Maximum – Enter 4800

14. Click OK. 
    

15. Click Send Changes and Activate.