the setup described above are:
1.
The NetDefendOS date and time must be set correctly since certificates can expire.
2.
Load a Gateway Certificate and Root Certificate into NetDefendOS.
3.
When setting up the IPsec Tunnel object, specify the certificates to use under Authentication.
This is done by:
a.
Enable the X.509 Certificate option.
b.
Select the Gateway Certificate.
c.
Add the Root Certificate to use.
4.
If using the Windows XP L2TP client, the appropriate certificates need to be imported into
Windows before setting up the connection with the New Connection Wizard.
The step to set up user authentication is optional since this is additional security to certificates.
Also review Section 9.6, “CA Server Access”, which describes important considerations for
certificate validation.
9.2.7. PPTP Roaming Clients
PPTP is simpler to set up than L2TP since IPsec is not used and instead relies on its own, less
strong, encryption.
A major secondary disadvantage is not being able to NAT PPTP connections through a tunnel so
multiple clients can use a single connection to the NetDefend Firewall. If NATing is tried then only
the first client that tries to connect will succeed.
The steps for PPTP setup are as follows:
1.
In the Address Book define the following IP objects:
•
A pptp_pool IP object which is the range of internal IP addresses that will be handed out
from an internal network.
•
An int_net object which is the internal network from which the addresses come.
•
An ip_int object which is the internal IP address of the interface connected to the internal
network. Let us assume that this interface is int.
•
An ip_ext object which is the external public address which clients will connect to (let's
assume this is on the ext interface).
2.
Define a PPTP/L2TP object (let's call it pptp_tunnel) with the following parameters:
•
Set Inner IP Address to ip_net.
•
Set Tunnel Protocol to PPTP.
•
Set Outer Interface Filter to ext.
•
Set Outer server IP to ip_ext.
•
For Microsoft Point-to-Point Encryption it is recommended to disable all options except
128 bit encryption.
•
Set IP Pool to pptp_pool.
9.2.7. PPTP Roaming Clients
Chapter 9. VPN
395
Summary of Contents for NetDefend DFL-260E
Page 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Page 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Page 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Page 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Page 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Page 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Page 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Page 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Page 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Page 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Page 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Page 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Page 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Page 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Page 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...
