Oracle Bare Metal and Firebox BOVPN Virtual Interface Integration Guide

Oracle Bare Metal BOVPN® service is a service offered by Oracle Cloud Infrastructure. This document describes the basic steps to build a Branch Office VPN (BOVPN) virtual interface connection between the Oracle Cloud Infrastructure and the WatchGuard Firebox.

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product.

Contents

• Oracle Bare Metal and Firebox BOVPN Virtual Interface Integration Guide
  • Contents
  • Platform and Software
  • Configure the Oracle Bare Metal VPN
    • Create a Virtual Cloud Network and Subnet
    • Create the Dynamic Routing Gateway and Virtual Cloud Network Attachment
    • Update the Routing Table
    • Update the Security List
    • Create the Customer-Premises Equipment (CPE)
    • Create an IPSec Connection
  • Configure the Firebox
    • Configure the Phase 2 IPSec Proposal
    • Configure the BOVPN Virtual Interface
  • Test the Integration

Platform and Software

The hardware and software used in this document include:

• WatchGuard Firebox with Fireware v12.10.1
• Oracle Cloud Infrastructure account

Configure the Oracle Bare Metal VPN

For information about the basic structure to set up a site-to-site VPN, go to the Oracle documentation.

To configure the Oracle Bare Metal VPN:

1. Create a Virtual Cloud Network and Subnet.
2. Create the Dynamic Routing Gateway and Virtual Cloud Network Attachment.
3. Update the Routing Table.
4. Update the Security List.
5. Create the Customer-Premises Equipment (CPE).
6. Create an IPSec Connection.

Create a Virtual Cloud Network and Subnet

To create a virtual cloud network and subnet:

1. Log in to the Oracle Cloud with an administrator account.

2. From the navigation menu, select Networking > Virtual Cloud Networks.

3. From the Compartment drop-down list, select your compartment. The available compartment depends on your permission.
4. Click Create VCN.
   The Create a Virtual Cloud Network page opens.

5. In the Name text box, type a name. In this example, we use MyVCN
6. In the IPv4 CIDR Blocks text box, type your CIDR block.
7. Keep the default values for other settings.
8. Click Create VCN.
   The virtual cloud network is created with a default route table and security list.

9. To view the default route table, from the Resources section, click Route Tables.

10. To view the default security list, from the Resources section, click Security Lists.
    

11. Click Subnets(0), then click Create Subnet.
    The Create Subnet page opens.

12. In the Name text box, type a name.
13. In the IPv4 CIDR Block text box, type the CIDR block. Generally, a subnet CIDR block is smaller than the VCN CIDR block.
14. From the Route Table drop-down list, select the default route table.
15. For Subnet Access, select Private Subnet.
16. From the Security Lists drop-down list, select the default security list.
17. Keep the default values for other settings.
18. Click Create Subnet.

Create the Dynamic Routing Gateway and Virtual Cloud Network Attachment

To create the Dynamic Routing Gateway and Virtual Cloud Network Attachment:

1. From the navigation menu, select Networking > Customer Connectivity > Dynamic Routing Gateway.
2. From the Compartment drop-down list, select your compartment.
   
3. Click Create Dynamic Routing Gateway.
   The Create Dynamic Routing Gateway page opens.

4. In the Name text box, type a name.
5. Click Create Dynamic Routing Gateway.
   The Dynamic Routing Gateway is created.

6. From the Resources section, click VCN Attachments.
7. Click Create Virtual Cloud Network Attachment.
   The Create VCN Attachment page opens.

8. In the Attachment Name text box, type a name.
9. From the Virtual Cloud Network drop-down list, select the VCN you created in Create a Virtual Cloud Network and Subnet.
10. Click Create VCN Attachment.

Update the Routing Table

To update the routing table:

1. From the navigation menu, select Networking > Virtual Cloud Networks.
2. Select the VCN you created in Create a Virtual Cloud Network and Subnet.
3. From the Resources section, click Route Tables.
4. Select the default route table.
5. Click Add Route Rules.
   The Add Route Rules page opens.

