[TUTORIAL] Sophos XG Firewall - Konfigurasi IPsec VPN Site-to-Site Preshared Key

Hari ini saya dihadapkan dengan berdirinya salah satu group di Palembang, Sumatera Selatan. Dimana site tersebut membutuhkan koneksi ke Jakarta untuk mengakses beberapa server. Catatan ini akan menjelaskan langkah-langkah untuk mengkonfigurasi koneksi IPsec VPN menggunakan preshared key.
Berikut Topologi & Skenarionya:
Location | JAKARTA | PALEMBANG |
---|---|---|
Site | Head Office | Branch Office |
Device | Sophos XG 210 | Sophos XG 210 |
Device IP | 192.168.101.254 | 192.168.201.254 |
LAN Subnet | 192.168.101.0/24 | 192.168.201.0/24 |
LAN Port | Port6 | Port6 |
WAN Bandwidth | Dedicated 30 Mbps | Dedicated 10 Mbps |
WAN IP | 103.138.40.11 | 203.238.50.21 |
WAN Port | Port1 | Port1 |
IPsec Connection Type | Site-to-Site | Site-to-Site |
IPsec Gateway Type | Respond only | Initiate the connection |
IPsec Policy | DefaultHeadOffice | DefaultBranchOffice |
IPsec Authentication Type | Preshared key | Preshared key |
Oke lah kalau begitu, tanpa basa-basi lagi, langsung saja mari kita mulai konfigurasi...
1. XG210-JAKARTA - HEAD OFFICE
1.1. Login ke Sophos XG 210 Firewall, lalu tambahkan LAN Subnet Jakarta dan Palembang, klik SYSTEM Host and services ⇒ IP host ⇒ Add
- Local LAN (Jakarta Subnet)
- Remote LAN (Palembang Subnet)
- ⇒ Save
1.2. Buat IPsec VPN connection, klik CONFIGURE VPN ⇒ IPsec connections ⇒ Add
- General settings
- Name: VPN_PALEMBANG
- Description: via WANP1
- IP version: IPv4
- Connection type: Site-to-Site
- Gateway type: Respond only
- Active on save: checked
- Create firewall rule: unchecked
- Encryption
- Policy: DefaultHeadOffice
- Authentication type: Preshared key
- Preshared key: IPSecJktTOPlg098765
- Repeat preshared key: IPSecJktTOPlg098765
- Gateway settings
- Local gateway
- Listening interface: Port1 (WANP1)
- Local ID type: Select local ID (default)
- Local subnet ⇒ Add new item: 101.168.192_JKT
- Remote gateway
- Gateway address: 203.238.50.21
- Remote ID type: Select remote ID (default)
- Remote subnet ⇒ Add new item: 201.168.192_PLG
- Network Address Translation (NAT): unchecked
- Advanced
- User authentication mode: None
- ⇒ Save
1.3. Setelah itu, buat dua firewall rules IPsec VPN traffic, klik PROTECT Firewall (v17) / Rules and policies (v18) ⇒ + Add firewall rule ⇒ User/network rule
- 1.3.1. Group LAN to VPN
- Rule name *: LAN_VPN_PALEMBANG
- Action: Accept
- Rule position: Top
- Rule group: LAN to VPN
- Source
- Source zones * ⇒ Add new item: LAN
- Source networks and devices * ⇒ Add new item: 101.168.192_JKT
- During scheduled time: All the time
- Destination & services
- Destination zones * ⇒ Add new item: VPN
- Destination networks * ⇒ Add new item: 201.168.192_PLG
- Services *: Any
- Identity (v17)
- Match known users: unchecked
- Web malware and content scanning (v17) / Security features (v18)
- Unchecked all and none
- Advanced (v17) / Other security features (v18)
- Unchecked all and none
- Log traffic
- Log firewall traffic: checked
- ⇒ Save
1.3.2. Group VPN to LAN - Rule name *: VPN_LAN_PALEMBANG
- Action: Accept
- Rule position: Top
- Rule group: VPN to LAN
- Source
- Source zones * ⇒ Add new item: VPN
- Source networks and devices * ⇒ Add new item: 201.168.192_PLG
- During scheduled time: All the time
- Destination & services
- Destination zones * ⇒ Add new item: LAN
- Destination networks * ⇒ Add new item: 101.168.192_JKT
- Services *: Any
- Identity (v17)
- Match known users: unchecked
- Web malware and content scanning (v17) / Security features (v18)
