Oracle Bare Metal and Firebox Branch Office VPN Integration Guide

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product.

Oracle Bare Metal BOVPN® service is a service offered by Oracle Cloud Infrastructure. This document describes the basic steps to build a Branch Office VPN (BOVPN) tunnel between the Oracle Cloud Infrastructure and a WatchGuard Firebox.

Contents

• Oracle Bare Metal and Firebox Branch Office VPN Integration Guide
• Contents
• Platform and Software
• Configure Oracle Bare Metal VPN
• Create Virtual Cloud Network and Subnet
• Create the Dynamic Routing Gateway and Virtual Cloud Network Attachment
• Update the Routing Table
• Update the Security List
• Create Customer-Premises Equipment (CPE)
• Create an IPSec Connection
• Configure the Firebox
• Configure the Phase 2 IPSec Proposal
• Configure the Branch Office VPN
• Test the Integration

Platform and Software

The hardware and software used to complete the steps outlined in this document include:

• WatchGuard Firebox with Fireware v12.10
• Oracle Cloud Infrastructure account

Configure Oracle Bare Metal VPN

Oracle documentation lists the basic steps to set up a site-to-site VPN. These steps provide a high-level overview of the process:

1. Gather information.
2. Create your Virtual Cloud Network (VCN) and a subnet in your VCN.
3. Create your Dynamic Routing Gateway (DRG) and Virtual Cloud Network Attachment.
4. Update the routing in your VCN to use the DRG.
5. Update the security list in your VCN.
6. Create a Customer-Premises Equipment (CPE) object and provide the public IP address of your CPE device.
7. Create an IPSec connection to the CPE object and provide your static routes.

Create Virtual Cloud Network and Subnet

1. Log in to Oracle Cloud as an administrator.
2. From the upper-left corner, select the navigation menu.

3. Select Networking > Virtual Cloud Networks.

4. From the Compartment drop-down list, select your compartment. The available compartment depends on your permission.
5. Click Create VCN.
6. In the Name text box, type a name.
7. In the IPv4 CIDR Blocks text box, type your CIDR block.
8. Keep the default values for other settings.

10. Click Create VCN.
    The Virtual Cloud Network is created.

11. Click Create Subnet.
12. In the Name text box, type a name.
13. In the IPv4 CIDR Block text box, type the CIDR block. Typically, a subnet has a CIDR block smaller than the CIDR of the VCN.
14. From the Route Table drop-down list, select the default route table you created earlier.
15. For Subnet Access, select Private Subnet.
16. From the Security Lists drop-down list, select the default security list you created earlier.
17. Keep the default values for other settings.

18. Click Create Subnet.

Create the Dynamic Routing Gateway and Virtual Cloud Network Attachment

1. From the navigation menu, select Networking > Customer Connectivity > Dynamic Routing Gateway.
2. From the Compartment drop-down list, select your compartment.
   
3. Click Create Dynamic Routing Gateway.
4. In the Name text box, type a name.

5. Click Create Dynamic Routing Gateway.

6. From the Resources section, select VCN Attachments.
7. Click Create Virtual Cloud Network Attachment.
8. In the Attachment Name text box, type a name.
9. From the Virtual Cloud Network drop-down list, select the VCN you created.

10. Click Create VCN Attachment.

Update the Routing Table

1. From the navigation menu, select Networking > Virtual Cloud Networks.
2. Select the VCN you created.
3. From the Resources section, select Route Tables.
4. Select the default route table you created earlier.
5. Click Add Route Rules.
6. From the Target Type drop-down list, select Dynamic Routing Gateway.
7. From the Destination Type drop-down list, select CIDR Block.
8. In the Destination CIDR Block text box, type the destination CIDR block.

9. Click Add Route Rules.

Update the Security List

1. From the navigation menu, select Networking > Virtual Cloud Networks.
2. Select the VCN you created.
3. From the Resources section, select Security Lists.
4. Select the default security list you created earlier.
5. From the Resources section, select Ingress Rules.
6. Select the rules and click Edit.
7. For the ICMP protocol rules, update the Type to All.
8. Click Save Changes.

For testing purposes, we allowed inbound ICMP traffic on all ports. Remove this rule after testing.

Create Customer-Premises Equipment (CPE)

1. From the navigation menu, select Networking > Customer Connectivity > Customer-Premises Equipment.
2. From the Create in Compartment drop-down list, select your compartment.
3. Click Create CPE.
   The Create CPE page opens.
4. In the Name text box, type a name.
5. In the IP Address text box, type the public IP address of your Firebox.
6. In the CPE Vendor Information section, from the Vendor drop-down list, select WatchGuard.
7. From the Platform/Version drop-down list, select Firebox with Fireware v12.
8. Keep the default values for other settings.

9. Click Create CPE.

Create an IPSec Connection

1. From the navigation menu, select Networking > Customer Connectivity > Site-to-Site VPN.
2. Click Create IPSec Connection.
3. In the Name text box, type a descriptive name.
4. From the Create in Compartment drop-down list, select your compartment.
5. From the Customer-premises Equipment drop-down list, select the CPE object you created earlier.
6. From the Dynamic Routing Gateway Compartment drop-down list, select the DRG you created earlier.
7. In the Routes to Your On-premises Network text box, type your on-premise network.

