• An external authentication server.An internal user database is easier to set up and is assumed here. Changing this to an externalserver is simple to do later.To implement user authentication with an internal database:• Define a Local User DB object (let's call this object TrustedUsers).• Add individual users to TrustedUsers. This should consist of at least a username andpassword combination.The Group string for a user can be specified if its group's access is to be restricted tocertain source networks. Group can be specified (with the same text string) in theAuthentication section of an IP object. If that IP object is then used as the SourceNetwork of a rule in the IP rule set, that rule will only apply to a user if their Group stringmatches the Group string of the IP object.NoteGroup has no meaning in Authentication Rules.• Create a new User Authentication Rule with the Authentication Source set toTrustedUsers. The other parameters for the rule are:Agent Auth Source Src Network Interface Client Source IPXAUTH Local all-nets any all-nets (0.0.0.0/0)2. The IPsec Tunnel object ipsec_tunnel should have the following parameters:• Set Local Network to lannet.• Set Remote Network to all-nets• Set Remote Endpoint to all-nets.• Set Encapsulation mode to Tunnel.• Set the IKE and IPsec algorithm proposal lists to match the capabilities of the clients.• No routes can be predefined so the option Dynamically add route to the remote networkwhen tunnel established should be enabled for the tunnel object. If all-nets is thedestination network, the option Add route for remote network should be disabled.NoteThe option to dynamically add routes should not be enabled in LAN to LANtunnel scenarios.• Enable the option Require IKE XAuth user authentication for inbound IPsec tunnels.This will enable a search for the first matching XAUTH rule in the authentication rules.3. The IP rule set should contain the single rule:Action Src Interface Src Network Dest Interface Dest Network ServiceAllow ipsec_tunnel all-nets lan lannet AllOnce an Allow rule permits the connection to be set up, bidirectional traffic flow is allowed which iswhy only one rule is used here. Instead of all-nets being used in the above, a more secure defined IP9.2.3. IPsec Roaming Clients withPre-shared KeysChapter 9. VPN326
