Configuring a Virtual Private Network | Perle Systems STS, SCS

Configuring a Virtual Private Network

Configuring a Virtual Private Network

You can configure the IOLAN to act as a Virtual Private Network (VPN) gateway using the IPsec protocol. Any of the following scenarios can be configured using one IOLAN and a host/server running IPsec software or two IOLANs, each acting as the VPN gateway. All the examples have NAT Traversal (NAT_T) enabled, since both VPN gateways are running through routers.

IOLAN-to-Host/Network

The following example shows how to configure an IPsec tunnel between serial devices connected to the IOLAN and a host/network. NAT Traversal (NAT_T) is enabled in this example (on both sides) because the VPN tunnel is going private network to public network to private network. This example uses an RSA signature for the authentication method, so the steps required to configure the authentication are in this example.

Unencrypted

Data

							External IP Address				External IP Address						Right
							196.15.23.56				199.24.23.88

																Remote VPN


								Router					Router				Gateway





										Internet



													192.168.45.99
								172.16.45.99
	172.16.45.1							172.16.45.99
			Left
								IPsec Tunnel--Encrypted Data									192.168.45.45
								IPsec Tunnel--Encrypted Data									Unencrypted
																	Unencrypted
																		Data



											192.168.45.87
											192.168.45.87								192.168.45.12

1.Configure the IPsec tunnel in the IOLAN:

328	IOLAN Device Server User’s Guide, Version 3.6

Image 328

Perle Systems STS, SCS manual Configuring a Virtual Private Network, IOLAN-to-Host/Network

