FireBrick Road Warrior FireBrick Config: Difference between revisions

← Older edit

FireBrick Road Warrior FireBrick Config (view source)

Revision as of 07:49, 28 July 2023

297 bytes added , 28 July 2023

no edit summary

AA-James

autoreview, Bots, Bureaucrats, editor, Interface administrators, reviewer, Administrators, upwizcampeditors

39

edits

Revision as of 19:51, 15 March 2017 (view source) Reedy (talk \| contribs) (→‎Configuration: eap near top) ← Older edit		Latest revision as of 07:49, 28 July 2023 (view source) AA-James (talk \| contribs) No edit summary
(5 intermediate revisions by 2 users not shown)
'''Think about the NAT''' A problem arises however when the LAN subnet is non-routable (RFC1918 IPs, e.g. ~~1923~~192.168.x.x). In this case the LAN subnet is usually marked NAT in the FB config, so LAN devices can communicate externally (obviously for outgoing ==Overview== In this example we are assuming you can allocate some IP addresses on ~~you~~your LAN. You do this by picking a range of addresses and setting up a roaming-pool (see below). You need to ensure the IP range does not clash with devices on the LAN and is not in the DHCP ranges that could allocate to the LAN. The FireBrick needs a configuration for the connection, and roaming pools and user identities. The connection can be used for any number of devices at once with the same pool of IP addresses; each would have a user name and password defined. <syntaxhighlight lang=xml> <ipsec-ike force-NAT="0.0.0.0/0"> <connection name="server" roaming-pool="roam-pool" auth-method="Certificate" peer-auth-method="EAP" mode="Wait" local-ID="FQDN:server.example.com"/> <roaming name="roam-pool" ip="[ranges of LAN IPs, inc IPv6]" DNS="[DNS, e.g. 8.8.8.8]"/> </ipsec-ike> </syntaxhighlight> Note: the <tt>force-NAT="0.0.0.0/0"</tt> forces keep-alives which are needed when NAT is involved between the endpoints but and also helps where stateful firewalls are in the route too. (without this set, you may find that the ipsec tunnel drops every hour or so) Each roaming user then needs an <tt>eap</tt> user record. This goes with any user entries near the top of the config.