Category Archives: IPsec/VPN

Details about IPsec VPNs between different firewalls, etc.

FortiGate VPN Speedtests

2016-03-15Bandwidth/Delay, Fortinet, IPsec/VPNBandwidth, FortiGate, Fortinet, iperf, Knoppix, Site-to-Site VPN, ThroughputJohannes Weber

Triggered by a customer who had problems getting enough speed through an IPsec site-to-site VPN tunnel between FortiGate firewalls I decided to test different encryption/hashing algorithms to verify the network throughput. I used two FortiWiFi 90D firewalls that have an official IPsec VPN throughput of 1 Gbps. Using iperf I measured the transfer rates with no VPN tunnel as well as with different IPsec proposals.

I first ran into really slow performances which were related to the default “Software Switch” on the FortiGate. After deleting this type of logical switch, the VPN throughput was almost as expected.

Continue reading FortiGate VPN Speedtests →

Where to terminate Site-to-Site VPN Tunnels?

2016-01-20Design/Policy, IPsec/VPNBest Practice, Cisco ASA, FortiGate, Juniper ScreenOS, Multilayer Firewall, Next-Generation Firewall, Palo Alto Networks, Site-to-Site VPNJohannes Weber

When using a multilayer firewall design it is not directly clear on which of these firewalls remote site-to-site VPNs should terminate. What must be considered in such scenarios? Differentiate between partners and own remote offices? Or between static and dynamic peer IPs? What about the default routes on the remote sites?

Following is a discussion about different approaches and some best practices. Since not all concepts work with all firewall vendors, the following strategies are separated by common firewalls, i.e., Cisco ASA, Fortinet FortiGate, Juniper ScreenOS, Palo Alto.

Continue reading Where to terminate Site-to-Site VPN Tunnels? →

Cisco ASA Remote Access VPN for Android

2015-11-10Android, Cisco ASA, IPsec/VPNAndroid, Cisco ASA, IPsec, Remote Access VPNJohannes Weber

The native Android IPsec VPN client supports connections to the Cisco ASA firewall. This even works without the “AnyConnect for Mobile” license on the ASA. If only a basic remote access VPN connection is needed, this fits perfectly. It uses the classical IPsec protocol instead of the newer SSL version. However, the VPN tunnel works anyway.

In this short post I am showing the configuration steps on the ASA and on the Android phone in order to establish a remote access VPN tunnel.

Continue reading Cisco ASA Remote Access VPN for Android →

Palo Alto Remote Access VPN for Android

2015-11-03Android, IPsec/VPN, Palo Alto NetworksAndroid, GlobalProtect, IPsec, Palo Alto Networks, Remote Access VPNJohannes Weber

For a basic remote access VPN connection to a Palo Alto Networks firewall (called “GlobalProtect”), the built-in VPN feature from Android can be used instead of the GlobalProtect app from Palo Alto itself. If the additional features such as HIP profiling are not needed, this variant fits perfectly.

I am showing a few screenshots and logs from the Android smartphone as well as from the Palo Alto to show the differences.

Continue reading Palo Alto Remote Access VPN for Android →

IPsec Site-to-Site VPN FortiGate <-> FRITZ!Box

2015-07-17Fortinet, FRITZ!Box, IPsec/VPNDyn DNS, FortiGate, Fortinet, FRITZ!Box, IPsec, Site-to-Site VPNJohannes Weber

Hier kommt ein kurzer Guide wie man ein Site-to-Site VPN zwischen einer FortiGate Firewall und einer AVM FRITZ!Box aufbaut. Anhand von Screenshots zeige ich die Einrichtung der FortiGate, während ich für die FRITZ!Box ein Template der *.cfg Konfigurationsdatei bereitstelle.

Continue reading IPsec Site-to-Site VPN FortiGate <-> FRITZ!Box →

IPv6 through IPv4 VPN Tunnel with Juniper SSGs

2015-04-28IPsec/VPN, IPv6, Juniper Networks, Routing6in4, IPsec, IPv6, Juniper ScreenOS, Juniper SSG, Site-to-Site VPN, Transition MethodJohannes Weber

The most common transition method for IPv6 (that is: how to enable IPv6 on a network that does not have a native IPv6 connection to the Internet) is a “6in4” tunnel. Even other tunneling methods such as Teredo or SixXS are found on different literatures. However, another method that is not often explained is to tunnel the IPv6 packets through a VPN connection. For example, if the main office has a native IPv6 connection to the Internet, as well as VPN connections to its remote offices, it is easy to bring IPv6 subnets to these stations.

Here is how I did it with some Juniper SSG firewalls:

Continue reading IPv6 through IPv4 VPN Tunnel with Juniper SSGs →

FRITZ!OS ab 06.23: IPsec P2 Proposals erweitert

2015-03-11FRITZ!Box, IPsec/VPN, TemplateDiffie-Hellman, FRITZ!Box, FRITZ!OS, IPsec, PFS, Site-to-Site VPNJohannes Weber

Es geht in eine weitere Runde bei den VPNs von und zur FRITZ!Box. Nach den unglücklichen Änderungen in Version 06.20 hat AVM wieder ein paar Phase 2 Proposals hinzugenommen, die komplett ohne Kompression laufen. Somit ist es wieder möglich, die FRITZ!Box im Aggressive Mode VPN-Verbindungen zu diversen Firewalls aufbauen zu lassen. Komisch nur, dass noch nicht alles ganz wie erwartet funktioniert. Hier kommen meine Testergebnisse.