6. From the Target Type drop-down list, select Dynamic Routing Gateway.
7. From the Destination Type drop-down list, select CIDR Block.
8. In the Destination CIDR Block text box, type the destination CIDR block.
9. Click Add Route Rules.

Update the Security List

To update the security list:

1. From the navigation menu, select Networking > Virtual Cloud Networks.
2. Select the VCN you created in Create a Virtual Cloud Network and Subnet.
3. From the Resources section, click Security Lists.
4. Click the default security list you created in Create a Virtual Cloud Network and Subnet
5. From the Resources section, click Ingress Rules.
   The Ingress Rules page opens.

6. Select the rules you want to update, then click Edit.
7. For the ICMP protocol rules, update the Type to All.
8. Click Save Changes.

For test purposes, we allow inbound ICMP traffic on all ports. Remove this rule after you complete the test.

Create the Customer-Premises Equipment (CPE)

To create the customer-premises equipment:

1. From the navigation menu, select Networking > Customer Connectivity > Customer-Premises Equipment.
2. From the Compartment drop-down list, select your compartment.
3. Click Create CPE.
   The Create CPE page opens.

4. In the Name text box, type a name.
5. In the IP Address text box, type the public IP address of your Firebox.
6. From the CPE Vendor Information section, from the Vendor drop-down list, select WatchGuard.
7. From the Platform/Version drop-down list, select Firebox with Fireware v12.
8. Keep the default values for other settings.
9. Click Create CPE.

Create an IPSec Connection

To create an IPSec connection:

1. From the navigation menu, select Networking > Customer Connectivity > Site-to-Site VPN.
2. Click Create IPSec Connection.
   The Create IPSec Connection page opens.

3. In the Name text box, type a name.
4. From the Create in Compartment drop-down list, select your compartment.
5. From the Customer-Premises Equipment drop-down list, select the CPE object you created in Create the Customer-Premises Equipment (CPE).
6. From the Dynamic Routing Gateway Compartment drop-down list, select the DRG you created earlier.
7. In the Routes to Your On-Premises Network text box, type your on-premise network.
8. Expand the Tunnel 1 section.
   The Tunnel 1 settings appear.

9. In the Name text box, type a name.
10. Select the Provide Custom Shared Secret check box.
11. In the Shared Secret text box, type the shared secret key.
12. From the IKE Version drop-down list, select IKEv2.
13. For Routing Type, select Static Routing.
14. Click Show Advanced Options.
    The Tunnel 1 advanced options appear.

15. Expand Phase One (ISAKMP) Configuration.
16. Select the Set Custom Configurations check box.
17. From the Custom Encryption Algorithm drop-down list, select AES_256_CBC.
18. From the Custom Authentication Algorithm drop-down list, select SHA2_256.
19. From the Custom Diffie-Hellman Group drop-down list, select GROUP14.
20. Expand Phase Two (IPSec) Configuration.
    The Phase Two (IPSec) Configuration settings appear.

21. Select the Set Custom Configurations check box.
22. From the Custom Encryption Algorithm drop-down list, select AES_256_CBC.
23. From the Custom Authentication Algorithm drop-down list, select HMAC_SHA2_256_128.
24. Keep the default values for other settings.
25. Repeat steps 8-24 to configure Tunnel 2.

26. Click Create IPSec Connection.
27. From the new IPSec connection, from the Oracle VPN IP Address column, copy the IP addresses.

Configure the Firebox

To configure the Firebox, you must:

1. Configure the Phase 2 IPSec Proposal
2. Configure the BOVPN Virtual Interface

Configure the Phase 2 IPSec Proposal

To configure the Phase 2 IPSec proposal:

1. Log in to Fireware Web UI at https://<your firebox IP address>:8080.
2. Select VPN > Phase 2 Proposals.
3. To create a new proposal, click Add.
   The Phase 2 Proposal Add page opens.

