Asentria SiteBoss 530 User Manual
63
How do I know the VPN is working?
To check the status of the VPN, read the
net.vpn[x].status
key. It returns one of 3 values:
•
0 (which means the VPN is off)
•
1 (which means the VPN is trying to start)
•
2 (which means the VPN is operational)
Note that the return value of 2 means the tunnel is up, but does not necessarily preclude configuration errors from
preventing VPN traffic to pass. So to ultimately know the VPN is operational, in addition to verifying
net.vpn.status
returns 2, you should also ping the server from the unit using the VPN address of the server.
(Or you can ping the unit from the server, using the VPN address of the unit.)
You can also use the
net.vpn[x].cmd
key to read the status of the VPN.
Do I need to give the VPN a name?
You may want to describe the VPN or give it a name; use the
net.vpn[x].description
key for that. This has
no functional purpose, it is just for making a note.
How does the unit know the VPN server is authentic (and vice versa)?
The unit uses certificate-based SSL/TLS security to authenticate the server (and the server uses the same thing to
authenticate the unit). Configuring certificates can be done with Setting Keys, but is likely more simple for a user
to use the SSLC command on the unit. The SSLC command allows unit administrators to manipulate the SSL
VPN certificates and other authentication data associated with the VPN.
The SSLC command takes a variety of command line arguments that tell it what to do. These arguments are
mainly broken down into "actions" and "items"
•
actions
o
add: add an item (load it into the unit)
o
list:
list an item (display what is already in the unit)
o
delete: delete an item
•
items
o
certificate
o
key
o
CA certificate
o
DH parameters
The idea behind this paradigm is that you do something (an action) on something (an item).
The command line arguments that specify actions and items are:
-e Specify item: certificate
-k Specify item: key
-r Specify item: CA certificate
-t Specify item: TLS-auth key
-h Specify item: DH parameters
-l Specify action: list item
-a Specify action: add item
-d Specify action: delete item
You must also specify which VPN you want this applied to with the "-v" command line argument:
-v x Specify VPN x, where x is 1 or 2
For example, to load the CA certificate for VPN 1, enter
SSLC -a -r -v 1
The unit cannot generate its own SSL authentication key/certificate. You must do this (presumably with an
OpenVPN server installation) and load the certificates/keys on the unit with the SSLC command. It is
recommended you use the SSLC command either in a trusted network environment via Telnet or via SSH. This is
for two reasons:
1. The data you upload is text format, and is accepted without any application layer protocol like Xmodem.
Therefore to make eliminate communcation errors, use the protocol on a TCP-based command processor
(like Telnet or SSH).
Содержание SiteBoss 530
Страница 6: ......