Contents

Iolan SDS/SCS/STS EN 55022 1998, Class A, Note Table of Contents Configuration Methods DHCP/BOOTP Getting Started Network Settings Configuring Serial Ports UDP Sockets Profile 132 Remote Access Slip Profile 179 Configuring Users Configuring Security Configuring I/O Interfaces Channels UDP Configuring Clustering Controlling the RPS, I/O Channels, System Administration Applications Appendix B SSL/TLS Ciphers Appendix E Setting Jumpers 361 Appendix G Utilities Appendix I Troubleshooting Glossary Index Preface About This BookIntended Audience Documentation Typeface Conventions Online Help About the Iolan IntroductionIolan Family Models Iolan Features Hardware Software Security Ldap Connectivity IntroductionIolan Components What’s Included Power Supply Specifications Available AccessoriesPower Over Ethernet PoE Models Desktop Models DC Power Requirements AC Power RequirementsGetting to Know Your Iolan Rack Mount Models Port Serial Activity Port Top View End View Console Port/LED View Rack MountSerial/Ethernet View Console/Serial Switch Console ModeSerial Mode Dedicated Console Port Rack Mount Models Desktop/Rack Mount Models Powering Up the IolanModels DC Power Models Earthing WirePrimary Supply Secondary back-up Supply Disconnecting 48V Power Supplies from the Iolan Powering Up the Iolan Configuration Methods Chapter Configures an IP Address Configuration Methods OverviewRequires a Configured IP Address Easy Config Wizard Access Platforms Unique FeaturesConnecting to the Iolan Using DeviceManager DeviceManager DeviceManager Using DeviceManager WebManager Connecting to the Iolan Using WebManager Iolan Using WebManager Connecting to the Iolan Using the CLI Command Line InterfaceThrough the Network Using the CLI Connecting to the Iolan Using the MenuMenu Through the Serial Port Using the Menu Connecting to the Iolan Using DHCP/BOOTP Using DHCP/BOOTP DHCP/BOOTP Parameters TACACS+ Securid Connecting to the Iolan Using Snmp Snmp Using the Snmp MIB Using the IOLAN+ Interface Connecting to the Iolan to Use the IOLAN+ InterfaceIOLAN+ Interface REMOTE-ADMIN Changes to the IOLAN+ Interface Opt HEX Rlogin/Telnet Remote Access Systems Screen Name Wchiewsds2 Debug mode IP address IOLAN+ Interface Easy Configuration Wizard Getting Started Setting Up the Network Using a Direct Serial Connection to Specify an IP Address Using a Direct Serial Connection to Enable BOOTP/DHCP Using ARP-Ping For an IPv6 Network Setting Up the Serial Ports Setting Up the Serial Ports Setting Up Users Using DeviceManager WebManager Navigating DeviceManager/WebManager DeviceManager WebManager EasyPort Web Using DeviceManager to Connect to the Iolan Starting a New Session Assigning a Temporary IP Address to a New Iolan Adding/Deleting Manual IOLANs Logging in to the Iolan Using WebManager to Connect to the Iolan Configuration FilesCreating a New Iolan Configuration in DeviceManager Logging into the Iolan Importing an Existing Configuration File Opening an Existing Configuration FileManaging the Iolan Network Settings IP Settings IPv4 SettingsOverview Field Descriptions IPv6 Settings Autoconfiguration IPv6DHCPv6 Custom IPv6 Prefix Bits Range Default Adding/Editing a Custom IPv6 Address Advanced Server Name.Domain Prefix.Domain Name Default 100 ms Default 200 msDefault Disabled Advertise DHCPv6 Configuration Advanced Host TableFunctionality IP Filtering Data Options Adding/Editing a Host Host NameFully Qualified Domain Name Route List Default Default Adding/Editing RoutesType IPv4 Subnet Mask DNS/WINS RIP Editing/Adding DNS/WINS Servers Ethernet Mode Default NoneAuthentication Password Dynamic DNS Overview FunctionalityEnd Time Key Account Settings Default DynamicUser Name System Type Cipher Suite Field Descriptions Adding/Editing a Cipher Suite Validation Criteria Field Descriptions IPv6 Tunnels Common Name Default Manual Adding/Editing an IPv6 TunnelName Mode 102 Iolan SDS/SCS/STS User’s Guide, Version Serial Ports Functionality Editing a Serial Port Copying a Serial Port Serial Port Profiles Resetting a Serial PortCommon Tabs Hardware Tab Field Descriptions Default Full Default Auto Flow ControlEnable Inbound Flow Control Default Enabled Enable Outbound Email Alert Tab Field Descriptions Packet Forwarding Tab Field Descriptions Enable Trigger1 Enable Trigger2Packet Definition Packet Size Default Trigger EOF1 CharacterEOF2 Character Trigger SSL/TLS Settings Tab Field Descriptions Default Client 114 Iolan SDS/SCS/STS User’s Guide, Version 115 116 Iolan SDS/SCS/STS User’s Guide, Version Default Telnet Console Management ProfileGeneral Tab Field Descriptions Protocol Advanced Tab Field