[[Include(WikiToC)]]
=== IPSEC VPN === #setup

We maintain point to point connections to link various resources to the testbed, mostly at layer 2 for networking experiments. This consists of dialable links over internet2, as well as tunnels over the public internet.

==== User VPN Service

Connect to the following endpoints using your COSMOS username and password. This will only be active during your reservation.

 ||   Server                  ||  Subnet         ||  Description        ||
 || vpn.bed.cosmos-lab.org    ||  10.110.0.0/16  ||  COSMOS Main Testbed ||
 || vpn.sb1.cosmos-lab.org    ||  10.37.0.0/16  ||  COSMOS SB1 ||
 || vpn.sb2.cosmos-lab.org    ||  10.116.0.0/16  ||  COSMOS SB2 ||


==== Instructions per Client OS

[[CollapsibleStart(Windows)]]

Windows !PowerShell commands for specific testbed domains:

  ||  Domain  ||  Windows !PowerShell Commands  ||
  || SB1    || {{{ Add-VpnConnection -Name "COSMOS SB1" -ServerAddress vpn.sb1.cosmos-lab.org -DnsSuffix sb1.cosmos-lab.org -TunnelType IKEv2 -EncryptionLevel Required -AuthenticationMethod EAP -SplitTunneling -RememberCredential -PassThru}}}[[BR]]{{{ Add-VpnConnectionRoute -ConnectionName "COSMOS SB1" -DestinationPrefix 10.37.0.0/16 -PassThru}}} ||
  || SB2    || {{{ Add-VpnConnection -Name "COSMOS SB2" -ServerAddress vpn.sb2.cosmos-lab.org -DnsSuffix sb2.cosmos-lab.org -TunnelType IKEv2 -EncryptionLevel Required -AuthenticationMethod EAP -SplitTunneling -RememberCredential -PassThru }}} [[BR]]{{{ Add-VpnConnectionRoute -ConnectionName "COSMOS SB2" -DestinationPrefix 10.116.0.0/16 -PassThru}}}  ||
  || Main Testbed || {{{ Add-VpnConnection -Name "COSMOS Main Testbed" -ServerAddress vpn.bed.cosmos-lab.org -DnsSuffix bed.cosmos-lab.org -TunnelType IKEv2 -EncryptionLevel Required -AuthenticationMethod EAP -SplitTunneling -RememberCredential -PassThru }}} [[BR]]{{{ Add-VpnConnectionRoute -ConnectionName "COSMOS Main Testbed" -DestinationPrefix 10.110.0.0/16 -PassThru}}}  
||

Open the !PowerShell command window as administrator

[[Image(PowerShell1.png, 600px)]]

Cut and paste the pair of commands into the !PowerShell window as show in figure below:

[[Image(PowerShell2.png, 600px)]]

Alternatively, [download the Windows !PowerShell script] to your local machine, right-click on it and run it as administrator. This will create three VPN connections for the three COSMOS domains.

Once VPN connection(s) are created, you will be able to bring the connection menu up by left mouse click on the network icon on the Windows task bar:

[[Image(VPN1.png, 300px)]]

Selecting the appropriate connection (for which you must have current reservation) will bring up the prompt for username and password (only the very first time that particular VPN connection is activated):


[[Image(VPN2.png, 300px)]] 

[[CollapsibleEnd]]

[[BR]]

[[CollapsibleStart(Linux)]]
Instructions are provided for configuring the strongswan network manager plugin. Strongswan is an IKE daemon which can be used to set up an IPSEC tunnel. The strongswan package is available for a variety of linux distros, and can be configured manually through files in /etc instead of installing the network manager plugin. See [https://wiki.strongswan.org/projects/strongswan/wiki/UsableExamples this page] on the strongswan wiki for examples. 

These instructions are specific to ubuntu 20.04, although they should be similar for other versions of ubuntu. Additional linux distros which use network-manager may provide a version of the plugin through their packaging system.

To install the plugin, run {{{apt-get install network-manager-strongswan}}}.

Open settings and navigate to the Network tab. Below wired connections, there should be a section for VPN connections. Select the "+" to add a new VPN connection.

[[Image(settings.png, 800px)]] 

Fill in the connection information as below, making sure to use your cosmos username and select the correct domain (e.g. vpn.sb1.cosmos-lab.org)

[[Image(strongswanconfig.png, 500px)]] 

In the IPv4 tab, you can configure manual routes or you can simply check the option to "Use this connection only for resources on its network".

The VPN can be enabled and disabled through the entry in network settings:

[[Image(vpnenable.png, 500px)]] 

When you enable the vpn, you will be prompted to enter the password for your cosmos username. 

Note: there has been some difficulty with DNS resolution over the vpn connection. If you encounter this problem, please let us know. Until the issue is resolved, you can use ip addresses instead of dns names. To find the ip address of a machine, use the host utility to query the dns server located at 10.50.0.8:

[[Image(hostlookup.png, 500px)]] 
 

[[CollapsibleEnd]]

[[BR]]

[[CollapsibleStart(MacOS)]]
 Coming soon
[[CollapsibleEnd]]