This is a "how to" guide if you're looking for information on how to set up the Astaro Security Gateway v8.305 (the version that I am currently using) to support the Apple iOS (iPhone, iPad, iPod Touch) VPN On Demand feature.
In my case, the problem that I am looking to solve is to create a Remote Access / VPN set up that will always create a VPN session whenever my phone engages the Internet. I want this capability so that I can safely use foreign / non-trusted Wi-Fi hotspots. And, the VPN On Demand feature is critical because iPhone will disconnect your VPN session, if manually established, and won't let you know and apps on the phone will happily still engage with the Internet without VPN access.
Step 1 - Create a New User
Definitions & Users >> Users & Groups.
Username: (define a user name)
Real Name: (add the real name)
Email Address: (add the email address)
Authentication: Local
Password: (set the password)
Repeat: (repeat the password)
X509 Cert: username (X509 User Cert)
Note that I am not using a Static Remote IP but defaulting to the VPN Pool (Cisco) range which is separate and distinct from any IP addresses that I use elsewhere in the ASG.
Step 2 - Turn on Cisco VPN Client
Remote Access >> Cisco VPN Client >> Global
Interface: External (WAN)
Server Certificate: Local X509 Cert
Pool Network: VPN Pool (Cisco)
Local Networks: Internal (LAN)
Users and Groups: (add the user created in Step 1)
Automatic Firewall Rules: checkmark the box
Enable
Remote Access >> Cisco VPN Client >> iOS devices
Connection name: Company Name (IPSec)
Override Hostname: asg.companyname.com
Establish VPN connection on demand: checkmark the box
Match domain or host: .com, .org, .us, .net, .co
Ok. Let's talk about this domain / host list. First, there isn't a way that I know to say "any top level domain", so you have to itemize the list. That's clearly a pain, but you can probably get good coverage by putting in the most common ones. (This is all going to change, by the way, once ICANN starts implementing vanity TLDs. Sigh.)
Next, it's important to know that Apple iOS allows three different states for this list of domains / hosts. Always establish (a VPN connect), establish if needed, and never establish. The Astaro Security gateway defaults to "establish if needed" which means that a VPN session is established if a DNS lookup fails. This clearly doesn't meet my use case, so we will have to fix that later since ASG doesn't allow us to use "always establish" or "never establish". More on that later.
Step 3 - Define DNS servers for VPN Use
Remote Access >> Advanced
DNS Server #1: 208.67.222.222
DNS Server #2: 208.67.220.220
I use OpenDNS. Those are their DNS servers.
Step 4 - Configure NAT
Network Security >> NAT >> Masquerading
Add a new rule with the following parms:
Network: VPN Pool (Cisco)
Position: 2 (or wherever you want to put it)
Interface: External (WAN)
Use Address: << primary address >>
Turn it on.
Step 5 - Log On to User Portal
In your browser, go to https://asg.companyname.com and log in as the user that you defined in Step 1 above. Click Remote Access at the top. Use the iOS device VPN Configuration box. Enter a password and click install. (This password you will enter again on your iOS device to install the VPN config information. You will not need it again.)
Use your desktop PC / Mac browser for this. Don't use your iOS device. This step differs from that in the Astaro documentation / guides because we need to open the .mobileconfig file generated by pressing "Install" to add the password.
Click "Install". The file is downloaded to your downloads folder. If your Mac tries to install the file in System Preferences, cancel out of it.
Step 6 - Change to "Always Establish" for Domain / Host List
Open the .mobileconfig File with iPhone Configuration Utility. iPhone Config Utility gives me an error about entries that cannot be managed by the app. Override Primary of 1. I am not sure what that is and opened up another thread on the bulletin board here for that. Click Import.
Now, go to Config Profiles, VPN. It should have a payload there that says something like this:
Connection Name: Company Name (IPSec)
Connection Type: IPsec (Cisco)
Server: asg.companyname.com
Account: (your username from Step 1)
Machine Auth: Certificate with credential of "username.p12"
Include User PIN: not checked
Enable VPN On Demand: checked
Now, change every value under "On Demand Action" from "Establish if needed" to "Always establish".
When you're done, export the file (don't sign it) and save it on your hard drive.
Step 7 - Edit the .mobileconfig File to Add the Password
Open the .mobileconfig file in TextWranger (or whatever text editor you want to use). Search for "xauthname" and it will take you to a line that looks like this:
<key>XAuthName</key>
<string>username</string>
You need to add these two lines immediate after the above two lines:
<key>XAuthPassword</key>
<string>passwordhere</string>
(Ok, policy issues aside, if you don't make this edit EVERYTIME your VPN session wants to auto connect it will force you to enter a password. This is not the behavior that I want, so I add the password to the .mobileconfig file.)
Save the file.
Step 8 - Email the .mobileconfig File to Yourself (Mac to iPhone)
On the iPhone, click the attachment in the message that you sent to yourself to install the profile on your iPhone. Go to Settings >> General >> Network >> VPN to see that you now have a VPN profile installed called Company Name (IPSec). If you click the right arrow, you have one option to Connect On Demand. So, that domain / host list that we entered on the ASG and then edited in the iPhone Config Utility is in the profile but you cannot edit it on the iPhone.
Step 9 - Enjoy
That should be everything! I don't think that I have missed anything, but there are quite a few steps there to work around the ASG limitations / bugs to get this working correctly.
I hope that this information is helpful.
To my Astaro / Sophos friends:
You have done a wonderful thing by creating the User Portal to generate the .mobileconfig file. I cannot imagine not having it. Thank you.
There are also some issues / bugs that should be addressed such as (a) allowing the use of "always establish" and "never establish" in the domain / hosts list, (b) fixing the bug (?) that iPhone Configuration Utility throws when importing the .mobileconfig file, and (c) supporting a cached password or adding the password directly to the .mobileconfig file.
