Creating an L2TP Roadwarrior Connection

Typically, you create a separate connection for each roadwarrior on your network.

To create an external L2TP roadwarrior connection, do the following:

1.

Create a certificate for each roadwarrior user — Managing Certificates . Typically, the certificate includes the user’s email address as the ID type.

2.

If preshared key authentication is required for this VPN, go to Network > VPN > Global, else skip to step 5.

3.

From the IPSec Road Warrior (and L2TP) Preshared Key panel, configure the following:

•

Preshared Key — Enter the key required for authentication.

•

Again — Re-enter the preshared key. Do not copy and paste from the previous field.

4.

Click Save.

5.

Go to Network > VPN > Global.

6.

Scroll down to the L2TP and SSL VPN client configuration settings panel.

7.

Configure the following:

•

Primary DNS — Configure the primary DNS gateway for all connected L2TP roadwarriors to use.

•

Secondary DNS — Configure the secondary DNS gateway for all connected L2TP roadwarriors to use.

•

Primary WINS — If required, configure the primary Windows Internet Name Service (WINS) for all connected L2TP roadwarriors to use.

•

Secondary WINS — If required, configure the secondary WINS for all connected L2TP roadwarriors to use.

8.

Scroll down to the L2TP settings panel.

9.

Configure the following:

•

L2TP client internal interface — From the drop-down list, select the internal network interface that all L2TP roadwarriors are connected to.

10.

Click Save.

11.

Go to Network > VPN > L2TP roadwarriors.

12.

Configure the following:

•

Name — Configure a meaningful name for this roadwarrior connection.

•

Enabled — New connections are enabled by default. Clear the check box to create a disabled connection.

•

Local IP — From the drop-down list, select the local IP address that the tunnel connects to. Typically, this is one of your external IP addresses, though it is possible to select a Basic interface to create an internal tunnel.

•

Client IP — Enter a valid client IP address for this roadwarrior tunnel.

•

Username — Enter the username required for access to this roadwarrior tunnel.

•

Password — Enter the password required for access to this roadwarrior tunnel.

•

Again — Re-enter the password. Do not copy and paste it from Password.

•

Authenticate by — From the drop-down list, select the authentication method:

Authentication Method	Description
Certificate presented by peer	Use a certificate created by a different Certificate Authority. Authenticating by a named certificate is recommended for easier management.
Preshared key	Use the global preshared key defined in step 3.

•

L2TP client OS — From the drop-down list, select the L2TP client’s operating system. Valid values are: Microsoft, Android or iOS.

•

Comment — Configure an optional comment for this VPN.

13.

Click Advanced.

14.

Configure the following:

•

Local certificate — If non-standard X509 authentication is used for this VPN, choose the local certificate from the drop-down list. For more information, see Using Multiple Local Certificates .

15.

Click Add.

An internal VPN capability can be useful in many situations, a few examples of typical scenarios are given below:



Secure wireless access – Commonly used wireless access protocols offer relatively weak levels of security, thus allowing potential intruders to directly access and intercept confidential data on an organization’s internal network. The Smoothwall can ensure secure wireless access by providing an additional interface as an internal VPN gateway. By attaching a wireless access point to this interface, wireless clients can connect and create a secure tunnel to the desired internal network. Without the necessary authentication credentials (a certificate), wireless intruders cannot gain access to any network resource.



Hidden network access – It is possible to create a hidden network that can only be accessed via a secure VPN tunnel. This might be useful to guarantee that certain resources can only be accessed by an exclusively authenticated member of staff. To do this, create a network that is not bridged to any other. Nominate an internal interface as a VPN gateway and set the client internal interface to the hidden network.

There is no complicated configuration process for creating such internal VPNs, the facility is provided by globally nominating an internal VPN interface and creating tunnels specifying it as its interface.

To create an internal L2TP VPN connection:

1.

Go to the Network > VPN > Global page.

2.

In the L2TP settings area, from the L2TP client internal interface drop-down list, choose an internal network interface.

3.

For further VPN settings, optionally, click Advanced at the bottom of the page.

4.

From the Advanced panel, configure the following:

•

Enable NAT-Traversal — NAT-T is enabled by default and allows IPSec clients to connect from behind NAT-ing devices.

