Send system-generated authentication requests through IPsec VPN

When you use a policy-based VPN, you must configure the branch office firewall to translate its LAN interface address to the destination AD server. The firewall sends this traffic to the IPsec tunnel.

If the traffic isn't sent to the tunnel because of the route precedence you specified, configure an IPsec route.

Translate the LAN interface

You must configure Source Network Address Translation (SNAT) for system-generated traffic, such as authentication requests, using the CLI.

To translate the LAN interface to the head office AD server address, do as follows:

1. Sign in to the CLI, enter 4 for Device Console, and run the following command:

   set advanced-firewall sys-traffic-nat add destination <destination IP or network address> snatip <source IP address to translate>
   

   Example

   set advanced-firewall sys-traffic-nat add destination 10.10.2.15 snatip 10.10.1.1
   

2. Make sure you've selected the LAN interface in the VPN configurations as follows:

   1. Local subnet in the branch office firewall
   2. Remote subnet in the head office firewall

You can use a route-based tunnel with any-to-any subnets.

Branch office: Add an SD-WAN route

Configure an SD-WAN route to send authentication queries to the XFRM interface as follows:

1. Go to Routing > SD-WAN routes and click Add.
2. Enter a Name.
3. Set Source networks to Any.

4. Set Destination networks to the IP host for the AD server. To configure the IP host, do as follows:

   1. Click Add new item and clear Any.
   2. Click Add and enter a Name.
   3. For IP address, enter 10.10.2.15
   4. Click Save.

5. For Services, create an object for TCP port 636 (the default port for secure AD and LDAP authentication).

   Do as follows:

   1. Click Add new item and clear Any.
   2. Click Add and click Services.
   3. Enter a Name.
   4. For Destination port, enter 636.

   5. Click Save.

      

6. Under Link selection settings, select Primary and backup gateways.

7. Click the drop-down list for Primary gateway and click Add.

8. Do as follows:

   1. Enter a name.
   2. For Gateway IP, enter the head office XFRM IP address (3.3.3.3).

   3. For Interface, select the XFRM interface you've configured on this firewall (example: xfrm1_3.3.3.4).

      

   4. If you want Health check on, for Monitoring condition, enter the AD server's IP address (10.10.2.15).

      

9. Select Route only through specified gateways.

   The firewall then drops traffic if the tunnel isn't available.

10. Click Save.

Branch office: Turn on ping through VPN

1. Go to Administration > Device access.
2. Under Ping/Ping6, select the checkbox for VPN.
3. Click Apply.

Branch office: Translate the gateway used by default

Translate (source NAT) the branch office firewall's gateway addresses to the XFRM interface address for system-generated traffic to the head office AD server.

Enter the following command:

set advanced-firewall sys-traffic-nat add destination <Destination or network IP address> snatip <NATed IP>

Head office: Add an SD-WAN route

Configure an SD-WAN route to send authentication queries to the XFRM interface as follows:

1. Go to Routing > SD-WAN routes and click Add.
2. Enter a Name.
3. Set Source networks to the IP host for the AD server (10.10.2.15).
4. Set Destination networks to the IP host for the LAN interface to which you've translated on the branch office firewall (10.10.1.1).

5. For Services, create an object for TCP port 636 (the default port for secure AD and LDAP authentication.)

   Do as follows:

   1. Click Add new item and clear Any.
   2. Click Add and click Services.
   3. Enter a Name.
   4. For Destination port, enter 636.
   5. Click Save.

   

6. Under Link selection settings, select Primary and backup gateways.

7. Click the drop-down list for Primary gateway and click Add.

8. Do as follows:

   1. Enter a name.
   2. For Gateway IP, enter the branch office XFRM IP address (3.3.3.4).

   3. For Interface, select the XFRM interface you've configured on this firewall (example: xfrm1_3.3.3.3).

      

   4. If you want Health check on, for Monitoring condition, enter an IP address in the branch office LAN (10.10.1.10).

      

9. Select Route only through specified gateways.

   The firewall then drops traffic if the tunnel isn't available.

10. Click Save.

Head office: Turn on ping through VPN

1. Go to Administration > Device access.
2. Under Ping/Ping6, select the checkbox for VPN.
3. Click Apply.

Head office: Outbound firewall rule

Configure a firewall rule to allow outbound traffic on the head office firewall. This allows the AD server to send its replies through the route-based VPN tunnel.

Select the following:

1. Source zones: DMZ
2. Source networks and devices: ADServer
3. Destination zones: VPN
4. Destination networks: BO_LAN
5. Services: AD_LDAP

6. Click Save.

   Here's an example:

   

Head office: Inbound firewall rule

Configure a firewall rule to allow inbound traffic on the head office firewall. Authentication queries received through the route-based VPN tunnel are then sent to the AD server.

Select the following:

1. Source zones: VPN
2. Source networks and devices: BO_LAN
3. Destination zones: DMZ
4. Destination networks: ADServer
5. Services: AD_LDAP

6. Click Save.

   Here's an example: