In this business case the administrator is tasked with setting up an IPSec VPN
in between a head office, using a Sophos XG firewall, and a branch office using a
Sophos SG UTM firewall. This setup is in order to create a secure connection in
between the two sites which allows for the branch office to access head office
resources securely. Let's take a look at how you would do this on the XG
firewall. Okay so in this tutorial we are going to be covering how you can create
a site-to-site VPN link with the new Sophos firewall. Site-to-site VPN links are
very important as they allow you to create a encrypted tunnel between your
branch offices and HQ. And in the Sophos firewall we can have IPSec and SSL
site-to-site links that take place between a Sophos firewall, and another
Sophos firewall. Also between a Sophos firewall and our existing Sophos UTMs,
but also between the Sophos firewall and third party devices as well.
It''s a very useful for getting a remote sites linked back up to HQ using
traditional standards such as IPSec and SSL. Now I have a Sophos firewall in
front of me here so I'm going to log on just using some local credentials, and as
a result of this we will see the familiar dashboard of the Sophos
firewall operating system. Now in this particular example I'm going to be
creating an IPSec tunnel between my Sophos firewall and a Sophos UTM that I
have in a remote office. So there's a number of things that we need to think
about when we're creating these policies and creating these links. First and
foremost we need to think about the device that we're connecting to and what
policy they are using, because one of the fundamentals of creating an IPSec policy
security association is making sure that the policy is exactly the same both
sides. Now that's absolutely fine if you're using a Sophos firewall at the
other end of the tunnel because we can use the same settings and it's very easy
to set up, but if it's a separate device it can be a little bit tricky. So the
first thing I'm going to do is have a at my IPSec policies. So I'm just going
to go down to the objects link here in the Sophos firewall and go to Policies.
And in the list you will see we have IPSec. In the list here we've got a
number of different policies and they're designed to allow you to get up and
running as soon as you possibly can. So you can see we've got a branch office
one and a head office one here. Now the most important thing here is just making
sure that it does match up with what you've got at the other end at your
branch office. So I'm going to have a look at the default branch office and in
here we can see all of the different settings that are used in the IPSec
internet key exchange, and of course building that security association. So
looking at this we can see the encryption methods the authentication
method that are being used we can see the, Diffie-Hellman group, key lifes, etc. So we
need to make a mental note of what settings these are, AES-128, MD5, and those
key lengths. Now because I'm connecting to a Sophos UTM in a remote office, I
can very quickly just go to my UTM and do the same process there. Have a look at
the policy that's being used for IPSec, So I'm going to go to my IPSec policies
and again we can see a long list of different policies available. Now picking
on the first one in the list I'm gonna have a look at AES -128, and when we
have a look at these details a AES-128, MD5, IKE security association lifetime,
when I match those against what I've got on the Sophos fire wall end they're
exactly the same. So we know that we've got a policy each end that matches so
that it's absolutely fine. Ok so the next thing I need to do is actually create my
policy.
Now at the moment I've got no connections whatsoever but what I'm going
to do is create a new connection here, and we're going to keep this simple.
