Configuring the FW-LYON firewall

Creating objects corresponding to LANs at the LILLE and LYON sites

  1. Go to Configuration > Objects > Network.
  2. Click on Add.
  3. In the column on the left side of the object creation window, select Network.
  4. Specify the Object name (LIL-LAN in this example).
  5. Enter the Network IP address in the form of a network/mask. The network mask can be entered in CIDR or decimal format.
  6. Click on Create and duplicate.
  7. Repeat steps 4 and 5 to create the object LYO-LAN.
  8. Click on Create.

Creating the object corresponding to the LYON WAN gateway/link

  1. Go to Configuration > Objects > Network.
  2. Click on Add.
  3. In the column on the left side of the object creation window, select Host.
  4. Specify the Object name (LYO-WAN-1 in this example).
  5. Enter its IPv4 address.
  6. Click on Create.

Setting this router object as the FW-LYON firewall's gateway

  1. Go to Configuration > Network > Routing.
  2. In the Default gateway field, select the host object that was created earlier (LYO-WAN-1 in this example).
  3. Click on Apply then Save.

Setting the IPsec peer for the LILLE site

This is a mobile peer, as the FW-LYON firewall cannot predict the address that the FW-LILLE firewall will use to set up the tunnel.

Similarly to the FW-LILLE firewall, the DPD (Dead Peer Detection) option has to be set to High to force the IPsec tunnel to be renegotiated immediately when the link is down.

  1. Go to Configuration > VPN > IPsec VPN > Peers tab.
  2. Click on Add, then on New mobile peer.
  3. Enter a name for this peer (FW-LILLE in the example).
  4. Select the IKEv2 version.
  5. Choose the IKE profile to use.
    It has to be the same as the one used on the FW-LILLE firewall.
  6. Click on Next.
  7. For the Authentication type, select Pre-shared key (PSK).
  8. Click on Next.
  9. Click on Add:
    1. For the ID, enter the public IP address of the LILLE site's first WAN link.
      Enter the Pre-shared key and confirm it.
      It has to be the same one defined on the FW-LILLE firewall.
    2. Click on Apply.
    3. Repeat steps A to C to set the pre-shared keys used for the two other WAN links on the LILLE site.
      They have to be the same ones defined on the FW-LILLE firewall.
  10. Click on Next.
    You will be shown a summary of the peer's details.
  11. Click on Finish.
    Details on the peer are shown.
  12. Ensure that the value of the Local address is Any.
  13. In the Advanced properties section, set the DPD field to High.
    14. NOTE
    As the peer is mobile, it is automatically set to Responder-only mode.
  14. Click on Apply then on Save.
  15. Changes can be applied immediately by clicking on Yes, activate the policy.

Creating the IPsec policy to set up the tunnel with the FW-LILLE peer

  1. Go to Configuration > VPN > IPsec VPN > Encryption Policy - Tunnels tab > Mobile – Mobile users tab.
  2. Click on Add, then on New standard mobile policy.
  3. In the Local resources field, select the traffic endpoint of the LYON site (network object LYO-LAN in the example).
    The endpoint may be a network group.
  4. In the Peer selection field, select the peer that was created for the LILLE firewall (host object FW-LILLE in the example).
  5. Click on Finish.
  6. Click in the Keepalive column and select a duration from the drop-down menu (600 ms in the example).
    This setting determines how long to keep the tunnel up even when it is not in use.
  7. Double-click in the Status column to enable this rule in the IPsec policy.
  8. Click on Apply then Save.
  9. Changes can be applied immediately by clicking on Yes, activate the policy.

On the FW-LYON firewall, the IPsec policy between the LYON and LILLE sites is therefore:

Creating the filter rule to enable dialogue between the LYON and LILLE sites

  1. Go to Configuration > Security policy > Filter - NAT, Filtering tab.
  2. Click on New rule > Single rule.
  3. Double-click in any column in this rule.
  4. General menu on the left: switch the Status of the rule to On.
  5. Action menu, General tab: set the Action to pass.
  6. Source menu on the left: select the object corresponding to the LILLE local network (LIL-LAN in this example).
  7. Destination menu on the left: select the object corresponding to the LYON local network (LYO-LAN in this example).
  8. Port/Protocol menu on the left: add to the grid the Destination ports of the various objects corresponding to the ports to be allowed in this filter rule.
  9. Inspection menu on the left: we recommend leaving the default Inspection level, IPS.
  10. Click on OK.
  11. Repeat steps 2 to 10 with the LYO-LAN object as the source, and the LIL-LAN object as the destination.
  12. Click on Apply.