Asentria SiteBoss 530 User Manual
67
VPN Server
SSL VPN Server support is where the unit runs OpenVPN version 2.1_rc15 to listen for a connection from an
OpenVPN where SSL/TLS is used for authentication and key exchange.
The benefits of using SSL VPN Server are:
•
SSL VPNs are simple, unlike other VPN technologies such as IPsec.
•
SSL VPNs can work through NAT-ing routers/firewalls, unlike other VPN technologies such as IPsec.
•
The OpenVPN distribution is freely available and works on a variety of platforms including Windows and Mac
When configuring SSL VPN Server it is best to use a question and answer format because it is relatively complex.
How do I specify SSL VPN Server mode?
Set
net.vpn.mode
to
SSL SERVER
.
How many VPNs can I configure?
The unit can be configured with up to 2 VPNs. The configuration settings for these VPNs are under the
net.vpn.*
key branch.
How many VPNs can I run at one time?
Although the unit supports multiple VPN configurations, only 1 VPN can be operational at any one time. The
setting that controls which VPN can be operational is the
net.vpn.active
key. It has values of VPN1, VPN2, or
NONE.
Am I using this VPN with SitePath?
The unit cannot use this feature to form a VPN with SitePath. If you need to use SitePath, let SitePath configure
the unit, which results in using the SSL VPN Client function.
Should my VPN start automatically when the unit starts?
If yes, then set
net.vpn[x].startmode
to
AUTO-PASSIVE
. If no then set it to MANUAL. When in MANUAL
startmode, start the VPN by setting
net.vpn[x].cmd
=1
. Note that this is different than manually starting an SSL
VPN client. Once started, the VPN will listen until told to stop (either by setting
net.vpn[x].cmd
=0
, or by the
unit resetting when the VPN is in MANUAL startmode).
Can multiple VPN clients connect to the unit?
Yes. You can enforce the maximum number of clients the unit will support with the “max-clients” OpenVPN
configuration item (configurable with the
net.vpn[x].ssl.conf
key, discussed below).
How do I know the VPN is working?
To check the status of the VPN, read the
net.vpn[x].status
key. It returns one of 3 values:
•
0 (which means the VPN is off)
•
1 (which means the unit is listenting for a VPN connection)
•
2 (which means the VPN is operational (and still listening for a VPN connection)
Note that the return value of 2 means the tunnel is up, but does not necessarily preclude configuration errors from
preventing VPN traffic to pass. So to ultimately know the VPN is operational, in addition to verifying
net.vpn.status
returns 2, you should also ping the client from the unit using the VPN address of the client. (Or
you can ping the unit from the client, using the VPN address of the unit.)
You can also use the
net.vpn[x].cmd
key to read the status of the VPN.
Do I need to give the VPN a name?
You may want to describe the VPN or give it a name; use the
net.vpn[x].description
key for that. This has
no functional purpose, it is just for making a note.
Содержание SiteBoss 530
Страница 6: ......
