Allow traffic passing through the IPsec tunnel in the filter policy

The traffic required to establish IPsec tunnels for mobile users are not handled by an implicit filtering rule. It is therefore necessary to create the corresponding rules manually.

REMINDER
By default, when a tunnel is established with the native Microsoft Windows client, the virtual address of the VPN interface overrides the default route of the client workstation. The entire network traffic of the workstation then uses the IPsec tunnel. This behavior is called full-tunneling. It is recommended to maintain this behavior.

In the context of full tunneling, it is necessary to add filtering rules that allow traffic to pass through the IPsec tunnel to authorized internal networks, as well as enabling Internet browsing by mobile clients.

Go to the Configuration > Security Policy > Filter - NAT > Filtering tab.

Create the rules necessary to establish the tunnels

1. In the filter grid, select the line below which you want to add the rule allowing IPsec VPN for mobile clients.
2. Click on New rule.
3. Select Simple rule.
   
   A new row appears.
4. On the newly added row, double-click in one of the cells.
   The configuration window of the rule opens. Fill in the various fields as follows:
   • In the left General menu: set the Status to On.
   • In the left Action menu, General tab, set Action to pass.
   • In the left Source menu:
     • General tab, for the Source hosts field, select the Internet object.
     • Geolocation/Reputation tab: you can select a geographical area to filter the geographical origin of IPsec tunnels. In this example: the France object.
   • In the left Destination menu, General tab, for the Destination hosts field, select the Firewall_out object.
   • In the left Port - Protocol menu, for the Destination port field, select the isakmp and isakmp_natt objects.

5. Click OK to validate filter rule creation.
6. Go under the rule previously created and repeat steps 2 to 4 by filling in the different fields as follows:
   • In the left General menu: set the Status to On.
   • In the left Action menu, General tab, set Action to pass.
   • In the left Source menu:
     • General tab, for the Source hosts field, select the Internet object.
     • Geolocation/Reputation tab: you can select a geographical area to filter the geographical origin of IPsec tunnels. In this example: the France object.
   • In the left Destination menu, General tab, for the Destination hosts field, select the Firewall_out object.
   • In the left Port - Protocol menu:
     • Destination port field: select the Any object.
     • Protocol Type field: Select the IP Protocol object.
     • IP Protocol field: select the vpn-esp object.
7. Click OK to validate filter rule creation.

The filter rules obtained are therefore as follows:

Create filter rules for authenticated mobile user traffic

Traffic to authorized networks

1. In the filter grid, go under the rules necessary to establish the tunnels.
2. Click on New rule.
3. Select Simple rule.
   
   A new row appears.
4. On the newly added row, double-click in one of the cells.
   The configuration window of the rule opens. Fill in the various fields as follows:
   • In the left General menu: set the Status to On.
   • In the left Action menu, General tab, set Action to pass.
   • In the left User menu:
     • Set the drop-down list to Equal to.
     • For the Directory/Domain name field: select the directory in which the users authorized to set up a tunnel are declared. In this example: stormshield.eu.
     • In the User - Group field: select the user group authorized to establish a tunnel. In this example: EAP-TLS VPN Users@stormshield.eu.
   • In the left Source menu:
     • General tab, for the Source hosts field, select the object corresponding to the network assigned to the mobile clients. In this example: IKEv2_EAPTLS_Clients_Network.
     • Advanced properties tab:
       • For the Via field, select IPsec VPN tunnel.
       • For the Authentication method field, select IPsec VPN.
   • In the left Destination menu, General tab, for the Destination hosts field, select the networks that mobile users can access through the IPsec VPN tunnel. In this example: IKEv2-EAPTLS-GRP-DST.
   • In the left Port - Protocol, for the Destination port field: select the Any object.
   • Optional: In the left Inspection menu, for the Inspection profile field, select the TCP-UDP inspection profile with the MSS option you may have created. In this example: IPS_03.
5. Click OK to validate filter rule creation.

The filter rule configured is therefore:

Internet browsing

1. In the filter grid, go under the previously created rule.
2. Click on New rule.
3. Select Simple rule.
   A new row appears.
4. On the newly added row, double-click in one of the cells.
   The configuration window of the rule opens. Fill in the various fields as follows:
   • In the left General menu: set the Status to On.
   • In the left Action menu, General tab, set Action to pass.
   • In the left User menu:
     • Set the drop-down list to Equal to.
     • For the Directory/Domain name field: select the directory in which the users authorized to set up a tunnel are declared. In this example: stormshield.eu.
     • In the User - User Group field: select the user group authorized to establish a tunnel. In this example: EAP-TLS VPN Users@stormshield.eu.
   • In the left Source menu:
     • General tab, for the Source hosts field, select the object corresponding to the network assigned to the mobile clients. In this example: IKEv2_EAPTLS_Clients_Network.
     • Advanced properties tab:
       • For the Via field, select IPsec VPN tunnel.
       • For the Authentication method field, select IPsec VPN.
   • In the left Destination menu, General tab, for the Destination hosts field, select the Internet object.
   • In the left Port - Protocol menu, for the Destination port field: select the https object.
   • Optional: In the left Inspection menu, for the Inspection Profile field, select the TCP-UDP inspection profile with the MSS option you may have created. In this example: IPS_03.
5. Click OK to validate filter rule creation.

The filter rule configured is therefore:

NAT rule for internet browsing

Go to Configuration > Security policy > Filtering - NAT > NAT tab.

1. In the NAT grid, select the line below which you want to add the rule for Internet browsing of mobile clients.
2. Click on New rule.
3. Select Dynamic rule with port address translation (Dynamic PAT).
   A new row appears.
4. On the newly added row, double-click in one of the cells.
   The configuration window of the rule opens. Fill in the various fields as follows:
   • In the left General menu: set the Status to On.
   • In the left User menu:
     • Set the drop-down list to Equal to.
     • For the Directory/Domain name field: select the directory in which the users authorized to set up a tunnel are declared. In this example: stormshield.eu.
     • In the User - Group field: select the user group authorized to establish a tunnel. In this example: EAP-TLS VPN Users@stormshield.eu.
   • In the left Original Source menu, General tab:
     • For the Source hosts field, select the object corresponding to the network assigned to the mobile clients. In this example: IKEv2_EAPTLS_Clients_Network.
     • For the Incoming interface field, select the ipsec object.
   • In the menu on the left, Original destination:
     • General tab:
       • In the Destination hosts field, select the Internet object.
       • In the Destination port field, select the Any object.
     • Advanced properties tab: For the Outgoing interface field, select the out object.
   • In the left Translated source menu, General tab:
     • In the Translated source host field, select the Firewall_out object.
     • In the Translated source port field, select the ephemeral_fw object.
   • In the left Translated Destination menu, General tab, for the Translated destination host field: select the Any object.
5. Click OK to validate the creation of the NAT rule.

The NAT rule obtained is therefore as follows: