2.5 Integrated VPN Service

The Integrated VPN feature is a security enhancement, which creates a Virtual Private Network to encrypt network traffic and provide connectivity between remote components of an OpenScape 4000 (OS4K) system.
If enabled this feature will set-up a VPN network between OS4K Host system and SoftGates, which will encrypt any traffic between the vHG boards and CSTA.
To enable the Integrated VPN feature, navigate to OS4K Portal > System > Intagrated VPN Service:
Figure 24
LAN Configuration
To get into the LAN Configuration menu, please navigate to System > LAN Configuration > System, then with Deployment chosen click Next.
Figure 25
HW Platform screen
Figure 26
LAN
Click Next until you reach the Internal LAN menu:
Figure 27
Internal LAN
To enable Integrated VPN service
1.
Check the Integrated VPN checkbox.
2.
Make sure that the Internal VPN subnet does not collide with any other subnets in your network.
3.
If you performed any changes, click Submit.
IMPORTANT:  Ensure that SoftGates and OS4K Host have Secure Mode disabled.(It can be enabled later, when the VPN auto-configuration is complete.)
You can also activate SBC feature here.
VPN Clients
VPN Clients can be managed in this section and the current status can be observed, (e.g. connection and certificate validity).
This page provides global controls to restart the VPN server or regenerate all clients.
The individual clients can be revoked, regenerated or deleted in the Advanced section.
A custom VPN client can be created in the dialog. The client is used for connecting other products to OS4k CSTA via a secure channel.
1.
Check the VPN server status, restart the VPN server
2.
Manage and observe the status of the VPN clients
3.
Create a new custom VPN client.
Check the status of VPN Server and clients:
1.
Server status should be running
2.
All clients Status should be „Connected.“
Certificate expiration
The certificates generated by the Integrated VPN expire in ten years from the time they are generated.
You can check the certificate’s expiration dates in the columns Valid From and Valid Until on the VPN Clients page:
If the certificate expires, the client will not be able to connect to the VPN and the certificate will need to be regenerated.
Certificates and secret keys are stored in the Central Host filesystem. The directory is readable only to the root user. In Duplex deployments this directory is shared between the two nodes of Central Host over DRBD.
Firewall consideration
The TCP port 1194 for NGS IP address on Central Host needs to be open and accessible from Central Host nodes to SoftGates.
The OpenVPN clients use an ephemeral TCP port for connecting to the VPN server.
Dropping of unencrypted traffic
Once the Integrated VPN has been enabled and successfully setup, the firewall on SoftGate should drop any traffic for CSTA not sent over VPN. This means the CSTA traffic is dropped from physical interfaces.
This is to ensure, that some directed DoS attack on the OpenVPN component cannot be used to push the system into unencrypted mode.
Revoking client key
If a client certificate or client machine (i.e. some SoftGate) is suspected to be compromised by an attacker, the validity of the given clients’ certificates should be revoked.
This can be done in the Advanced menu of the given client in the Integrated VPN Service Portal page.
Regenerate all client keys
If you suspect that all VPN clients have been compromised, then you can use the Regenerate all Clients button. This will also generate a new certificate authority that is used for signing the server and client keys. This action makes any compromised keys inaccessible for an attacker.
NOTE:  This action can take up to ten minutes to complete. The VPN service is down until finished.
Platform Administration (Portal), ID: P31003-H31A0-M101-03-76A9
Copyright © Unify Software and Solutions GmbH & Co. KG 07/2020  -  All rights reserved.