Continue reading FRITZ!OS ab 06.23: IPsec P2 Proposals erweitert →

Site-to-Site VPNs with Diffie-Hellman Groups 19 & 20 (Elliptic Curve)

2015-02-13Crypto, Fortinet, IPsec/VPN, Juniper NetworksBits of Security, Brute-Force, Diffie-Hellman, ECC, Elliptic Curve Cryptography, FortiGate, Fortinet, IKE, IPsec, Juniper ScreenOS, Perfect Forward Secrecy, PFS, Site-to-Site VPNJohannes Weber

Similar to my test with Diffie-Hellman group 14 shown here I tested a VPN connection with elliptic curve Diffie-Hellman groups 19 and 20. The considerations why to use these DH groups are listed in the just mentioned post – mainly because of the higher security level they offer. I tested the site-to-site IPsec connections with a Juniper ScreenOS firewall and a Fortinet FortiGate firewall. (Currently, neither Palo Alto Networks nor Cisco ASA support these groups.)

Continue reading Site-to-Site VPNs with Diffie-Hellman Groups 19 & 20 (Elliptic Curve) →

IPsec Site-to-Site VPN FortiGate <-> Cisco ASA

2015-02-05Cisco ASA, Fortinet, IPsec/VPNCisco ASA, FortiGate, Fortinet, IPsec, Site-to-Site VPNJohannes Weber

Following is a step-by-step tutorial for a site-to-site VPN between a Fortinet FortiGate and a Cisco ASA firewall. I am showing the screenshots of the GUIs in order to configure the VPN, as well as some CLI show commands.

Continue reading IPsec Site-to-Site VPN FortiGate <-> Cisco ASA →

IPsec Site-to-Site VPN FortiGate <-> Cisco Router

2015-02-02Cisco Systems, Fortinet, IPsec/VPNCisco Router, FortiGate, Fortinet, IPsec, Site-to-Site VPNJohannes Weber

This blog post shows how to configure a site-to-site IPsec VPN between a FortiGate firewall and a Cisco router. The FortiGate is configured via the GUI – the router via the CLI. I am showing the screenshots/listings as well as a few troubleshooting commands.

Continue reading IPsec Site-to-Site VPN FortiGate <-> Cisco Router →

IPsec Site-to-Site VPN FortiGate <-> Juniper SSG

2015-01-28Fortinet, IPsec/VPN, Juniper NetworksFortiGate, Fortinet, IPsec, Juniper ScreenOS, Juniper SSGJohannes Weber

Here comes the step-by-step guide for building a site-to-site VPN between a FortiGate and a ScreenOS firewall. Not much to say. I am publishing several screenshots and CLI listings of both firewalls, along with an overview of my laboratory.

Continue reading IPsec Site-to-Site VPN FortiGate <-> Juniper SSG →

IPsec Site-to-Site VPN Palo Alto <-> FortiGate

2015-01-26Fortinet, IPsec/VPN, Palo Alto NetworksFortiGate, Fortinet, IPsec, Palo Alto Networks, Site-to-Site VPNJohannes Weber

This is a small tutorial for configuring a site-to-site IPsec VPN between a Palo Alto and a FortiGate firewall. I am publishing step-by-step screenshots for both firewalls as well as a few troubleshooting CLI commands.

Continue reading IPsec Site-to-Site VPN Palo Alto <-> FortiGate →

Considerations about IPsec Pre-Shared Keys

2015-01-19Authentication, Crypto, IPsec/VPNBrute-Force, IKE, IPsec, Man-in-the-Middle, Pre-Shared Key, PSK, Site-to-Site VPN, VPNJohannes Weber

Pre-shared keys (PSK) are the most common authentication method for site-to-site IPsec VPN tunnels. So what’s to say about the security of PSKs? What is its role for the network security? How complex should PSKs be? Should they be stored additionally? What happens if an attacker catches my PSKs?

I am listing my best practice steps for generating PSKs.

Continue reading Considerations about IPsec Pre-Shared Keys →

Pulse Connect Secure: Easy Deployment Poster

2014-11-28At a Glance, IPsec/VPN, Juniper Networks, Pulse SecureJuniper MAG, Juniper SA, Junos Pulse Secure Access Service, Pulse Connect Secure, Remote Access VPN, SSL-VPN, VPN Portal, Web VPNJohannes Weber

For a beginner, the configuration of a J~~uniper Secure Access SA/MAG~~ Pulse Connect Secure device is not that simple. There are too many options and links that must be filled in. Though there are quite detailed configuration guides I was missing a “quick start” figure to see which profiles, roles, etc. must be set in order to have a simple login and group membership environment.

Here comes my at-a-glance poster for the Pulse Connect Secure SSL-VPN gateway.

Continue reading Pulse Connect Secure: Easy Deployment Poster →

FRITZ!OS ab 06.20: Änderungen bei VPNs

2014-11-25FRITZ!Box, IPsec/VPNDiffie-Hellman, FRITZ!Box, FRITZ!OS, Perfect Forward Secrecy, PFS, Site-to-Site VPNJohannes Weber

In den Release Notes der neuesten AVM FRITZ!Box Version FRITZ!OS 06.20 stand unter anderem: “VPN-Verbindungen unterstützen jetzt zusätzliche Diffie-Hellman-Gruppen 5, 14 und 15”. Coole Sache, ist doch die Sicherheit bei der Perfect Forward Secrecy mit DH-14 deutlich höher und der heutigen Zeit angemessen. Also habe ich das bei einem meiner VPNs direkt mal eingerichtet und entsprechend getestet. Leider hat sich aber mit der neuen Version die Kompatibilität zu diversen Firewalls/VPN-Gateways deutlich verschlechtert. Es ist also nicht nur Gewinn, die Version 06.20 am laufen zu haben.

Continue reading FRITZ!OS ab 06.20: Änderungen bei VPNs →

Weberblog.net

IT-Security, Networks, IPv6, VPN, DNSSEC, NTP