In my case, the problem that I am looking to solve is to create a Remote Access / VPN set up that will always create a VPN session whenever my phone engages the Internet. I want this capability so that I can safely use foreign / non-trusted Wi-Fi hotspots. And, the VPN On Demand feature is critical because iPhone will disconnect your VPN session, if manually established, and won't let you know and apps on the phone will happily still engage with the Internet without VPN access.
Step 1 - Create a New User
Definitions & Users >> Users & Groups.
Username: (define a user name)
Real Name: (add the real name)
Email Address: (add the email address)
Authentication: Local
Password: (set the password)
Repeat: (repeat the password)
X509 Cert: username (X509 User Cert)
Note that I am not using a Static Remote IP but defaulting to the VPN Pool (Cisco) range which is separate and distinct from any IP addresses that I use elsewhere in the ASG.
Step 2 - Turn on Cisco VPN Client
Remote Access >> Cisco VPN Client >> Global
Interface: External (WAN)
Server Certificate: Local X509 Cert
Pool Network: VPN Pool (Cisco)
Local Networks: Internal (LAN)
Users and Groups: (add the user created in Step 1)
Automatic Firewall Rules: checkmark the box
Enable
Remote Access >> Cisco VPN Client >> iOS devices
Connection name: Company Name (IPSec)
Override Hostname: asg.companyname.com
Establish VPN connection on demand: checkmark the box
Match domain or host: .com, .org, .us, .net, .co
Ok. Let's talk about this domain / host list. First, there isn't a way that I know to say "any top level domain", so you have to itemize the list. That's clearly a pain, but you can probably get good coverage by putting in the most common ones. (This is all going to change, by the way, once ICANN starts implementing vanity TLDs. Sigh.)
Next, it's important to know that Apple iOS allows three different states for this list of domains / hosts. Always establish (a VPN connect), establish if needed, and never establish. The Astaro Security gateway defaults to "establish if needed" which means that a VPN session is established if a DNS lookup fails. This clearly doesn't meet my use case, so we will have to fix that later since ASG doesn't allow us to use "always establish" or "never establish". More on that later.
Step 3 - Define DNS servers for VPN Use
Remote Access >> Advanced
DNS Server #1: 208.67.222.222
DNS Server #2: 208.67.220.220
I use OpenDNS. Those are their DNS servers.
Step 4 - Configure NAT
Network Security >> NAT >> Masquerading
Add a new rule with the following parms:
Network: VPN Pool (Cisco)
Position: 2 (or wherever you want to put it)
Interface: External (WAN)
Use Address: << primary address >>
Turn it on.
Step 5 - Log On to User Portal
In your browser, go to https://asg.companyname.com and log in as the user that you defined in Step 1 above. Click Remote Access at the top. Use the iOS device VPN Configuration box. Enter a password and click install. (This password you will enter again on your iOS device to install the VPN config information. You will not need it again.)
Use your desktop PC / Mac browser for this. Don't use your iOS device. This step differs from that in the Astaro documentation / guides because we need to open the .mobileconfig file generated by pressing "Install" to add the password.
Click "Install". The file is downloaded to your downloads folder. If your Mac tries to install the file in System Preferences, cancel out of it.
Step 6 - Change to "Always Establish" for Domain / Host List
Open the .mobileconfig File with iPhone Configuration Utility. iPhone Config Utility gives me an error about entries that cannot be managed by the app. Override Primary of 1. I am not sure what that is and opened up another thread on the bulletin board here for that. Click Import.
Now, go to Config Profiles, VPN. It should have a payload there that says something like this:
Connection Name: Company Name (IPSec)
Connection Type: IPsec (Cisco)
Server: asg.companyname.com
Account: (your username from Step 1)
Machine Auth: Certificate with credential of "username.p12"
Include User PIN: not checked
Enable VPN On Demand: checked
Now, change every value under "On Demand Action" from "Establish if needed" to "Always establish".
When you're done, export the file (don't sign it) and save it on your hard drive.
Step 7 - Edit the .mobileconfig File to Add the Password
Open the .mobileconfig file in TextWranger (or whatever text editor you want to use). Search for "xauthname" and it will take you to a line that looks like this:
<key>XAuthName</key>
<string>username</string>
You need to add these two lines immediate after the above two lines:
<key>XAuthPassword</key>
<string>passwordhere</string>
(Ok, policy issues aside, if you don't make this edit EVERYTIME your VPN session wants to auto connect it will force you to enter a password. This is not the behavior that I want, so I add the password to the .mobileconfig file.)
Save the file.
Step 8 - Email the .mobileconfig File to Yourself (Mac to iPhone)
On the iPhone, click the attachment in the message that you sent to yourself to install the profile on your iPhone. Go to Settings >> General >> Network >> VPN to see that you now have a VPN profile installed called Company Name (IPSec). If you click the right arrow, you have one option to Connect On Demand. So, that domain / host list that we entered on the ASG and then edited in the iPhone Config Utility is in the profile but you cannot edit it on the iPhone.
Step 9 - Enjoy
That should be everything! I don't think that I have missed anything, but there are quite a few steps there to work around the ASG limitations / bugs to get this working correctly.
I hope that this information is helpful.
To my Astaro / Sophos friends:
You have done a wonderful thing by creating the User Portal to generate the .mobileconfig file. I cannot imagine not having it. Thank you.
There are also some issues / bugs that should be addressed such as (a) allowing the use of "always establish" and "never establish" in the domain / hosts list, (b) fixing the bug (?) that iPhone Configuration Utility throws when importing the .mobileconfig file, and (c) supporting a cached password or adding the password directly to the .mobileconfig file.