Configuring Policy for Remote Access VPN

Step 1 - Create a Security Gateway/Cluster object

1. Install the required Security Gateway / Cluster Members and configure their interfaces.

For more information, see the R82 Installation and Upgrade Guide.

2. In SmartConsole, create a new object.

For more information, see the R82 Security Management Administration Guide.

3. Establish the Secure Internal Communication (SIC).

4. Get the interfaces and configure their topology settings.

For more information, see the R82 Gaia Administration Guide.

Step 2 - Configure the required Remote Access VPN settings in the Security Gateway / Cluster object

1. Create a Security Gateway network object.

2. On the General Properties page, select VPN.

3. Initialize a secure communication channel between the VPN module and the Security Management Server by clicking Communication.

4. On the Topology page, define the interfaces and the VPN domain.

The ICA automatically creates a certificate for the Security Gateway.

Step 3 - Configure the applicable Host, Network, Group, User and Access Role objects

Step 4 - Configure the Remote Access VPN Community

1. From the Objects Bar, click VPN Communities.

2. Double-click RemoteAccess.

The Remote Access window opens.

3. On the Participating Gateways page, click the Add button and select the Security Gateways that are in the Remote Access Community.

4. On the Participating User Groups page, click the Add button and select the group that contains the Remote Access users.

5. Click OK.

6. Publish the changes.

Step 5 - Configure the applicable Access Control rules

These rules apply to traffic from the Remote Access VPN clients to internal resources behind the Security Gateway.

Example:

Step 6 - Install the Access Control Policy

In SmartConsole, install the Access Control Policy on the Security Gateway/Cluster object.

Step 7 - Optional: Advanced Configuration

The encryption properties of the VPN tunnels in a Remote Access community are set by default. You can modify the encryption processes globally for all users, or configure the properties per user.

To modify the VPN tunnel encryption properties globally:

1. From Menu, click Global Properties.

2. From the navigation tree, click Remote Access > VPN- Authentication and Encryption.

3. Select an Encryption Method:

   • IKEv2 only

| | | | --- | --- | | | Important - If you select this option, Remote Access clients that do not support IKEv2 cannot connect to the VPN Gateway. |

• Prefer IKEv2, support IKEv1

Remote Access clients that support IKEv2 use IKEv2 to connect to the VPN Gateway. Remote Access clients that do not support IKEv2 use IKEv1 to connect to the VPN Gateway.

• IKEv1 only (selected by default)

4. From the Encryption algorithms section, click Edit.

5. In the IKE Security Association (Phase 1) tab, configure the applicable settings:

   • Support encryption algorithms - Select the encryption algorithms that will be supported with remote hosts.
   • Use encryption algorithms - Choose the encryption algorithm that will have the highest priority of the selected algorithms. If given a choice of more than one encryption algorithm to use, the algorithm selected in this field will be used.
   • Support Data Integrity - Select the hash algorithms that will be supported with remote hosts to ensure data integrity.
   • Use Data Integrity - The hash algorithm chosen here will be given the highest priority if more than one choice is offered.
   • Support Diffie-Hellman groups - Select the Diffie-Hellman groups that will be supported with remote hosts.
   • Use Diffie-Hellman group - Client users utilize the Diffie-Hellman group selected in this field.

6. Click OK.

7. Install policy.

To configure encryption policies for specified users:

1. Open Global Properties, and click Remote Access > Authentication and Encryption.

2. From the Encryption algorithms section, click Edit.

3. In the Encryption Properties window, click the IPSEC Security Association (Phase 2) tab.

4. Clear Enforce Encryption Algorithm and Data Integrity on all users.

5. Click OK and close the Global Properties window.

6. For each user:

   1. From the Objects Bar, double-click the user.

   2. From the navigation tree, click Encryption.

   3. Click Edit.

      The IKE Phase 2 Properties window is displayed.

   4. Click the Encryption tab.

   5. Click Defined below.

   6. Configure the Encryption Algorithm and Data Integrity.

   7. Click OK and close the User Properties window.

7. Install policy.

23 October 2025