in this video we are going to show you how to create a site-to-site VPN tunnel
between two locations using the VPN wizard. so we're first going to navigate
to configure VPN on the head office XG appliance. We'll now navigate to IPSec
connection wizard. We'll give this VPN connection a name and a description. Now
we're going to pick what type of VPN connection we're going to establish.
You'll notice here that we have a couple of different options. we're going to
select site-to-site. And we're simply going to select what policy out of the
predefined policy list we're going to choose. Since this is our main location
we're going to select a default head office. And then the action, we'll set this
to respond-only as we're gonna have the branch VPN office be the office that's
going to establish the VPN connection. We're now taken to an area where we'll
be able to define the type of authentication we're going to use. So
you'll notice here that we have three different options:
Pre-shared key, digital certificate, or an RSA key. For today's demonstration we'll
leverage a pre-shared key. Now we're going to be asked to define details on
the local network. So here I'm going to pick the local WAN port, in this case
it's my eth1 port. And now I'm going to define my local subnet. So
you'll see here that I have a predefined object corresponding to my 192.168.168.0
subnet. so we'll select that and for local ID we'll
go ahead and define this as an email.
We're now going to define the remote WAN IP address that we're going to be
connecting to for a VPN tunnel. So I'm going to type in the IP address of the
remote site that we're connecting to. I'm also going to define the subnet on that
site. In this case I have an address object already set up, but if you do want
to create a new subnet object you can come in and do that under this create
function. My remote ID is going to be an email address. We'll hit Next.
We'll leave the authentication mode for XAuth as disabled. We get a nice IPSec
summary and now we hit Finish. And you'll see here that the site-to-site
connection parameters have been established. At this point we'll want to
create firewall rules to allow inbound and outbound VPN traffic to flow. So I'm
going to go ahead and create two firewall rules under the protect
firewall area of Sophos Firewall LS, and the first rule is going to be called
inbound VPN. so inbound VPN will have a source of our VPN zone and a destination
of any trusted zone behind your firewall. In this case I'm going to select my LAN.
Now keep in mind if you wanted to get a little bit more specific you can tweak
your address objects so I'm simply going to define my VPN zone as the site B
subnet object that I have. And my destination is going to be my internal
LAN subnet. I'm going to disable an identity based rule by unchecking match
known users and we're going to enable logged
firewall traffic for troubleshooting purposes. I'm now also going to create an
outline rule. My source zone is going to be my LAN.
Once again I will define my network address object as being my internal
subnet, my destination is going to be my VPN zone. And once again I'll do the
exact same thing on the address object side. I'll define my remote subnet. We'll
uncheck match known users again, enable log firewall traffic, and hit Save. So now
we're going to navigate to the remote location and we're going to do the exact
same thing by first creating the VPN connection policy. Instead of using the
wizard this time I'm going to go ahead and manually add a VPN connection. So
we'll call this connection Chicago the connection type is going to be
site-to-site. Since this is our branch office we're going to select for policy,
default branch office. And we're going to have this particular office initiate the
VPN connection. So once again I have my choice of authentication type. In this
case we're using a pre-shared key. This pre-shared key has to match what is on
the other side, so we'll go ahead and enter that in. My local subnet here is
going to be .189 LAN IP address. And then I'll simply define the remote
LAN IP address of the office I'm connecting to.
I'll now define my local subnet here.
My local ID is going to be my email address, my remote LAN network is going
to be the other side of the tunnel, in this case Chicago. And then my remote ID
is going to be the email address that we specified at the other location. So now
we'll hit Save, and under IPSec connections you'll notice that the status will be
red. If we click on activate the connection the tunnel should come up.
Although you'll notice here that the connection will still remain red.
in order to complete this site-to-site VPN we'll have to create two access
rules under firewall protect for the remote location. An inbound rule as well
as an outbound rule. So for my Source Zone for inbound
we'll use the VPN zone. We'll also tie the Chicago subnet object to the VPN
zone, and then we'll also define my destination as my trusted interface, or
in this case my LAN interface. The remote subnet is going to be the object I
created for the LAN interface. We'll uncheck match known users, click on Log
Firewall Traffic, and hit Save. We will also create an outbound VPN policy by
defining my source as LAN.
My network object which will correspond to the LAN interface that's present
behind this firewall, destination will be the VPN zone, and finally my object will
correspond to that remote subnet. We'll uncheck match known users. We will also
enable Log Firewall Traffic for troubleshooting purposes, and hit Save.
Now as we navigate back to configure VPN.
We'll click on the RED connection button. At this point the VPN connection is
established.