Descriptions Enable Microsoft AdministratorSupport Default Disabled Multisessions Idle Timeout Modem TruePort ProfilePhone System Default Enabled Host Name Connect to remoteConnect to Multiple Hosts Host and backup Adding/Editing Additional TruePort HostsHosts to connect to Define a primary Adding/Editing a Multihost Entry Backup HostPrimary Host Day Motd Default Disabled Enable TCP Signals highWhen Session Timeout Enable DataLogging Connection Workstation/Server on the network Default Enabled TCP Sockets Profile Initiate Connection Received on the serial port Adding/Editing Additional Hosts 129 Day Motd Default Disabled Enable Data 131 UDP Sockets Profile Start IP Address UDP port DirectionEnd IP Address Terminal Profile Default 0 zeroUDP Port Default Dumb VT100TVI925 VT320 specifically supporting VT320-7 Default Disabled Protocol Is received Data Range 138 Iolan SDS/SCS/STS User’s Guide, Version User Service Settings Login Settings Telnet Settings InterruptQuit Erase User is only prompted for a password Rlogin SettingsEscape SSH Settings Slip Settings RSA authentication for the SSH sessionAuthentication for the SSH session Arcfour Routing VJ Compression PPP Settings IPv6 Remote Default ChapNone Remote User Remote Password Configure ReqTimeout Default 3 seconds Default 1 minute Roaming CallbackChallenge Interval Address/Control Printer Profile Serial Tunneling Profile Serial Server TunnelSerial Client Iolan Tunnel Client Default Disabled Host Name Act As Tunnel Virtual Modem Profile 154 Iolan SDS/SCS/STS User’s Guide, Version DCD AT Command DTR Signal Acts as RTS Signal Always On RTS Signal Acts asResponse Delay Phone Number to Host Mapping Control Signal I/O Profile VModem Phone Number EntryPhone Number Host IP Address Input Signal Field Descriptions Invert SignalDescription Latch Auto Clear Mode Mode Default DisabledManual Clear Syslog Output Signal Field Descriptions Failsafe Action Modbus Gateway Profile Settings Button UID Range Destination SlaveIP Mappings Advanced Slave Default 1000 ms Default 30 msAdvanced Field Descriptions Modbus Slave IP Settings Field Descriptions Adding/Editing Modbus Slave IP Settings Default HostUID Start UID End Modbus Slave Advanced Settings Field Descriptions Default TCPRange Default 50 ms Data Options TCP or UDP Power Management Profile Editing Power Management Plug Settings Field Descriptions Default RSP820RPS Name RPS Model Remote Access PPP Profile Default StateDefault Off Data Options On, Off Negotiate IP IPv6 Global Authentication Tab Field Descriptions 174 Iolan SDS/SCS/STS User’s Guide, Version Enable Dynamic DNS for this Serial Default Disabled Port HostAccount Settings Dynamic DNS Field Descriptions 176 Iolan SDS/SCS/STS User’s Guide, Version Configure Request Compression Default Enabled Enable ProtocolEnable VJ Enable Magic MS Direct Host Dial In/OutMS Direct Guest Remote Access Slip Profile 180 Iolan SDS/SCS/STS User’s Guide, Version 181 Custom Application Profile General Tab Field Description Local Port Buffering Port BufferingKeyboard Buttons Hot Keys Direction Field Definitions Remote Port Buffers Enable Port Data Default Disabled Enable Key StrokeNFS Host NFS Directory Advanced Serial Settings Tab SignalsProcess Break Deny Multiple Default ~menu Serial Port MenuString Session Escape Adding/Editing a Modem Modems TabName Name of the modem TruePort Baud Rate Tab Field Definitions 190 Iolan SDS/SCS/STS User’s Guide, Version Configuring Users User Settings Adding/Editing Users General Tab Default Normal Services Tab ServiceDefault DSPrompt Host IP IPv6 Interface Indentifier Advanced Tab Default English Sessions Tab Session 1, 2, 3 Connect Serial Port Access Tab Serial Port AccessAllow Access to Clustered Ports 202 Iolan SDS/SCS/STS User’s Guide, Version Configuring Security Authentication Authentication Method Default Local SecondaryPrimary Method Local Radius General Field Descriptions Authenticator response Default Enabled Retry NAS-IP-Address Default EnabledAttributes Field Descriptions NAS-Identifier Kerberos RealmKDC Domain KDC Port Base Enable TLSTLS Port Authentication Authorization Primary Host Secondary Host Default None AuthenticationAuthorization Port Default Authentication Primary Host Default None SecurID NIS Users Logging into the Iolan Using SSH Device ServerLynn Tracy Lynn Sales Server Users Passing Through the Iolan Using SSH Dir/SilHR Server Interactive Default Enabled Password Field DescriptionsAllow SSH-1 Keyboard Output Default Disabled Enable VerboseBreak String Button For a valid SSL/TLS connection 218 Iolan SDS/SCS/STS User’s Guide, Version Adding/Editing a Cipher 220 Iolan