FireBrick Road Warrior Windows 7

Windows setup

The following instructions were tested on a Windows 7 system. Setup on other versions of Windows will be similar, but the dialogs and messages seen may not be exactly as shown here.

The CA certificate needs to be installed on the Windows machine using an account with administrator privileges.

First, download the CA certificate in DER format to the Windows machine. The easiest way to do this is to use a browser to visit your FireBrick certificate management page, and click on the Download DER link corresponding to the CA certificate. Save it in a suitable location on the Windows machine. Do not attempt to execute it or install it just yet. Note that you must download the certificate in DER format - windows machines do not recognize PEM format. The file will be given the .crt extension.

Start the Windows Certificate Manager

The Windows certificate manager should now be started up as follows:

1. Using a command window, or the Start|Run box, execute the command mmc (and answer Yes when asked if you want to allow changes).
2. Select Add/Remove Snap-in from the File menu, choose the Certificates snap-in and add it to selected snap-ins.
3. A dialog will ask if you want to manage certificates for the user account, a service account or computer account. You must select Computer Account here in order to manage the system certificates. If you do not select this, or you start up the certificate manager in some other way (eg using certmgr.msc, you will not be able to install the certificate system-wide, and the Windows IPsec subsystem will not find it.
4. Another dialog will ask which computer to manage. Choose Local computer.
5. Finally click on OK to start the certificate manger snap-in.

Install the CA certificate

To install the certificate:

1. Double-click on Certificates (Local Computer) in the left pane, to open the certificate store names, and then right-click on Trusted Root Certification Authorities in the centre pane.
2. Select All Tasks and then Import...
3. Click Next and browse to where you saved the CA .crt file.
4. Click Next and check that the certificate will be placed in the trusted root store.
5. Click Next again, and then Finish.

There - wasn't that easy! Thank you Microsoft.

Set up the VPN Network Connection

Now you need to set up the IPsec network connection details.

1. Go to Control Panel and select Set up a new connection or network.
2. Select Connect to a Network and choose Connect to a Workplace.
3. Click Next, select No, create a new connecton, Next
4. Choose Use my Internet connection
5. Insert the server name (eg server.example.com), and choose whatever you like to name the connection (Destination name).
6. Select Don't connect now; ...
7. You don't need to enter User name and password as it will ask again later
8. Click on Create and then Close (Don't connect yet!)
9. Back at the Network and Sharing Center dialog, select Connect to a network
10. Right-click the connection you have just created in the pop-up box and select Properties
11. Select the Security tab, and change the Type of VPN to IKEv2.
12. EAP-MSCHAPv2 should already be selected.
13. Click OK

You should now be ready to connect - select Connect to a network again, click on the connection and choose Connect. If not already saved, you'll use the username and password as set up in the EAP Identity on the FireBrick (in this example, we had set up a user of fred with a password)

You probably want to change the type of network to Work Network after the connection establishes.

Windows 10

1. Download DER format
2. Click on the file, you may get a Warning (see screenshot)
3. The 'Welcome to the Certificate Import Wizard' screen opens, select Local Machine, then Next (see screenshot)
4. You will be prompted to enter in the Administrator password of the computer, do this.
5. Select ' Place all certificates in the following store' (see screenshot)
6. Click Browse
7. Select 'Trusted Root Certification Authorities', click OK. (see screenshot)
8. You'll now be back at the screen you were on previously, Click Next (see screenshot)
9. The 'Completing the Certificate Import Wizard' screen shows, Click Finish (see screenshot)
10. A little window pops up saying 'The import was successful' (see screenshot)