Managed tunnel configuration

This section explains the required parameters for the managed configuration of options that are necessary for setting up a VPN tunnel, assuming that the installation was properly conducted, and the technical requirements were met.

IMPORTANT
The user certificate and root CA have to be imported in advance into the relevant Windows storage locations. The Cybels VPN application will then search for these certificates respectively in the Personal folder (for user certificates), and in the Trusted root certification authorities folder (for the root CA) in the current user's Windows store.

Managed configuration means that the administrator:

  1. Sets and runs the steps in the manual configuration (see Manual tunnel configuration) on a workstation, and finalizes the creation of the configuration.
  2. Exports this configuration (see )
  3. Manually deploys this configuration on several user workstations through the Cybels VPN application (importing configurations) or with administration tools such as an EMM/GPO.

This configuration feature is useful for creating configuration backups before making changes or conducting tests, and also for building a configuration "template" that can be replicated on several workstations, which saves time, compared to individual manual configurations on several workstations.

Exporting and importing configurations

Exporting the configuration from a reference workstation

In the VPN client interface, the administrator opens the Cybels VPN application's general settings and selects "Export configuration". The application generates a json file according to the configuration created manually and anonymized (no exported user information in the json file)

Importing the configuration to the fleet

Individually:

This configuration can be imported by clicking on “Import a configuration” on one or several workstations.

Bulk (Available in the Cybels Premium version):

  • Simply place this configuration file in the following folder C:\ProgramData\Ercom\Cybels-VPN
  • The name of the file has to follow the format vpn_config.json

Finalizing the configuration

As mentioned previously, user settings are not exported to the json configuration file. They must be filled in after importing the generic configuration.

There are two ways to do this.

Manual configuration customization for PSK and certificate

For PSK and certificate, from the VPN client interface: from the Configure my VPNs menu, click on the icon associated with the tunnel whose configuration you want to complete.

And enter the missing information to finalize the configuration of the tunnel in PSK mode or select the desired user certificate if the tunnel was configured in certificate mode.

NOTE
If ModeConfig is activated (see Association lifetime and network configuration, the application does not request the virtual IP address of the VPN client

Managed configuration customization for certificate

Available in Cybels Premium version

BEFORE importing the configuration to the fleet of PCs to be configured (see ), the administrator can simplify the selection of the user certificate from the configuration file by filtering on one or more criteria.

To do this, open the imported configuration file in a text editor. This file contains empty values in the “certificateFilters” tag which must be completed based on the configuration/certificate of the reference station.

Filtering can be performed on one or more of the following criteria:

  • Organization (O) of the user certificate
  • Organizational unit (OU) of the user certificate
  • Country (C) of the user certificate
  • User certificate State/Region (ST)
  • Location/City (L) of user certificate
  • Distinguishing name of the issuer of the user certificate. To avoid any format incompatibility, the issuer’s DN must be copied (using the copy button on the Cybels VPN interface) from a user certificate from the reference station.

Then, these fields are filled in via the configuration file in the different “value” tags corresponding to the above criteria.

"certificateFilters": [
	{
		"criteria": [
			{
				"field": "O",
				"value": ""
			},
			{
				"field": "OU",
				"value": ""
			},
			{
				"field": "C",
				"value": ""
			},
			{
				"field": "ST",
				"value": ""
			},
			{
			"field": "L",
			"value": ""
			}
		],
		"issuer": ""
	}
]

The json configuration file can then be deployed on the fleet of PCs to be configured, and when the application is started, it searches for a user certificate as follows:

  • Case 1: If no certificate is found: no certificate is selected in the tunnel configuration (the tunnel configuration is therefore incomplete).
  • Case 2: If only one certificate is found: this certificate is automatically selected in the tunnel configuration. The administrator does not have the possibility to select it himself (and cannot change it).
  • Case 3: If several certificates match the criteria: the administrator must select one of these certificates.

NOTE
The more criteria are entered, the more precise the certificate selection will be