First and foremost. So I'm going to say if I want to make an IPSec connection to
my branch office there we go. Now in terms of the connection type we're not
talking about row access VPNs here we want to create a secure connection
between sites, so I'm going to go site-to -site. Now we also need to make the
decision as to whether this Sophos firewall is going to initiate the VPN
connection or only respond to it. And there might be certain reasons why you
would choose one or the other, but in this scenario we're going to just say
we're going to initiate the connection. Now the next thing I need to do is say
ok what authentication are we going to use how are we going to identify
ourselves to the other end, the location that we are connecting to. So I'm going
to use a pre-shared key in this particular example. I'm just going to put
a pre-shared key that only I know. Now it's worth mentioning that there are
limitations to pre-shared keys because if you've got lots and lots of different
IPSec tunnels that you want to bring up and running, there's lots of different
keys to think about, but we'll go on to other methods later on in this
demonstration on how you can make that a little bit easier. Ok so we're using a
pre-shared key. So the next thing I need to say is where is that device. So
firstly I need to select the ports that I am going to use on this Sophos
firewall, which is going to be port 3 which has a 10.10.10.253 address,
and I'm going to connect to my remote device which actually has an IP address
of 10.10.54. Now of course in a real world example that's far more
likely to be an external IP address but for this particular
tutorial we'll just keep it that way. Ok so the next thing we need to do is specify the
local subnet and what this is saying is what local subnets will the other end of
the tunnel or the other location be able to access on this side. So I'm going to
click Add. Now I could add in a particular network, a particular IP if I
wanted to, but I've actually got a few that I've
created already. So I'm going to say okay any remote device, any remote UTM or
Sophos firewall or any other device that's it, that's connecting via this
site-to-site link will be able to access the HQ network, which is a network
locally connected to this device. So we're going to click Save to that. Now at
the same time I need to say what remote networks I'll be able to access when we
successfully establish a link to the remote site. So again I'm just going to
click Add New Item there and I've already got an object for the branch
office network, that's the network that's locally connected at my remote site that
I'm connecting to. So we're going to click Apply. Now the configuration does
require us to put a ID in for the VPN connection. This isn't really applicable
to pre-shared keys but I'm going to just put the IP address of the local device.
Just to make things simple, we'll do exactly the same remote network. Okay so
we've created our configuration there, that includes the fact that we're using
a certain type of authentication, a specific IPSec policy, we've specified
the type, and also the networks that we're going to have access to. Okay so
there we go. So I now have my IPSec connection saved in the list there but
the problem is is we need to configure the other side. Now as I was saying the
other side of the connection, the other device that you're connecting to in your
remote office, could be a Sophos firewall, could be a Sophos UTM, it could be a
third party device. As I was mentioning earlier we have a Sophos UTM, it's our
remote site, so I'm just going to quickly create my configuration there.
Now what we're doing on this side isn't really important because it would differ
from device to device, but the main thing that we need to remember is that we're
using the same policy and that we have the same network specified. Otherwise our
security associations are going to fail. Okay so we've got that done I'm gonna
click Save to that. Okay so finally on the Sophos UTM I'm just going to create
my connection. Now as I was saying earlier this process
will differ from device to device. If you're not using Sophos at all, your
remote site it might be a completely different configuration. But I'm just
going to create my connection here, that's gonna be called HQ, I'm going to
specify the remote gateway policy that I've just created. I'm also going to
specify the interface that these IPSec VPNs are going to take place on. So I'll
specify that in the in the list. Now another thing that I need to do is
specify the policy and as I was mentioning earlier this is really
important. The policy that you set or that you specify here needs to be
identical to what we are using on the other side. So you saw that we went
through the process earlier at making sure that each policy has the same
Diffie-Hellman group, the same algorithms, the same hashing methods. So you just
need to make sure you select the correct policy there. We also need to specify the
local networks that HQ are going to be able to access on this site once this
tunnel is successfully established. Okay so I'm just going to click Save to that.
And that is now enabled. So we've had a look at both sides, we firstly configured
our Sophos firewall, we've then configured our Sophos UTM, so all that
should remain here is I need to activate the IPSec tunnel on the left-hand side.
So I'm activating this policy, I then need to initiate the connection and
click OK. Now you can see we've got two green lights there which means that that
IPSec connection should be successfully established. And if I just jump onto the
UTM for confirmation of that. We can see that our security association is
successfully established there between our Sophos firewall and our Sophos UTM.
So that shows how you can create a simple site-to-site VPN link between the
Sophos firewall and the Sophos UTM. In subsequent tutorial videos we'll have a
look at how we can perform the same process but using different
authentication mechanisms, such as X-509 certificates. Many thanks for watching.
In this demonstration we ensured that the IPSec profile configuration matches on
both sides of the tunnel, and we also created IPSec connection policies on
both sides in order to successfully create our IPSec VPN.