8. In the Tunnel 1 section, in the Name text box, type a name.
9. Check Provide Custom Shared Secret.
10. In the Shared Secret text box, type the shared secret key.
11. From the IKE Version drop-down list, select IKEv2.
12. For Routing Type, select Policy Based Routing.
13. In the Associations section, in the On-premises CIDR Blocks text box, type your on-premise CIDR block.
14. In the Oracle Cloud CIDR Blocks text box, type your Oracle Cloud CIDR block.

15. Click Show Advanced Options.
16. Expand Phase One (ISAKMP) Configuration.
17. Select Set Custom Configurations.
18. From the Custom Encryption Algorithm drop-down list, select AES_256_CBC.
19. From the Custom Authentication Algorithm drop-down list, select SHA2_256.
20. From the Custom Diffie-Hellman group drop-down list, select GROUP14.

21. Expand the Phase Two (IPSec) Configuration section.
22. Select the Set Custom Configurations check box.
23. From the Custom Encryption Algorithm drop-down list, select AES_256_CBC.
24. From the Custom Authentication Algorithm drop-down list, select HMAC_SHA2_256_128.
25. Keep the default values for other settings.

26. To configure Tunnel 2, repeat steps 8–25.

27. Click Create IPSec Connection.
28. From the new IPSec connection, copy the IP addresses from the Oracle VPN IP Address column.

Configure the Firebox

To configure the Firebox, complete these high-level steps:

1. Configure the Phase 2 IPSec Proposal.
2. Configure the Branch Office VPN.

Configure the Phase 2 IPSec Proposal

1. Log in to Fireware Web UI at https://<your firebox IP address>:8080.
2. Select VPN > Phase 2 Proposals.
3. To create a new proposal, click Add .
4. In the Name text box, type a name for the proposal.
5. (Optional) In the Description text box, type a description.
6. From the Type drop-down list, select ESP (Encapsulating Security Payload).
7. From the Authentication drop-down list, select SHA2.
8. From the Encryption drop-down list, select AES(256-bit).
9. For Force Key Expiration, select the Time check box and type 1 hour.

10. Click Save.

Configure the Branch Office VPN

1. Select VPN > Branch Office VPN.
   The Branch Office VPN configuration page opens.
2. In the Gateways section, click Add.
3. In the Gateway Name text box, type a name to identify this Branch Office VPN gateway.
4. From the Address Family drop-down list, select IPv4 Addresses.
5. In the Credential Method section, select Use Pre-Shared Key.
   
6. In the adjacent text box, type the pre-shared key.

7. From the Gateway Endpoint section, select Add.
   The Gateway Endpoint Settings dialog box opens.
8. From the External Interface drop-down list, select External.
9. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
   The Primary Interface IP Address is the primary IP address you configured on the selected external interface.
10. Select By IP Address.
11. In the adjacent text box, type the public IP address of the External Firebox interface.
    

12. Select the Remote Gateway tab.
13. Select Static IP Address.
14. In the adjacent text box, type the Oracle VPN IP address that you copied from the Oracle Bare Metal IPSec connection.
15. Select By IP Address.
16. In the adjacent text box, type the Oracle VPN IP address that you copied from the Oracle Bare Metal IPSec connection.
    

17. Click OK.
18. Repeat steps 7-17 to create another Gateway Endpoint. In Steps 14 and 16, specify the other Oracle VPN IP address.
19. In the Gateway Endpoint section, select the Start Phase 1 tunnel when Firebox starts check box.

20. Select the Phase 1 Settings tab.
21. From the Version drop-down list, select IKEv2.
22. In the Transform Settings section, select the default setting, and click Edit.
23. In the SA Life text box, type 8 and select Hours from the drop-down list.
24. Keep all other settings as the default values.

25. Click OK.

26. Click Save.
27. From the Tunnels section, select Add.

28. From the Gateway drop-down list, select the gateway that you configured.

29. From the Addresses section, click Add.
    The Tunnel Route Settings dialog box opens.

30. In the Local IP section, from the Choose Type drop-down list, select Network IPv4.
31. In the Network IP text box, type the local IP segment. This is the local network protected by the Firebox.
32. In the Remote IP section, from the Choose Type drop-down list, select Network IPv4.
33. In the Network IP text box, type the remote IP segment. This is the local network protected by the Oracle Cloud.

34. Click OK.
35. Select the Phase 2 Settings tab.
36. Select the Enable Perfect Forward Secrecy check box. From the drop-down list, select Diffie-Hellman Group 5.
37. In the IPSec Proposals section, from the Phase 2 Proposals drop-down list, select the phase 2 proposal you created, then click Add.
38. Remove any other proposals that appear on the list.

39. Click Save.

Test the Integration

To test the integration, from Oracle Bare Metal:

1. Make sure your IPSec connection status is Up and green.

2. Launch an instance into the VCN.
   For information about launching an instance, see the Oracle Cloud Infrastructure documentation.
3. Ping the instance from your on-promises network.

To test the integration, from Fireware Web UI:

1. Select System Status > VPN Statistics.
2. Select the Branch Office VPN tab.
3. Verify that the VPN is established.

4. Verify that Host1 (behind the Firebox) and Host2 (behind the Oracle Cloud ) can ping each other.