4. In the Name text box, type a name for the proposal.
5. (Optional) In the Description text box, type a description.
6. From the Type drop-down list, select ESP (Encapsulating Security Payload).
7. From the Authentication drop-down list, select SHA2-256.
8. From the Encryption drop-down list, select AES(256-bit).
9. For Force Key Expiration, select the Time check box, then type 1 hour.
10. Click Save.

Configure the BOVPN Virtual Interface

To configure the BOVPN virtual interface:

1. Select VPN > BOVPN Virtual Interfaces.
   The BOVPN Virtual Interfaces configuration page opens.
2. Click Add.
   The BOVPN Virtual Interfaces Add page opens.

3. In the Interface Name text box, type a name to identify this BOVPN virtual interface.
4. From the Remote Endpoint Type drop-down list, select Cloud VPN or Third-Party Gateway.
5. From the Gateway Address Family drop-down list, select IPv4 Addresses.
   
   
6. From the Credential Method section, select Use Pre-Shared Key.
7. In the adjacent text box, type the pre-shared key.
8. From the Gateway Endpoint section, click Add.
   The Gateway Endpoint Settings dialog box opens.

9. From the Physical drop-down list, select External.
10. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
    
    The Primary Interface IP Address is the primary IP address you configured on the selected external interface.
11. Select By IP Address.
12. In the adjacent text box, type the public IP address of the External Firebox interface.
13. Select the Remote Gateway tab.
    

14. Select Static IP Address.
15. In the adjacent text box, type the Oracle VPN IP address that you copied from the Oracle Bare Metal IPSec connection.
16. Select By IP Address.
17. In the adjacent text box, type the Oracle VPN IP address that you copied from the Oracle Bare Metal IPSec connection.
18. Click OK.
    The Gateway Endpoint details appear on the BOVPN Virtual Interfaces Add page.

19. From the Gateway Endpoint section, select the Start Phase 1 Tunnel When it is Inactive check box.
20. Select the Add This Tunnel to the BOVPN-Allow Policies check box.
21. Select the VPN Routes tab.
    
22. Click Add.
    The VPN Route Settings dialog box opens.

23. From the Choose Type drop-down list, select Network IPv4.
24. In the Route To text box, type the Network IP address of a route that uses this virtual interface.
25. For Metric, type 1.
26. Click OK.
    The VPN Route details appear on the BOVPN Virtual Interfaces Add page.

27. Select the Phase 1 Settings tab.
28. From the Version drop-down list, select IKEv2.
29. From the Transform Settings section, select the default setting, then click Edit.
    The Transform Settings dialog box opens.

30. In the SA Life text box, type 8 and select Hours from the drop-down list.
31. Keep the default values for all other settings.
32. Click OK.
    The Transform Settings appear on the BOVPN Virtual Interfaces Add page.

33. Select the Phase 2 Settings tab.
    

34. Select the Enable Perfect Forward Secrecy check box.
35. From the adjacent drop-down list, select Diffie-Hellman Group 5.
36. From the IPSec Proposals section, from the Phase 2 Proposals drop-down list, select the phase 2 proposal you created, then click Add.
37. Remove any other proposals that appear in the list.
38. Click Save.
39. Repeat steps 1-38 to create another BOVPN virtual interface, with these changes:
1. In Steps 15 and 17, specify the other Oracle VPN IP address.
2. In Step 25, for Metric, type 2.

Test the Integration

To test the integration, from Oracle Bare Metal:

1. Make sure your IPSec connection status is Up and green.
   Oracle provisions two IPSec tunnels for the connection, only one of which is up. For more information about the IPSec tunnel redundancy, go to the Oracle Cloud Infrastructure documentation.
   

2. Launch an instance into the VCN.
   For information about how to launch an instance, go to the Oracle Cloud Infrastructure documentation.
3. Ping the instance from your on-premise network.

To test the integration, from Fireware Web UI:

1. Select System Status > VPN Statistics.
2. Select the Branch Office VPN tab.
3. Verify that the VPN is established.

4. Verify that Host1 (behind the Firebox) is able to ping Host2 (in the Oracle Cloud).