Tunnel server configuration Implementing PC-to-WAN Tunnels

105 • Total tunnels : The total number of tunnels for this tunnel group is set to 128. As each tunnel session is assigned two IP addresses, this makes the total IP address range equal to 256 IP addresses. • NetMask : 255.255.255.0 for the 256 IP virtual network. Authentication table The group name for this tunnel is SalesSupport. The password in this case is WHOlistenen. These two parameters have been extracted into an ETA file called salsup.eta and distributed via floppy disk to the various tunnel clients. The key file has been created by the tunnel server on the corporate LAN and is specific to this tunnel group. The key file has also been extracted and distributed via floppy disk. By default, this key file is named salsup.key.

6.4.3.3 WAN router configuration

The WAN routers function in this scenario is to route network traffic between the two subnets Sales and Support. All hosts on the two subnets have default routes to the router, which routes traffic either between the two networks or out onto the Internet. The WAN router is likewise configured to route tunnel traffic from the virtual network 1.196.5. to the tunnel server at 1.195.6.2 on port 3265.

6.4.3.4 Firewall configuration

The local firewall is configured to relay all external tunnel traffic those reaching 1.195.6.1 on port 3265 to the WAN router at 1.195.6.5. The WAN router then routes the traffic to the tunnel server as in the previous WAN router section.

6.4.3.5 Network host configurations

All hosts on both the 1.195.6. subnet and the 1.195.7. subnet are configured with default routes pointing to the WAN router.

6.4.3.6 Remote client configurations

The remote PC clients are configured similarly to the methods presented earlier in Section 6.4.2 . The only differences are the names of the ETA and key files. In this case, each PC will have salsup.eta and salsup.key files installed for the SalesSupport tunnel user group.

6.4.3.7 Tracing the packets

The remote PC begins by opening a tunnel request to the tunnel server. The PC is connected to the Internet via an ISP and has initiated the tunnel connection with its AltaVista Tunnel Telecommuter client. The request passes through the end users ISP transparently, destined for the remote firewalls IP interface on the Internet 1.195.6.1 on the tunnel port of 3265. The remote firewall is set up to relay all traffic received on this port to the WAN routers interface for its subnet 1.195.6.5. The WAN router then routes this traffic to the tunnel servers physical IP address, at 1.195.6.2 on port 3265. The tunnel server checks the authentication information against its Authentication tables, and encrypts a reply using the remote clients private key. This reply is sent back to the remote client, which decrypts the reply with its private key. The two sides then exchange parts of the session key salsup.key,which is 106 combined to form a secret session key. The tunnel server assigns the virtual IP address of 1.196.5.2 to the remote clients pseudo-adapter. This will act as the clients end of the tunnel, and all traffic destined for the remote network will be routed to this address. The tunnel server takes 1.196.5.1 as its pseudo-adapter interface to this tunnel session, and any traffic received at this IP address is routed to the WAN router for further routing to one or the other subnets. The remote client now interacts with nodes on the WAN as if it were physically connected to that network. When the second remote PC connects to the tunnel server, the new tunnel is assigned a second pair of IP addresses from the tunnel servers dynamic range. In this case, the second remote client is assigned 1.196.5.4, and the tunnel server takes 1.196.5.3 as its end of this tunnel session. The remote client routes all tunnel traffic to its pseudo-adapter interface to the tunnel, and the tunnel server routes all incoming traffic to its local network range for the tunnel that is directed at the WAN router. In both cases, the secret session key is regenerated by the tunnel server every 30 to 1,440 minutes and redistributed to the remote clients transparently.