Route Based VPN

A policy-based approach forces the VPN policy configuration to include the network topology configuration. This makes it difficult to configure and maintain the VPN policy with a constantly changing network topology.

With the Route Based VPN approach, network topology configuration is removed from the VPN policy configuration. The VPN policy configuration creates a Tunnel Interface between two end points. Static or Dynamic routes can then be added to the Tunnel Interface. The Route Based VPN approach moves network configuration from the VPN policy configuration to Static or Dynamic Route configuration.

Not only does Route Based VPN make configuring and maintaining the VPN policy easier, a major advantage of the Route Based VPN feature is that it provides flexibility on how traffic is routed. With this feature, users can now define multiple paths for overlapping networks over a clear or redundant VPN.

Topics:
•
Using Route Based VPN
•
Route Entries for Different Network Segments

Using Route Based VPN

Route Based VPN configuration is a two-step process. The first step involves creating a Tunnel Interface. The crypto suites used to secure the traffic between two end-points are defined in the Tunnel Interface. The second step involves creating a static or dynamic route using Tunnel Interface.

The Tunnel Interface is created when a Policy of type Tunnel Interface is added for the remote gateway. The Tunnel Interface must be bound to a physical interface and the IP address of that physical interface is used as the source address of the tunneled packet.

Topics:
•
Adding a Tunnel Interface
•
Creating a Static Route for Tunnel Interface
Adding a Tunnel Interface
To add a Tunnel Interface:
1
Navigate to VPN>Settings>VPN Policies.
2
Click the Add button. The VPN Policy dialog displays.

3
On the General tab, select the policy type as Tunnel Interface. The Network tab is removed.
4
Next, click the Proposals tab.

5
Configure the IKE (Phase 1) Proposal and IPSec (Phase 2) Proposal options for the tunnel negotiation.
6
Click the Advanced tab to configure the advanced properties for the Tunnel Interface. By default, Enable Keep Alive is enabled. This is to establish the tunnel with remote gateway proactively.

7
The following other advanced options can be configured:
•
Disable IPsec Anti-Replay - Disables anti-replay, which is a form of partial sequence integrity that detects the arrival of duplicate IP datagrams (within a constrained window).
•
Allow Advanced Routing - Adds this Tunnel Interface to the list of interfaces in the Advanced Routing table on the Network > Routing page.

Making this an optional setting avoids adding all Tunnel Interfaces to the Advanced Routing table, which helps streamline the routing configuration. See Configuring Advanced Routing for Tunnel Interfaces for information on configuring RIP or OSPF advanced routing for the Tunnel Interface.

•
Enable Transport Mode - Forces the IPsec negotiation to use Transport mode instead of Tunnel Mode. This has been introduced for compatibility with Nortel. When this option is enabled on the local firewall, it MUST be enabled on the remote firewall as well for the negotiation to succeed.
•
Enable Windows Networking (NetBIOS) Broadcast - Allows access to remote network resources by browsing the Windows® Network Neighborhood.
•
Enable Multicast - Allows multicast traffic through the VPN tunnel.
•
Permit Acceleration - Enables redirection of traffic matching this policy to the WAN Acceleration (WXA) appliance
•
Management via this SA - Allows remote users to log in to manage the firewall through the VPN tunnel. Select one or more: HTTPS, SSH, SNMP.
•
User login via this SA - Allows users to login using the SA. Select either or both: HTTP or HTTPS.
* 
NOTE: HTTP user login is not allowed with remote authentication.
•
VPN Policy bound to - Sets the interface the Tunnel Interface is bound to. This is Interface X1 by default.
8
If IKEv2 Mode was selected on the Proposals tab, configure the IKEv2 Settings:
•
The Do not send trigger packet during IKE SA negotiation checkbox is not selected by default and should be selected only when required for interoperability if the peer cannot handle trigger packets.

The term Trigger Packet refers to the use of initial Traffic Selector payloads populated with the IP addresses from the packet that caused SA negotiation to begin. It is recommended practice to include Trigger Packets to assist the IKEv2 Responder in selecting the correct protected IP address ranges from its Security Policy Database. Not all implementations support this feature, so it may be appropriate to disable the inclusion of Trigger Packets to some IKE peers.

•
Select one or both of the following two options for the IKEv2 VPN policy:
•
Accept Hash & URL Certificate Type – The firewall sends an HTTP_CERT_LOOKUP_SUPPORTED message to the peer device. If the peer device replies by sending a “Hash and URL of X.509c” certificate, the firewall can authenticate and establish a tunnel between the two devices.
•
Send Hash & URL Certificate Type – The firewall, on receiving an HTTP_CERT_LOOKUP_SUPPORTED message, sends a "Hash and URL of X.509c” certificate to the requestor.

Select these options if your devices can send and process hash and certificate URLs instead of the certificates themselves. Using these options reduces the size of the messages exchanged.

In a VPN, two peer firewalls (FW1 and FW2) negotiate a tunnel. From the perspective of FW1, FW2 is the remote gateway and vice versa.

9
Click OK.
Creating a Static Route for Tunnel Interface

After you have successfully added a Tunnel Interface, you may then create a Static Route.

To create a Static Route for a Tunnel Interface:
1
Navigate to Network>Routing>Route Policies.
2
Click the Add button. The Add Route Policy dialogue appears for adding Static Route.
3
Select a tunnel interface from the Interface drop-down menu, which lists all available tunnel interfaces.
* 
NOTE: If the Auto-add Access Rule option is selected, firewall rules are automatically added and traffic is allowed between the configured networks using tunnel interface.
4
Configure the rest of the settings as necessary.
5
Click OK.

Route Entries for Different Network Segments

After a tunnel interface is created, multiple route entries can be configured to use the same tunnel interface for different networks. This provides a mechanism to modify the network topology without making any changes to the tunnel interface.