Oracle Bare Metal and Firebox Branch Office VPN Integration Guide

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product.

Oracle Bare Metal BOVPN® service is a service offered by Oracle Cloud Infrastructure. This document describes the basic steps to build a Branch Office VPN (BOVPN) tunnel between the Oracle Cloud Infrastructure and the WatchGuard Firebox.

Platform and Software

The hardware and software used to complete the steps outlined in this document include:

• WatchGuard Firebox M400 with Fireware v12.8.1
• Oracle Cloud Infrastructure account

Configure the Oracle Bare Metal VPN

Oracle documentation lists the basic structure to set up a site-to-site VPN. These steps provide a high-level overview of the process.

1. Gather information.
2. Create your VCN (Virtual Cloud Network) and a subnet in your VCN.
3. Create your DRG (Dynamic Routing Gateway) and Virtual Cloud Network Attachment.
4. Update the routing in your VCN to use the DRG.
5. Update the security list in your VCN.
6. Create a CPE (Customer-Premises Equipment) object and provide your CPE device's public IP address.
7. Create an IPSec connection to the CPE object and provide your static routes.

Create Virtual Cloud Network and Subnet

1. Log in to your Oracle Cloud as an administrator.
2. In the upper-left corner, click the navigation menu.

3. Click Networking.

4. Click Virtual Cloud Networks.
5. From the Compartment drop-down list, select your compartment. The available compartment depends on your permission.
6. Click Create VCN.
7. In the Name text box, type a name.
8. In the IPv4 CIDR Blocks text box, type your CIDR block.
9. Keep the default value for other settings.

10. Click Create VCN.
    The Virtual Cloud Network is created.

11. Click Create Subnet.
12. In the Name text box, type a name.
13. In the IPv4 CIDR Block text box, type the CIDR block. Typically a subnet has a CIDR block smaller than the VCN's CIDR.
14. From the Route Table drop-down list, select the default route table you created earlier.
15. For Subnet Access, select Private Subnet.
16. From the Security Lists drop-down list, select the default security list you created earlier.
17. Keep the default value for other settings.

18. Click Create Subnet.

Create the Dynamic Routing Gateway and Virtual Cloud Network Attachment

1. From the navigation menu, select Networking > Customer Connectivity > Dynamic Routing Gateway.
2. From the Compartment drop-down list, select your compartment.
   
3. Click Create Dynamic Routing Gateway.
4. In the Name text box, type a friendly name.

5. Click Create Dynamic Routing Gateway.

6. From the Resources section, click Virtual Cloud Networks Attachments.
7. Click Create Virtual Cloud Network Attachment.
8. In the Attachment name text box, type a name.
9. From the Virtual Cloud Network drop-down list, select the VCN you created.

10. Click Create Virtual Cloud Network Attachment.

Update the Routing Table

1. From the navigation menu, select Networking > Virtual Cloud Networks.
2. Click the VCN you created.
3. In the Resources section, click Route Tables.
4. Click the default route table you created earlier.
5. Click Add Route Rules.
6. From the Target Type drop-down list, select Dynamic Routing Gateway.
7. In the Destination CIDR Block text box, type the destination CIDR block.

8. Click Add Route Rules.

Update the Security List

1. From the navigation menu, select Networking > Virtual Cloud Networks.
2. Click the VCN you created.
3. Under Resources, click Security Lists.
4. Click the default security list you created earlier.
5. In the Resources section, click Ingress Rules.
6. Select the rules and click Edit.
7. For the ICMP protocol rules, update the Type to All.
8. Click Save changes.

For testing purposes, we allowed inbound ICMP traffic on all ports. Remove this rule after testing.

Create Customer-Premises Equipment (CPE)

1. From the navigation menu, select Networking > Customer Connectivity > Customer-Premises Equipment.
2. From the Compartment drop-down list, select your compartment.
3. Click Create Customer-Premises Equipment.
   The Create Customer-Premises Equipment page opens.
4. In the Name text box, type a friendly name.
5. In the Public IP Address text box, type the public IP address of your Firebox.
6. In the CPE Vendor Information section, from the Vendor drop-down list, select WatchGuard.
7. From the Platform/Version drop-down list, select Firebox with Fireware v12.

8. Click Create CPE.

Create an IPSec Connection

1. From the navigation menu, select Networking > Customer Connectivity > Site-to-Site VPN.
2. Click Create IPSec Connection.
3. In the Name text box, type a descriptive name.
4. From the Create in Compartment drop-down list, select your compartment.
5. From the Customer-Premises Equipment drop-down list, select the CPE object you created earlier.
6. From the Dynamic Routing Gateway Compartment drop-down list, select the DRG you created earlier.
7. In the Routes to your On-Premises Network text box, type your on-premise network.