SDS/SCS/STS User’s Guide, Version VPN IKE Phase 1 Proposals ESP Phase 2 ProposalsAuthentication Algorithms-MD5, SHA1, SHA2 IPsec Adding/Editing the IPsec Tunnel Default Left Secret/RemoteValidation Criteria Local Device Shared Secret Field Description Remote Validation Criteria Field Descriptions L2TP/IPsec Allow L2TP/IPsec Exceptions Adding/Editing a VPN Exception Field Description Services Telnet ServerTruePort Full Syslog Client DeviceManager WebManagerSSH Server Sntp Client Keys and Certificates Key Type 234 Iolan SDS/SCS/STS User’s Guide, Version Configuring I/O InterfacesChapter Settings Access Functionality Advanced Slave Modbus Settings Request Queuing Default 30 seconds Failsafe Timer FunctionalityFailsafe Action is triggered Broadcast of I/O Default Disabled Status Enable UDPUDP Functionality UDP Settings UDP Entry Temperature Functionality Default Celsius Channels AnalogMonitoring Application A4D2 Analog I/O Analog Default Current Alarm Settings Monitoring Application Digital InputDigital I/O Input Mode 247 Digital Output Default Sink Output ModeOutput Pulse Mode Inactive Signal Width Active Signal WidthDelay Pulse Count Monitoring Application A4D2Relay RelayRelay I/O Inactive Signal Width Active Signal Digital I/O ExtensionFront Door Warehouse Perle Iolan Reception Message type 1 Byte Current Alarm State 1 Byte z 0 = Not in alarmInput number 1 Byte Extension Enable I/OInput TCP Port Hosts Local connection Simultaneously Communicate to the Primary Host Temperature Temperature I/O Industrial Freezers Default RTD Alarm Settings Basic Analog Alarm Settings Clear Mode Advanced Analog Alarm SettingsTrigger Type Clear UDP Unicast Format UDP Broadcast Packet Analog Section Length EnabledSection Channel Serial Pin Signal Section Digital/Relay SectionLength Channel Length Pin Modbus Slave UDP Unicast ExampleModbus Serial Application Connected to the Serial Port Modbus Serial Application Connected to the Network Modbus I/O Access Modbus RTU Or Ascii Application Power Digital OutputModbus TCP Application Function Codes Coil/Register Descriptions Serial Port Coil/Register Descriptions A4/T4 RegistersData Model A1/T1 A2/T2 A3/T3 A4/T4 Holding Registers Input Registers A4D2/A4R2 Registers Data Model D1/R1 D2/R2 Coils Serial Pin Signals D4/D2R2 RegistersData Model D3/R1 D4/R2 Coils Data Model Pin Coils TruePort I/O Modbus Serial Application TruePort Power Digital OutputTruePort/Modbus Combination API Over TruePort Only PC running Custom Application API TruePort Setup Accessing I/O Data Via TruePortIntroduction Format of API Commands Get CommandsCommand Format Response Format Set Commands Successful Response Format Unsuccessful Response FormatExample 1 Turn on the first relay on a D2R2 unit Example 2 Turn on the first and second relay on a D2R2 unit Error Codes Snmp Traps 280 Iolan SDS/SCS/STS User’s Guide, Version Clustering Slave List Configuring Clustering ChapterAdvanced Button Adding Clustering Slaves Advanced Clustering Slave Options Editing Clustering Slave SettingsPort Name Slave TCP Port Master TCP Port Option Card Settings Configuring the Option CardConfiguring the Iolan Modem Card Overview Field Descriptions Configuring a Wireless WAN CardCard APN 288 Iolan SDS/SCS/STS User’s Guide, Version Alerts Configuring the System ChapterEmail Alerts Alerts Syslog Management ContactLocation Community Auth Algorithm Data Options MD5, SHA Default MD5 Auth PasswordDefault DES Privacy Password Algorithm Data Options MD5, SHA Default MD5 Privacy Algorithm Data Options DES, AES Default DESConfirm Password Trap Time Network Time Tab Field Descriptions Sntp ModeSntp Version Time Zone/Summer Time Tab Field Descriptions Custom App/Plugin Login Tab Field Descriptions Bootup Files Tab Field Descriptions Message of the Day Motd Tab Field Descriptions Tftp HostFilename Display Motd WebManager/Easy Port Web Default Flow Control Tftp Tab Field DescriptionsConsole Port Tab Field Descriptions Baud Rate 302 Iolan SDS/SCS/STS User’s Guide, Version Controlling the RPS, I/O Channels, and IPsec Tunnels State Button Management profile settingsRPS Control Plug Control OK Button Closes the window Power Plug Status Serial Port Power ControlButton Serial port Deactivate Output Manually deactivates the channel output IPsec Tunnel Control 308 Iolan SDS/SCS/STS User’s Guide, Version System Administration Chapter Managing Configuration FilesSaving Configuration Files Downloading Configuration Files Downloading Configuration Files to Multiple IOLANs Reboot Server Specifying a Custom Factory Default Configuration Uploading Configuration FilesLess than 3 seconds-Reboots the Iolan