Suchen Sie etwas anderes?
Table of Contents
Scenario Details
From a PC it is intended to remotely access the configuration of a Titan 4G router and the configuration of a PLC that is connected to the Ethernet port of said Titan router. All this through a secure IPSec type connection. It is intended to use IKEv2 and PSK authentication.
Description of the Example
Basically with this example it is intended to create an IPSec VPN from a PC (which has an IPSec Client software such as TheGreenBow which is used in this example) against a remote Titan 4G router that will act as an IPSec Server which has a turn connected a PLC to its Ethernet port.
Configuration and Previous Requirements
The basic requirement to be able to carry out the application is that the SIM card inserted in the Titan router that will act as IPSec Server must have a public and static IP address. This is necessary to be able to access remotely from a PC connected to the public internet.
Router Titan IPSEC Configuration
In the VPN>IPSec menu, check the Enabled box at the beginning of this configuration page and press the SAVE CONFIG button.
Finally, since the IPSec service of the Titan router is based on strongswan, the files “ipsec.conf” and “ipsec.secrets” must be configured. The easiest thing is to go to the examples at the bottom of the page and obtain the example that is closest to what you want to configure. In the case of this application note, Example 2 is chosen, by clicking (downloading) the corresponding files ipsec.conf and ipsec.secrets, which we will open with a notepad to obtain their content.
Such content should be adapted to the example and inserted in the appropriate boxes. For ipsec.conf:
And for “ipsec.secrets” (previously you must click on the “Show/Hide” legend to show the box), we will set the text “mypass” as password:
And then the SAVE CONFIG button will be pressed, which will save the content of both files in the internal memory of the Titan router. Finally, if when the router was started up the IPSec service was not started (that is, the “Enabled” box was not active), the router must be completely rebooted (menu “Other> Reboot.” If the IPSec service was already started (box “ Enabled “active), only the“ RESTART IPSEC ”button can be pressed to restart the IPSec service with the new configuration without having to completely restart the router, a much faster option.
After restarting the router or pressing the “RESTART IPSEC” button (if the service was already active), the status of the IPSEC connection will appear as indicated below. If the Status box is blank, the service may not have started yet. Wait a few seconds and press the REFRESH button.
IPSEC Client Configuration
In this example, the popular TheGreenBow PC software will be used as the IPSec client software to connect against the Titan router. Below are some screenshots with the basic configuration of each section.
1. In the “Authentication” section of the IKEv2 type connection, the public IP address of the Titan router must be indicated (in the case of this example it is 176.80.171.249) and the authentication method by PSK (Preshared Key), with password “ mypass ”as specified in the file“ ipsec.secrets”.
2. In the “Protocol” section we configure it as DNS and enter the remote\’s ID as “titan”, since it is the name given to the router in the “leftid” field of the “ipsec.conf” file.
3. And finally, simply, in the “Child SA” tab we indicate that we want to obtain the configuration of the Titan router itself. Following this, it is now possible to open the IPSec tunnel by right-clicking on the connection and pressing the “Open tunnel” option as shown in the following screen.
Checking Connectivity
If the connection has been made successfully, all that remains is to check the connectivity, that is, from the IPSec client PC, it is possible to access both the Titan router (IP: 192.168.1.2) and the PLC that hangs from it (IP: 192.168 1,200). For this it is possible to perform a few simple PINGs.
Ping the Titan router through the IPSec VPN from the PC:
Ping the PLC through the IPSec VPN from the PC:
Enter the “ethernet” or “modem” connection type:
For an ethernet configuration, make sure the IP parameters are compatible with server access according to the concentrator local network configuration. For an ethernet connection, the configuration must be compatible with the concentrator’s local network topology so that it can access the servers. This configuration is done from the “Networks” configuration page (see section 3.2.2.3: “Networks”).
For a modem connection, the modem configuration must be correct before a connection can be set up. This configuration is done from the “Modem” configuration page (see section 3.2.2.4: “Modem”).
The parameters for the servers to be configured are at least the following:
Therefore the following fields need to be configured: “Interface”, “Type”, “Server type”, “Address”, “Port”, “Login” and “Password”.
The other fields can be left at the default values subject to the directories having been properly created beforehand. See section 3.1.2: “Configuration files” for more details.
Wait. The concentrator will reboot using its factory configuration.
Esperar. El concentrador arrancará con su configuración de fábrica.
Warten Sie. Der Hub startet nach ein paar Augenblicken mit der Werkseinstellung neu.
Attendre. Le concentrateur va redémarrer avec sa configuration usine.
