This configuration guide describes configuring IPsec IKEv2 Remote Access VPN by Windows Client on Windows OS to establish VPN connections. After that, the customer can access virtual machines and applications located on the HGIO Cloud with more security and reliability.
Setup IPSec IKEv2 Remote Access VPN Setup VPN Windows Client
Step 1: Configuration VPN Profile for Windows client.
Open PowerShell with Administrator permission.
Copy and paste the information below into PowerShell (replace red word xxxx by your domain name).
Add-VpnConnection -Name "HI-GIO-IKEv2-VPN" -ServerAddress " remote-xxxxx.xxxx01.vpn.higio.net " -TunnelType "Ikev2"
Set-VpnConnectionIPsecConfiguration -ConnectionName "HI-GIO-IKEv2-VPN" -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -EncryptionMethod GCMAES128 -IntegrityCheckMethod SHA256 -PfsGroup "PFS2048" -DHGroup "Group14" -PassThru -Force
Step 2: Enable VPN split tunneling in the Windows client.
Virtual private network (VPN) split tunneling lets you route some of your application or device traffic through an encrypted VPN. In contrast, other applications or devices have direct access to the internet.
Copy and paste the information below into PowerShell.
Set-VPNconnection -name "HI-GIO-IKEv2-VPN" -SplitTunneling $true
Step 3: Add a route to a VPN connection.
Add a VPN connection route for the subnet (example: 10.16.1.0/24). If we need to add an additional subnet, perform the same way and replace it with the new subnet.
Copy and paste the information below into PowerShell.
Step Connect VPN from Windows Client.
Login to the account with the provided username and password, then click OK.
The VPN connection was established successfully.
Using the ping command line, confirm that you are connected to the application located on the HGIO Cloud.
VPN Tunnel Name
IKE Profile (Phase 1)
Tunnel Configuration (Phase2)
DPD Configuration
Encryption
AES 128, AES 256, AES-CGM 128, AES-CGM 192, AES-CGM 256
Digest
SHA1, SHA 2-256, SHA 2-384, SHA 2-152
Package Integrity Control Hash Algorithm
Diffie-Hellman Group
Group 2,
Group 5,
Group 14, Group 15, Group 16, Group 19, Group 20, Group 21
Encryption Public Key Size
Association Life Time (seconds)
Encryption
AES 128, AES 256, AES-CGM 128, AES-CGM 192, AES-CGM 256
Digest Algorithm
SHA1, SHA 2-256, SHA 2-384, SHA 2-152
Package Integrity Control Hash Algorithm
Diffie-Hellman Group
Group 2,
Group 5,
Group 14, Group 15, Group 16, Group 19, Group 20, Group 21
Association Life Time (seconds)
Enabled
Turn on / off the tunnel
Authentication
Pre-Shared Key, Certificate
How to authenticate parties when raising a tunnel
Local Endpoint IP Address
The public IP address from HI GIO
Local Endpoint Network
List of the network share in the HI GIO cloud accessible through the tunnel
Remote Endpoint IP Address
The public IP address of the remote router from which you are connecting
Remote Endpoint Network
List of remote networks accessible through the tunne
Remote ID (Optional)
IKE Version
IKEv1, IKEv2
Enabled perfect forward secrecy (PFS)
Interval
IPsec VPN offers site-to-site connectivity between an HI GIO and remote sites with third-party hardware routers or VPN gateways that support IPSec.
On HI GIO, you can create VPN tunnels between:
Organization virtual data center networks in the same organization
Organization virtual data center networks in different organizations
Between an organization's virtual data center network and an external network
Fulfill .
Step 1: In the top navigation bar, click Networking and click the Edge Gateways tab.
Step 2: Click the edge gateway.
Step 3: Under Services, click IPSec VPN.
Step 4: To configure an IPSec VPN tunnel, click New.
Step 5: Enter a Name and a description (optional) for the IPSec VPN tunnel.
Step 6: To enable the tunnel upon creation, toggle on the Status option.
Step 7: Click NEXT to select Authentication mode.
Step 8: Select a peer authentication mode and NEXT.
HI GIO supported 02 option for Authentication Mode:
Option
Description
Pre-Shared Key
Choose a pre-shared key to enter. The pre-shared key must be the same on the other end of the IPSec VPN tunnel.
Certificate
Select site and CA certificates to be used for authentication.
Step 9: On Endpoint Configuration windows, we put some parameters (follow IPSec parameters in the prepare step):
IP address [Local Endpoint]: Enter public IP (HI GIO’s public IP).
Networks [Local Endpoint]: Enter at least one local (HI GIO’s network) IP subnet address for the IPSec VPN tunnel.
IP address [Remote Endpoint]: Enter public IP (remote site, ex: Office’s public IP).
Networks [Remote Endpoint]: Enter at least one remote IP (ex: Office’s network) subnet address for the IPSec VPN tunnel.
Step 10: Enter the remote ID (optional) for the peer site.
The remote ID must match the SAN (Subject Alternative Name) of the remote endpoint certificate, if available. If the remote certificate does not contain a SAN, the remote ID must match the distinguished name of the certificate that is used to secure the remote endpoint, for example, C=US, ST=Massachusetts, O=VMware, OU=VCD, CN=Edge1.
Step 11: Click Next.
Step 12: Review your settings and click Finish.
The newly created IPSec VPN tunnel is listed in the IPSec VPN view. The IPSec VPN tunnel is created with a default security profile.
Step 13: To verify that the tunnel is functioning, select it and click View Statistics.
If the tunnel is functioning, Tunnel Status and IKE Service Status both display Up.
Once the IPSec VPN tunnel has been created. We can change the IPSec VPN configuration by security profile, it must fit with the remote site.
Step 1: In the top navigation bar, click Networking and click the Edge Gateways tab.
Step 2: Click the edge gateway.
Step 3: Under Services, click IPSec VPN.
Step 4: Select the IPSec VPN tunnel and click Security Profile Customization.
Step 5: Change the configures of the VPN tunnel as you prepared ().
Step 1: Preparing IP set for firewall rule (can use dynamic\static group also). More detail
IP set detail:
Step 2: Create 02 the firewall rules (Edge gateway firewall) for the IPsec tunnel:
+ HI GIO to Local (remote site)
+ And Local (remote site) to HI GIO
If we used Distributed firewall, we also need to create firewall rules to allow VPN’s traffic (remote site to HI GIO).
*** Please also set the firewall rules for VPN traffic on the remote routers.
VALIDATE: Tunnel static is UP with Traffic
For the Security Profile – we keep it as Default and configure it later once the VPN tunnel has been created.
In case we use a Certificate for Authentication mode
Remember that the security settings must match the remote site's security settings.