In some advanced and unusual situations, however, this feature may prevent connections, therefore, NAT-T can be disabled.

•

Enable Dead Peer Detection — Used to activate a keep-alive mechanism on tunnels that support it.

This setting, commonly abbreviated to DPD, allows the VPN system to almost instantly detect the failure of a tunnel and have it marked as Closed in the control page.

If this feature is not used, it can take any time up to the re-keying interval (typically 20 minutes) to detect that a tunnel has failed. Since not all IPSec implementations support this feature, it is not enabled by default.

In setups consisting exclusively of Smoothwall VPN gateways, it is recommended that this feature is enabled.

•

Copy TOS (Type Of Service) bits in and out of tunnels — When selected, TOS bits are copied into the tunnel from the outside as VPN traffic is received, and conversely in the other direction. This makes it possible to treat the TOS bits of traffic inside the network (such as IP phones) in traffic shaping rules within Traffic and traffic shape them.

If this option is not selected, the TOS bits are hidden inside the encrypted tunnel and it is not possible to traffic shape VPN traffic.

Note that there is a theoretical possibility that enabling this setting can be used to spy on traffic

5.

Click Save.

6.

Create a certificate for the L2TP client — see Managing Certificates .

7.

Go to Network > VPN > L2TP roadwarriors.

8.

From the Create new tunnel panel, configure the following:

•

Name — Configure a meaningful name for this tunnel.

•

Enabled — New tunnels are enabled by default. Clear the check box to create a disabled tunnel.

•

Local IP — Select the external IP address to use for this tunnel.

•

Client IP — Enter a client IP address for this connection. The IP address must be a valid and available IP on the globally specified internal network.

•

Username — Enter a username for this connection.

•

Password — Enter a password for the connection.

•

Again — Re-enter the password to confirm it.

•

Authenticate by — To dedicate this connection to a specific user, choose the user’s certificate from the drop-down list.

To allow any valid certificate holder to use this tunnel, choose Certificate presented by peer.

If your organization anticipates supporting many roadwarrior connections, authenticating by a specific certificate is recommended for ease of management.

•

L2TP client OS — From the drop-down list, select the L2TP client's operating system.

•

Comment — Enter an optional description of the tunnel.

9.

Click Advanced and, from the Local certificate drop-down list, select Default.

10.

Click Add. The Smoothwall lists the tunnel in the Current tunnels area.

To configure client access to the L2TP tunnel, see Using the Smoothwall L2TP Client .

To connect to an L2TP tunnel, a roadwarrior must be using a Microsoft operating system which is covered by the Microsoft support lifecycle.

The first step in the connection process is to run the L2TP Client Wizard. You can download it from here. It is a freely distributable application that automates much of the configuration process.

Note: There is an alternative configuration method that uses a command line tool, thus enabling an L2TP connection to be configured as part of a logon script. For details, see Example VPN Configurations.

To install the L2TP client:

1.

Run the L2TP Client Wizard on the roadwarrior system.

2.

View the license and click Next to agree to it.

3.

Click Browse and open the Certificate Authority certificate file as exported during the certificate creation process. Click Next.

4.

Click Go to locate and select the roadwarrior's host certificate file. This must be a PKCS#12 file, typically saved as *.p12, as exported during the certificate creation process. Enter the password and click Next.

5.

Ensure that the Launch New Connection Wizard option is selected and click Install.

6.

The wizard install the certificates. Click Finish. The Microsoft New Connection Wizard is launched.

7.

Click Next.

8.

Select Connect to the network at my workplace and click Next.

9.

Select Virtual Private Network connection and click Next.

10.

Enter a name for the connection and click Next.

11.

Enter the Smoothwall’s host name or IP address and click Next.

12.

Click Finish.

13.

In the Connect window, enter the username and password of the roadwarrior and click Connect. Ensure that the tunnel is enabled.

Note: Certain anti-malware and worm detection software may generate alerts when L2TP client connections are first established. Only UDP port 500, UDP port 4500, and ESP should flow from the roadwarrior when using a Smoothwall L2TP over an IPSEC connection. Any alerts concerning this kind of traffic can be safely ignored, and unblocked communication permitted.