- Unchecked all and none
- Advanced (v17) / Other security features (v18)
- Unchecked all and none
- Log traffic
- Log firewall traffic: checked
- ⇒ Save
2. XG210-PALEMBANG - BRANCH OFFICE
2.1. Login ke Sophos XG 210 Firewall, lalu tambahkan LAN Subnet Palembang dan Jakarta, klik SYSTEM Host and services ⇒ IP host ⇒ Add
- Local LAN (Palembang Subnet)
- Remote LAN (Jakarta Subnet)
- ⇒ Save
2.2. Buat IPsec VPN connection, klik CONFIGURE VPN ⇒ IPsec connections ⇒ Add
- General settings
- Name: VPN_JAKARTA
- Description: via WANP1
- IP version: IPv4
- Connection type: Site-to-Site
- Gateway type: Initiate the connection
- Active on save: checked
- Create firewall rule: unchecked
- Encryption
- Policy: DefaultBranchOffice
- Authentication type: Preshared key
- Preshared key: IPSecJktTOPlg098765
- Repeat preshared key: IPSecJktTOPlg098765
- Gateway settings
- Local gateway
- Listening interface: Port1 (WANP1)
- Local ID type: Select local ID (default)
- Local subnet ⇒ Add new item: 201.168.192_PLG
- Remote gateway
- Gateway address: 103.138.40.11
- Remote ID type: Select remote ID (default)
- Remote subnet ⇒ Add new item: 101.168.192_JKT
- Network Address Translation (NAT): unchecked
- Advanced
- User authentication mode: None
- ⇒ Save
2.3. Setelah itu, buat dua firewall rules IPsec VPN traffic, klik PROTECT Firewall (v17) / Rules and policies (v18) ⇒ + Add firewall rule ⇒ User/network rule
- 2.3.1. Group LAN to VPN
- Rule name *: LAN_VPN_JAKARTA
- Action: Accept
- Rule position: Top
- Rule group: LAN to VPN
- Source
- Source zones * ⇒ Add new item: LAN
- Source networks and devices * ⇒ Add new item: 201.168.192_PLG
- During scheduled time: All the time
- Destination & services
- Destination zones * ⇒ Add new item: VPN
- Destination networks * ⇒ Add new item: 101.168.192_JKT
- Services *: Any
- Identity (v17)
- Match known users: unchecked
- Web malware and content scanning (v17) / Security features (v18)
- Unchecked all and none
- Advanced (v17) / Other security features (v18)
- Unchecked all and none
- Log traffic
- Log firewall traffic: checked
- ⇒ Save
2.3.2. Group VPN to LAN - Rule name *: VPN_LAN_JAKARTA
- Action: Accept
- Rule position: Top
- Rule group: VPN to LAN
- Source
- Source zones * ⇒ Add new item: VPN
- Source networks and devices * ⇒ Add new item: 101.168.192_JKT
- During scheduled time: All the time
- Destination & services
- Destination zones * ⇒ Add new item: LAN
- Destination networks * ⇒ Add new item: 201.168.192_PLG
- Services *: Any
- Identity (v17)
- Match known users: unchecked
- Web malware and content scanning (v17) / Security features (v18)
- Unchecked all and none
- Advanced (v17) / Other security features (v18)
- Unchecked all and none
- Log traffic
- Log firewall traffic: checked
- ⇒ Save
2.4. Setelah mengkonfigurasi kedua sisi Firewall, sekarang cek Status koneksi IPsec VPN yang barusan dibuat di XG210-JAKARATA dan XG210-PALEMBANG, klik CONFIGURE VPN ⇒ IPsec connections
Jika Status Active dan Connection sudah berwarna hijau, sekarang coba test koneksi atau ping dari perangkat di belakang Firewall, misal dari PC Desktop lokal di Jakarta maupun Palembang untuk memastikan koneksi IPsec VPN Site-to-Site ini berjalan normal. Jika masih Request time out, silahkan cek Rules and Policies Firewall (LAN to VPN dan VPN to LAN).
Itu saja yang perlu dilakukan untuk membuat koneksi IPsec VPN menggunakan preshared key pada perangkat Sophos XG210, konfigurasi di atas bisa juga diterapkan pada Sophos XG Firewall Series. Semoga catatan ini bisa berguna untuk saya dan yang membacanya.