Managed tunnel configuration

This section explains the required parameters for the managed configuration of options that are necessary for setting up a VPN tunnel, assuming that the installation was properly conducted, and the technical requirements were met.

IMPORTANT
The user certificate and root CA have to be imported in advance into the relevant Windows storage locations. The Cybels VPN application will then search for these certificates respectively in the Personal folder (for user certificates), and in the Trusted root certification authorities folder (for the root CA) in the current user's Windows store.

Managed configuration means that the administrator:

  1. Sets and runs the steps in the manual configuration (see Manual tunnel configuration) on a workstation, and finalizes the creation of the configuration.
  2. Exports this configuration (see Exporting and importing configurations)
  3. Manually deploys this configuration on several user workstations through the Cybels VPN application (importing configurations) or with administration tools such as an EMM/GPO.

This configuration feature is useful for creating configuration backups before making changes or conducting tests, and also for building a configuration "template" that can be replicated on several workstations, which saves time, compared to individual manual configurations on several workstations.

Exporting and importing configurations

Exporting the configuration from a control workstation

In the VPN client interface, the administrator opens the Cybels VPN application's general settings and selects "Export configuration". The application generates a json file reflecting the configuration that was manually created and anonymized (no user information exported to the json file).

Importing the configuration on the pool

Individually:

This configuration canbe imported by clicking on "Import configuration" on one or several workstations.

Batch (Available in Cybels Premium):

  • Simply place this configuration file in the following folder C:\ProgramData\Ercom\Cybels-VPN
  • The name of the file has to follow the format vpn_config.json

Finalizing the configuration

As stated earlier, user settings are not exported to the json configuration file. They have to be entered after the generic configuration has been imported.

There are two ways to do so.

Manual configuration customization for PSKs and certificates

For PSKs and certificates, in the VPN client interface: in the "Configure my VPN" menu, click on the icon associated with the incompletely configured tunnel.

Enter the missing information to finalize the tunnel configuration in PSK mode or select the desired user certificate if the tunnel was configured in certificate mode.

NOTE
If ModeConfig is enabled (see Association lifetime and network configuration), the application will not ask for the VPN client's virtual IP address.

Managed configuration customization for certificates

Available in Cybels Premium

BEFORE importing the configuration on the pool of PCs to be configured (cf Importing the configuration on the pool), the administrator can simplify the selection of the user certificate in the configuration file by filtering results based on one or more criteria.

To do so, the imported configuration file needs to be opened in a text editor. This file contains blank values in the "certificateFilters" tag, which need to be entered by referring to the configuration/certificate on the control workstation.

Results can be filtered by one or more criteria including:

  • User certificate's Organization (O)
  • User certificate's Organizational unit (OU)
  • User certificate's Country (C)
  • User certificate's State/Region (ST)
  • User certificate's Locality/City (L)
  • Distinguished name of the user certificate's issuer (issuer). To prevent format incompatibility, the issuer's DN has to be copied (using the copy button found in the Cybels VPN interface) from the user certificate originating from the control workstation.

  • Extended Key Usage (EKU): distinguishes certificates that are almost identical (same DN, same issuer, etc.) but only with different EKUs. Currently, the only supported value is 1.3.6.1.5.5.7.3.2 (clientAuth). Other values are ignored during the filtering operation.

These fields have to be entered in the configuration file, in the various "value" tags that correspond to the above criteria.

"certificateFilters": [
	{
		"criteria": [
			{
				"field": "O",
				"value": ""
			},
			{
				"field": "OU",
				"value": ""
			},
			{
				"field": "C",
				"value": ""
			},
			{
				"field": "ST",
				"value": ""
			},
			{
				"field": "L",
				"value": ""
			},
			{
				"field": "EKU",
				"value": "1.3.6.1.5.5.7.3.2"
			},
		],
		"issuer": ""
	}
]

The json configuration file can then be deployed on the pool of PCs to be configured. When the application starts, it will look for a user certificate as follows:

  • Case 1: If no certificates are found: no certificates will be selected in the tunnel configuration (the tunnel configuration remains incomplete).
  • Case 2: If a single certificate is found: this certificate will be automatically selected in the tunnel configuration. The administrator cannot personally select or change it.
  • Case 3: If several certificates meet the criteria: the administrator must select one of them.

NOTE
Entering more criteria will increase the accuracy of the certificate selection.