Siemens RUGGEDCOM ROX II User Manual page 235

RUGGEDCOM ROX II
CLI User Guide
5. Configure a host for the interface that carries the unencrypted IPsec traffic. Make sure the VPN zone is
associated with the interface. If VPN tunnels to multiple remote sites are required, make sure host entry
exists for each or collapse them into a single subnet. For more information about configuring hosts, refer to
Section 6.9.11, "Managing
6. Configure a second host for the interface that carries the encrypted IPsec traffic. Make sure the interface is
associated with the network zone and specify a wider subnet mask, such as 0.0.0.0/0. For more information
about configuring hosts, refer to
NOTE
The VPN host must be specified before the network host so the more specific VPN zone subnet can
be inspected first.
The following are examples of possible host configurations:
Host
vpn
net
7. Configure rules with the following parameter settings for the UDP, Authentication Header (AH) and
Encapsulation Security Payload (ESP) protocols:
NOTE
The IPsec protocol operates on UDP port 500, using protocols Authentication Header (AH) and
Encapsulation Security Payload (ESP) protocols. The firewall must be configured to accept this
traffic in order to allow the IPsec protocol.
Action
Accept
Accept
Accept
For more information about configuring rules, refer to
8. Configure the following rule to allow traffic from Libreswan, the IPsec daemon, to enter the firewall:
NOTE
IPsec traffic arriving at the firewall is directed to Libreswan, the IPsec daemon. Libreswan decrypts
the traffic and then forwards it back to the firewall on the same interface that originally received
it. A rule is required to allow traffic to enter the firewall from this interface.
Action
Accept
For more information about configuring rules, refer to
Section 6.9.7
Configuring the Firewall for a VPN in a DMZ
When the firewall needs to pass VPN traffic through to another device, such as a VPN device in a Demilitarized
Zone (DMZ), then a DMZ zone and special rules are required.
Configuring the Firewall for a VPN in a DMZ
Hosts".
Section 6.9.11, "Managing
Interface
W1ppp
W1ppp
Source-Zone Destination-Zone
net fw
net fw
net fw
Source-Zone Destination-Zone
vpn loc
Hosts".
Subnet
192.168.1.0/24
0.0.0.0/0
Protocol
ah
esp
udp
Section 6.9.15, "Managing
Protocol
—
Section 6.9.15, "Managing
Chapter 6
Security
IPsec Zone
Yes
No
Dest-Port
—
—
500
Rules".
Dest-Port
—
Rules".
189