Asentria SiteBoss 530 User Manual
70
The "client" item specifies that the server will operate in the mode secured by SSL/TLS. This the only mode the
unit supports, so if the server does not use tls-server mode then the unit is incompatible with it. This item also
specifies that the client will allow the server to configure addressing information for it. This implies that on the unit,
there must be a "server" configuration option that specifies the virtual network. E.g., "server 10.8.0.0
255.255.255.0" means the server will hand out and address to the client in the 10.8.0.0/24 network. The unit
keeps the ".1" address in the virtual network for itself; e.g., the unit would have address 10.8.0.1 in this example.
The "remote" item specifies the address the address to connect to. The only impact this has on the unit is that the
unit must listen on the address that the connection ultimately arrives at. Use a generic key to specify this address
(e.g., net.vpn[x].ssl.conf="local 10.82.3.1"). Also, if firewalls separate the unit and the server, you should be aware
of the firewall configuration, so that the firewall routes traffic to the address on which the unit is listening.
The "port" and "proto" items specify what TCP/UDP port is used. The values for these items should match the
values for the
net.vpn[x].ssl.port
and
net.vpn.ssl[x].proto
keys on the unit.
The "dev" item specifies whether the server uses bridging or routing. The unit supports routing only (dev tun). If
the client says "dev tap" then the unit is incompatible with the client.
The "ca" item specifies the CA certificate. Use the SSLC command to load the CA certificate on the unit.
The "cert" and "key" items specify the server certificate and key. The unit must be configured with a certificate
(and key) using the SSLC command. Note also that if the server certificate is generated with the "nsCertType"
value of "server", then you can add the "ns-cert-type server" config item to the client configuration as an extra
layer of authentication.
The "tls-auth /etc/openvpn/tlsauth.key" item specifies the key used for the additional HMAC layer. If the client uses
this, then the unit must use this too. Specify this key with the SSLC command.
The "cipher AES-256-CBC" item specifies the cipher to use on the VPN; it must match the unit VPN configuration.
Specify this item with a generic key, for example: sec.vpn[x].ssl.conf[7]="cipher AES-256-CBC".
The "comp-lzo" item specifies LZO compression to be used on the VPN; it must match the unit VPN configuration.
Specify this item with a generic key, for example:
sec.vpn[x].ssl.conf[7]
="comp-lzo".
The "ping 15" and "ping-restart 60" items specify that the client will send a frame to the unit no less often than 15
seconds and restart the VPN after 60 seconds. This does not require the unit to have a similar configuration,
although it is recommended that the unit is configured with the "ping" and "ping-restart" items so that the unit does
not think the VPN is up when the physical connection is broken.
The "verb 3" item specifies the verbosity level of the OpenVPN syslog output. This configuration on the client is
independent of the unit. If you want to configure it on the unit then use a generic key to specify it.
The "daemon" item specifies that OpenVPN is to run as a daemon on the server. Daemon mode is mandated on
the unit, so this is automatically configured and not user-configurable.
In sum, the client configuration file in this example is by no means exhaustive, but it does cover what a typical
OpenVPN client configuration may look like and how to make the unit work with it in SSL SERVER VPN mode.
Summary of Contents for SiteBoss 530
Page 6: ......