8. In the Tunnel 1 section, in the Name text box, type a name.
9. Select Provide custom shared secret.
10. In the Shared Secret text box, type the shared secret key.
11. From the IKE Version drop-down list, select IKEv2.
12. For Routing Type, select Policy Based Routing.
13. In the Associations section, in the On-Premises CIDRs text box, type your on-premise CIDR block.
14. In the Oracle Cloud CIDRs text box, type your Oracle Cloud CIDR block.

15. Click Show Advanced Options.
16. Expand Phase One (ISAKMP) Configuration.
17. Select Set Custom Configurations.
18. From the Custom Encryption Algorithm drop-down list, select AES_256_CBC.
19. From the Custom Authentication Algorithm drop-down list, select SHA2_256.
20. From the Custom Diffie-Hellman Group drop-down list, select GROUP14.

21. Expand Phase Two (IPSec) Configuration.
22. Check Set Custom Configurations.
23. From the Custom Encryption Algorithm drop-down list, select AES_256_CBC.
24. From the Custom Authentication Algorithm drop-down list, select HMAC_SHA2_256_128.
25. Keep the default value for other settings.

26. Repeat steps 8–25 to configure Tunnel 2.

27. Click Create IPSec Connection.
28. From the new IPSec connection, copy the IP addresses from the Oracle VPN IP Address column.

Configure the Firebox

Configure the Phase 2 IPSec Proposal

1. Log in to Fireware Web UI at https://<your firebox IP address>:8080.
2. Select VPN > Phase 2 Proposals.
3. To create a new proposal, click Add .
4. In the Name text box, type a name for the proposal.
5. (Optional) Type a Description.
6. From the Type drop-down list, select ESP (Encapsulating Security Payload).
7. From the Authentication drop-down list, select SHA2.
8. From the Encryption drop-down list, select AES(256-bit).
9. For Force Key Expiration, select the Time check box and type 1 hour.

10. Click Save.

Configure the Branch Office VPN

1. Select VPN > Branch Office VPN.
   The Branch Office VPN configuration page opens.
2. In the Gateways section, click Add.
3. In the Gateway Name text box, type a name to identify this Branch Office VPN gateway.
4. From the Address Family drop-down list, select IPv4 Addresses.
5. In the Credential Method section, select Use Pre-Shared Key.
   
6. In the adjacent text box, type the pre-shared key.

7. In the Gateway Endpoint section, click Add.
   The Gateway Endpoint Settings dialog box opens.
8. From the External Interface drop-down list, select External.
9. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
   The Primary Interface IP Address is the primary IP address you configured on the selected external interface.
10. Select By IP Address.
11. In the adjacent text box, type the public IP address of the External Firebox interface.
    

12. Select the Remote Gateway tab.
13. Select Static IP Address.
14. In the adjacent text box, type the Oracle VPN IP address that you copied from the Oracle Bare Metal IPSec connection.
15. Select By IP Address.
16. In the adjacent text box, type the Oracle VPN IP address that you copied from the Oracle Bare Metal IPSec connection.
    

17. Click OK.
18. Repeat steps 7-17 to create another Gateway Endpoint. In Steps 14 and 16, specify the other Oracle VPN IP address.
19. In the Gateway Endpoint section, select the Start Phase 1 tunnel when Firebox starts check box.

20. Select the Phase 1 Settings tab.
21. From the Version drop-down list, select IKEv2.
22. In the Transform Settings section, select the default setting, and click Edit.
23. In the SA Life text box, type 8 and select hours from the drop-down list.
24. Keep all other settings as the default values.

25. Click OK.

26. Click Save.
27. In the Tunnels section, click Add.

28. From the Gateway drop-down list, select the gateway that you configured.
29. In the Addresses section, click Add.

30. In the Local IP section, from the Choose Type drop-down list, select Network IPv4.
31. In the Network IP text box, type the local IP segment. This is the local network protected by the Firebox.
32. In the Remote IP section, from the Choose Type drop-down list, select Network IPv4.
33. In the Network IP text box, type the remote IP segment. This is the local network protected by the Oracle Cloud.

34. Click OK.
35. Select the Phase 2 Settings tab.
36. Select the Enable Perfect Forward Secrecy check box. From the drop-down list, select Diffie-Hellman Group 5.
37. In the IPSec Proposals section, from the Phase 2 Proposals drop-down list, select the phase 2 proposal you created, and click Add.
38. Remove any other proposals that appear on the list.

39. Click Save.

Test the Integration

To test the integration, from Fireware Web UI:

1. Select System Status > VPN Statistics.
2. Select the Branch Office VPN tab.
3. Verify that the VPN is established.

4. Verify that Host1 (behind the Firebox) and Host2 (behind the Oracle Cloud ) can ping each other.