Ipsec Roaming Clients With Certificates - D-Link NetDefendOS User Manual

• Enable the IKE Config Mode Pool option in the IPsec Tunnel object ipsec_tunnel.
2. If client IP addresses are to be retrieved through DHCP:
• Create an IP Pool object and in it specify the DHCP server to use. The DHCP server can
be specified as a simple IP address or alternatively as being accessible on a specific
interface. If an internal DHCP server is to be used then specify the loopback address
127.0.0.1 as the DHCP server IP address.
• Create a Config Mode Pool object (there can only be one associated with a
NetDefendOS installation) and associate with it the IP Pool object defined in the
previous step.
• Enable the IKE Config Mode Pool option in the IPsec Tunnel object ipsec_tunnel so the
created pool is selected.
Configuring IPsec Clients
In both cases (A) and (B) above, the IPsec client will need to be correctly configured. The client
configuration will require the following:
• Define the URL or IP address of the NetDefend Firewall. The client needs to locate the tunnel
endpoint.
• Define the pre-shared key that is used for IPsec security.
• Define the IPsec algorithms that will be used and which are supported by NetDefendOS.
• Specify if the client will use config mode.
There are a variety of IPsec client software products available from a number of suppliers and this
manual will not focus on any specific one. The network administrator should use the client that is
best suited to their budget and needs.
For a roaming clients example showing the actual configuration steps, go to Example 9.5, "PSK
Based IPsec Tunnel for Roaming Clients Setup".

9.2.4. IPsec Roaming Clients with Certificates

If certificates are used with IPsec roaming clients instead of pre-shared keys then no Pre-shared
Key object is needed and the other differences in the setup described above are:
1. Upload a Root Certificate and a Gateway Certificate into NetDefendOS. The gateway
certificate needs to have 2 parts added: a certificate file (usually with filetype .cer or .crt) and
a private key file (with filetype .key). The root certificate needs just the certificate file added.
2. When setting up the IPsec Tunnel object, specify the certificates to use under
Authentication. This is done by doing the following:
a. Enable the X.509 Certificate option.
b. Select the Gateway Certificate.
c. Add the Root Certificate to use.
3. The IPsec client software will need to be appropriately configured with the certificates and
677
Chapter 9: VPN