BiGuard C01 BiGuard VPN Client Quick Installation Guide (BiGuard series VPN enabled devices) Secure access to Company Network
Your network is constantly evolving as you integrate more business applications and consolidate servers. In that environment, it is becoming extremely complex to maintain total security at the edge while users being employees or Teleworkers on the go are working with customers and partners. You need to get access to those applications and servers quickly, easily and securely. BiGuard VPN Client is an on demand IPSec VPN Client, compliant with Billion BiGuard series VPN enabled devices.
Billion BiGuard VPN enabled devices – VPN Configuration After connected to your Billion BiGuard VPN enabled devices, you must select the menu: 【Configuration】→ 【IPSec】. Click and add a new IPSec VPN setting as below. Connection Name: A user-defined name for the connection (e.g. “BiGuardVPN”).
Data: Input ID’s information, like domain name www.ipsectest.com. Network: Set the Any local address, subnet or single address of the local network. ~Any Local Address: All IP address of the local network ~ Subnet: The subnet of the local network. For example, IP: 192.168.100.0 with netmask 255.255.255.0 specifies one class C subnet starting from 192.168.100.1 (i.e. 192.168.100.1 through to 192.168.100.254). ~ Single Address: The IP address of the local host.
Perfect Forward Secrecy: Choose whether to enable PFS using Diffie-Hellman public-key cryptography to change encryption keys during the second phase of VPN negotiation. This function will provide better security, but extends the VPN negotiation time. Diffie-Hellman is a public-key cryptography protocol that allows two parties to establish a shared secret over an unsecured communication channel (i.e. over the Internet). There are two modes, MODP 768-bit, and MODP 1024-bit.
BiGuard VPN Client Configuration – Phase 1 Configuration “Authentication” or “Phase 1” window will concern settings for Authentication Phase or Phase 1. It is also called IKE Negotiation Phase. Phase 1's purpose is to negotiate IKE policy sets, authenticate the peers, and set up a secure channel between the peers. As part of Phase 1, each end system must identify and authenticate itself to the other.
IKE key group: Diffie-Hellman key length. You must also add phase 1 IDs in “P1 Advanced” window, if the BiGuard VPN Client from a LAN. Config-Mode : If checked, the VPN Client will activate Config-Mode for this tunnel. Config-Mode allows to the VPN Client to fetch some VPN Configuration information from the VPN gateway like DNS/WINS server IP addresses. In case Config-Mode is not available on the remote gateway, please refer to section 'Phase2 Advanced' settings to manually set DNS/WINS server addresses.
DPD detects non-responding remote gateways) the VPN Client immediately starts opening a new tunnel with the redundant gateway. z The exact same behaviour will apply to the redundant gateway. This means that the VPN Client will try to open primary and redundant gateway until the user exits software or click on 'Save & Apply'. IKE port: Negotiation port for IKE. Default value is 500. Local ID: Local ID is the identity the BiGuard VPN client is sending during Phase 1 to VPN gateway.
BiGuard VPN Client Configuration – Phase 2 Configuration “IPSec Configuration” or “Phase 2” window will concern settings for Phase 2. The purpose of Phase 2 is to negotiate the IPSec security parameters that are applied to the traffic going thought tunnels negotiated during Phase 1. Name: Label for IPSec Configuration only used by the VPN client. This parameter is never transmitted during IPSec Negotiation. It is possible to change this name at any time and read it in the tree list window.
ESP mode: IPSec encapsulation mode : tunnel. PFS group: Diffie-Hellman key length. For more advanced settings, click on 'P2 Advanced'. Automatic Open Mode : The VPN Client can automatically open the specified tunnel (Phase2) on specific events such as: z Auto open this tunnel when the VPN Client starts up. z Auto open this tunnel when USB stick is inserted. z Auto open this tunnel when the VPN Client detect traffic towards remote LAN. Open Script : A specific script or application (e.g.
Open IPSec VPN Tunnels Once both Billion BiGuard VPN enabled devices and BiGuard VPN Client has been configured accordingly, you are ready to open VPN tunnels. First make sure you enabled your firewall with IPSec traffic. 1. Clink on Client Configuration. to make into account all modifications we’ve made on your VPN 2. Click on , or generate traffic that will automatically open a secure IPSec VPN Tunnel (e.g. ping, IE browser). 3. Select to see opened VPN Tunnels.
Configuration Wizard Seven easy steps Wizard BiGuard VPN client provides a Configuration Wizard that allows the creation of VPN configuration in seven easy steps. This Configuration Wizard is designed for remote computers that need to get connected to a corporate LAN through a VPN gateway. Let take the following example: The remote computer has a dynamically provided public IP address. It tries to connect the Corporate LAN behind a VPN gateway that has a DNS address "gateway.mydomain.com".
Step 1 of 7 You need to specify the following information: The public (network side) address of the remote gateway Address (In IP or Domain name). (e.g. specify gateway.mydomain.com) The Preshared-key you will use for this tunnel (this Preshared-key must be the same in the gateway). Step 2 of 7 You must specify the following information: The IP address of your remote gateway LAN Network address (e.g. specify 192.168.1.0).
Step 3 of 7 You need to input this VPN Client IP address that will be used to identify the client in the VPN connection (e.g. specify 192.100.205.101). Be sure that each client must use different VPN Client IP Address. Warning Step 4 of 7 The fourth step summaries your new VPN configuration. Other parameters may be further configured directly via the main interface (e.g.virtual IP address, etc..).
Step 5 of 7 As for BiGuard side, please go to >Configuration >VPN >IPSec >IPSec Wizard And input Connection Name (BiGuardVPN as example), and PreShared Key(12345678 as example), and select LAN to Host(For BiGuard VPN Client Only), then press Next. Step 6 of 7 Input BiGuard VPN Client IP Address. (195.100.205.101 as example) and press Next. Be sure that each client must use different VPN Client IP Address.
Step 7 of 7 After all, you will see a Configuration Summary, click Done too apply this rule.
Appendix A – Compatible table of Billion BiGuard VPN enabled devices & BiGuard VPN Client Hash algorithms MD5 SHA1 Encryption DES 3DES AES 128 AES 192 AES 256 Diffie Hellman Group Support Group1: MODP 768 Group2: MODP 1024 Group5: MODP 1536 Authentication Mechanism Preshared key X509 Certificate support (PEM) X-Auth Key Management ISAKMP (RFC2408) IKE (RFC2409) IPSec Mode ESP Tunnel IKE Mode Main Aggressive Quick x = not support BiGuard 2 BiGuard 10 BiGuard 30 v v v v v v v v v v v v v v v v v v v
Appendix B – Product Support and Contact Information Referring to the Troubleshooting section in the User’s Manual can solve most problems. If you cannot resolve the problem with the Troubleshooting chapter, please contact the dealer where you purchased this product. Contact Billion WORLDWIDE http://www.billion.