Downloading Iolan Firmware Calibrating I/OCalibrating Analog Input Calibrating Voltage Calibrating Temperature Input Calibrating Analog ChannelsCalibrating Thermocouple Calibrating RTD Resetting Calibration Data Rebooting the Iolan Setting the IOLAN’s Date and TimeResetting the Iolan to Factory Defaults Language Support Resetting the SecurID Node SecretLoading a Supplied Language Software Upgrades and Language Files Translation Guidance Downloading Terminal Definitions Creating Terminal Definition Files Resetting Configuration Parameters For example Lost Admin Password Configuring Modbus Configuring a Master GatewayConfiguring a Slave Gateway Applications Modbus Master Gateway Modbus Gateway SettingsModbus Slave Gateway Modbus Serial Port Settings Modbus Master SettingsModbus Slave UID Master Gateway Serial EIA-232 Modbus Master Slave Gateway Modbus Slave SettingsSerial Port EIA-422/485 Modbus Master Modbus Slave UID Configuring PPP Dial On Demand 172.16.0.0 Setting Up Printers Remote Printing Using LPD Remote Printing Using RCP Remote Printing Using Host-Based Print Handling Software Configuring a Virtual Private Network IOLAN-to-Host/Network Or just Network-to-Network 172.16.45.84 192.168.45.87 192.168.45.12 Host-to-Host Left External IP Address RightGateway Router 172.16.45.99 332 Iolan Device Server User’s Guide, Version VPN Client-to-Network VPN Client Initiate Communication Router Broadband Right 334 Iolan Device Server User’s Guide, Version Radius and TACACS+ Appendix a Supported Radius Parameters PPP User level. See Perle Radius Dictionary Example Accounting Message Mapped Radius Parameters to Iolan Parameters Radius Parameter Iolan Parameter Perle Radius Dictionary Example Value Accessing the Iolan Through a Serial Port Users TACACS+ Name Values Description Slip Accessing the Iolan from the Network Users Accessing the Iolan from the Network User Example Settings SSL/TLS Ciphers Valid SSL/TLS Ciphers DES-CBC-MD5 Commands Virtual Modem Initialization Commands AT&Rn AT&SnAT&Cn Serial Pinouts Pinouts and Cabling DiagramsDB25 Male DB25 Female RJ45 RJ45 SCS48C/SCS32C/SCS16C/SCS8C DB9 Male Serial Only Power Over Ethernet Pinouts DB9 Male I/O EIA-232 Cabling Diagrams Terminal DB25 ConnectorDB25 Male DB25 Female DB9 Male RJ4510-pin Pin Modem DB25 Connector Iolan RJ45 DCE RxD TxD DTR 20 DTR GND 360 Iolan SDS/SCS/STS User’s Guide, Version Setting Jumpers Port Iolan DB25 Male/Female Port Iolan RJ45 P Power Over Ethernet Port Iolan RJ45 Port Iolan DB9 Port Iolan SDS1M Modem Port Iolan Port Desktop Iolan Port/Line # Line Termination 5V Output Input Volt Output Digital I/O Module Analog Input Module 368 Iolan SDS/SCS/STS User’s Guide, Version Wiring I/O Diagrams Digital I/ODigital Input Wet Contact Digital Input Dry Contact Digital Output Sink Digital Output Source Current Analog InputVoltage Temperature Input RTD 2-WireRTD 3-Wire Thermocouple RTD 4-Wire Relay OutputNormally Open Contact Normally Closed Contact 374 Iolan SDS/SCS/STS User’s Guide, Version Utilities TruePort API Request Format API I/O Access Over TruePortAPI Response Format Error Codes Decoder 378 Iolan SDS/SCS/STS User’s Guide, Version Accessories Installing a Perle PCI Card Installing a Perle PCI Card Accessories Starter Kit Adapters/Cable RJ45F to DB25M DTE Crossover Adapter RJ45F to DB25M DCE Modem Adapter RJ45F to DB25F DTE Crossover Adapter RJ45F DB25F RJ45F to DB9M DTE Crossover Adapter Sun/Cisco RJ45M Connector Cable for Rack Mount Models RJ45F to DB9F DTE Crossover Adapter SCS48C/SCS32C/SCS16C/SCS8C Starter Kit Adapters/Cable GND DTR 20 DTR DSR RJ45F to DB25F DTE Crossover Adapter 390 Iolan SDS/SCS/STS User’s Guide, Version Sun/Cisco Roll-Over Adapter for Rack Mount Models RJ45F 392 Iolan SDS/SCS/STS User’s Guide, Version Troubleshooting Hardware TroubleshootingPower/Ready LED stays red after a boot Power/Ready LED on a rack mount model flashes red DeviceManager Problems Communication IssuesGeneral communication checks and practices are as follows Host Problems Radius Authentication Problems Login Problems Problems with Terminals DHCP/BOOTP Problems Callback ProblemsLanguage Problems You observe Tftp errors when the Iolan boots, for example Modem Problems PPP ProblemsPrinting Problems Long Reboot Cycle Certificate did not match configuration ModelsCould not obtain peers certificate An A4R2 model is starting/stopping IPv6 Issues Contacting Technical Support Making a Technical Support Query Repair Procedure Feedback on this Manual Glossary PAP Password Authentication Protocol Radius RemoteAuthentication Dial Users Services Reverse Connection RIP Routing Index API Ldap Radius Index W