Configuring VPN

This section describes how to configure these VPN configuration scenarios:

Configuring Remote Access VPN

introduction

use these option for remote access :

Remote Access Configuration

These are the methods to configure remote access users:

• Local users

• RADIUS users

• ad user

To allow only specified users to connect with a remote access client,set group permissions for the applicable user type. Select the arrow next to the option and select the relevant group option. See Configuring Remote Access Users.

To configure new local user :

1. Go to > .

2. Click to add local users.

3. Make sure that the checkbox is selected.

For more information ,see configure Remote Access Users .

To configure existing users:

1. Go to > .

2. Click to make sure that the checkbox is selected.

For more information ,see configure Remote Access Users .

To configure RADIUS users:

1. Go to >

2. click to add aRADIUS server . See configure Authentication Servers for Remote Access .

3. click to set access permission .

To configure ad user:

1. Go to > and click to add an AD domain. See Configuring Authentication Servers for Remote Access.

2. click to set access permission .

L2TP VPN Client configuration

For L2TP VPN Client configuration,click to enter the key after you enable the L2TP VPN client method.

Advanced Options

For more information on advanced Remote Access options,for example Office Mode network,see Configuring Advanced Remote Access Options.

Monitoring

To make sure Remote Access is working:

Use the configured client to connect to an internal resource from a remote host.

Configuring Site to Site VPN with a Preshared Secret

introduction

In this Site to Site VPN configuration method a preshared secret is used for authentication.

Prerequisites

• Make sure the Site to Site VPN blade is set to On and is selected. See Configuring the Site to Site VPN Blade.

• The peer device that you connect to must be configure and connect to the network . If it is is is aDAIP gateway,its host name must be resolvable.

Configuration

Enter a host name or IP address and enter the preshared secret information. For more information,see Configuring VPN Sites.

Monitoring

To make sure the VPN is work :

1. Send traffic between the local and peer gateway.

2. Go to > to monitor the tunnel status. See view VPN Tunnels .

Configuring Site to Site VPN with a Certificate

introduction

In this Site to Site VPN configuration method a certificate is used for authentication.

Prerequisites

• Make sure the Site to Site VPN blade is set to On and is selected. See Configuring the Site to Site VPN Blade.

• The peer device that you connect to must be configure and connect to the network . If it is is is aDAIP gateway,its host name must be resolvable.

• You must reinitialize certificates with your IP address or resolvable host name. Make sure the certificate is trusted on both sides.

• VPN encryption settings is be must be the same on both side ( the localgateway and the peer gateway ) . This is is is especially important when you use the Custom encryption option .

Configuration

1. Reinitialize certificates – Use the option described in Managing Installed Certificates. Make sure this is done on both the local and peer gateway (if they both use locally managed check point appliances).

2. Trust CAs on the local and peer gateway – Use one of these procedures:

   • Exchange CAs between gateway

   • sign a request using one of thegateway‘s CAs.

   • Authenticate by using a 3rd party CA.

   • Authenticate with an existing 3rd party certificate.

3. use certificate authentication to create the VPN   site .

   1. Follow the instructions in Configuring VPN Sites.

   2. To make sure the specified certificate is used ,enter the peergateway‘s certificate information in > .

Trust Procedures

Exchange CAs between gateway:

click to add the Trusted CA of the peergateway. This makes sure the CA is uploaded on both the local and peer gateway. See Managing Trusted CAs.

sign a request using one of thegateway‘s CAs:

You create a request from one gateway that must be signed by the peer gateway’s CA:

1. Use the option in Managing Installed Certificates.

2. Export this request using the option.

3. Use the peer gateway‘s internal CA is ‘s to sign the request on the peer gateway .

   If the peergateway is a locally managed check point gateway,go to > and use the option.

   For more information ,see Managing Trusted ca .

4. upload the sign request to the localgateway.

   1. Go to > .

   2. select the instal certificate that you ask the remote peer to sign .

   3. upload the certificate with the option .

      See Managing Installed Certificates.

5. Make sure that the CA is installed on both of the gateway. Use the option in Managing Trusted CAs.

To authenticate by using a 3rd party CA :

You create a signing request from each peer gateway. Follow the steps above in sign a request using one of thegateway‘s CAs to sign it with a 3rd party CA .

note that a 3rd party CA can issue *.crt,*.p12,or *.pfx certificate files.

1. upload the certificate using the appropriate upload option .

   1. Go to > .

   2. select the instal certificate that you ask the remote peer to sign .

   3. upload the certificate with the or option .

      See Managing Installed Certificates.

2. Make sure that the 3rd party CA is installed on both of the gateway.

   Use the option in Managing Trusted CAs.

To authenticate with an existing 3rd party certificate:

1. Create a P12 certificate for the local and peer gateway.

2. Upload the P12 certificate using the option on each gateway.

3. Make sure that the 3rd party CA is installed on both of the gateway.

   Use the option in Managing Trusted CAs.

Monitoring VPN

To make sure the VPN is work :

1. Pass traffic between the local and peer gateway.

2. Go to > to monitor the tunnel status.

   See view VPN Tunnels .