Roaming Clients - D-Link NetDefendOS User Manual

1. Go to: Network > Routing > Routing Tables > main > Add > Route
2. Now enter:
• Interface: ipsec_hq_to_branch
• Network: 192.168.11.0/24
3. Click OK
Now, configure the branch office firewall in a similar fashion. The local and remote gateway
networks are reversed and the head office public IP now becomes the Remote Endpoint value.
Note that the same PSK value must be used on both sides. Also, the proposal lists for IKE and
IPsec should either be the same or at least have some overlap so cryptographic methods
acceptable to both sides can be found during the IKE negotiation to set up the tunnel.

9.4.3. Roaming Clients

An employee who is on the move who needs to access a central corporate server from a
notebook computer from different locations is a typical example of a roaming client. Apart from
the need for secure VPN access, the other major issue with roaming clients is that the mobile
user's IP address is often not known beforehand. To handle the unknown IP address the
NetDefendOS can dynamically add routes to the routing table as tunnels are established.
Dealing with Unknown IP addresses
If the IP address of the client is not known beforehand then the NetDefend Firewall needs to
create a route in its routing table dynamically as each client connects. In the example below this
is the case and the IPsec tunnel is configured to dynamically add routes.
If clients are to be allowed to roam in from everywhere, irrespective of their IP address, then the
Remote Network needs to be set to all-nets (IP address: 0.0.0.0/0) which will allow all existing
IPv4-addresses to connect through the tunnel.
When configuring VPN tunnels for roaming clients it is usually not necessary to add to or modify
the algorithm proposal lists that are preconfigured in NetDefendOS.
PSK Based IPsec Tunnels for Roaming Clients
The following example shows how a PSK based tunnel can be set up.
Example 9.5. PSK Based IPsec Tunnel for Roaming Clients Setup
This example describes how to configure an IPsec tunnel at the head office firewall for roaming
clients that connect to it to gain remote access to the protected network 172.16.1.0/24 which is
on the lan interface.
It is assumed the default NetDefendOS IKE and IPsec proposal list are used on the firewall and
that the clients will use proposal lists that will result in an acceptable match during the IKE
negotiation phase of tunnel setup.
Command-Line Interface
708
Chapter 9: VPN