and on the client, as described previously. It also assumes that the RADIUS server used for
authentication is also correctly configured.
Note that the authentication rule in this example uses all-nets and any as its traffic filtering
parameters. In practice, it would better to narrow these properties.
Command-Line Interface
A. Create a config mode IP pool for client IPs:
gw-world:/> add ConfigModePool
IPPoolType=Static
IPPoolAddress=192.168.189.30-192.168.189.50
IPPoolNetmask=255.255.255.0
DNS=192.168.28.4
B. Configure the IPsec tunnel:
gw-world:/> add Interface IPsecTunnel my_ikev2_client_tunnel
LocalNetwork=lannet
RemoteNetwork=all-nets
AuthMethod=Certificate
GatewayCertificate=my_host_cert
RootCertificates=my_root_cert
AddRouteToRemoteNet=Yes
AutoInterfaceNetworkRoute=No
IKEVersion=2
RemoteEndpoint=all-nets
EAP=Yes
RequestEAPID=Yes
IKEConfigModePool=ConfigModePool
C. Configure the RADIUS server for authentication:
gw-world:/> add RadiusServer my_radius_server
IPAddress=203.0.113.20
SharedSecret=MYSHAREDRADIUSSECRETSTRING
D. Configure the authentication rule for the tunnel:
gw-world:/> add UserAuthRule
Agent=EAP
AuthSource=RADIUS
Interface=any
Name=my_ikev2_auth_rule
OriginatorIP=all-nets
RadiusServers=my_radius_server
Web Interface
A. Create a config mode IP pool for client IPs:
1. Go to: Objects > IKE Config Mode Pool > Add >
2. Enable the Use a Static IP pool option
3. Now enter:
Chapter 9: VPN
717
To Next Page
Loading...
