VPN Gateway:Establish an SSL-VPN connection with AD authentication

Prerequisites

• You have created a VPC in the China (Hangzhou) region and deployed applications on ECS instances in the VPC. For more information, see Set up an IPv4 VPC.

  Ensure the security group rules for the ECS instances allow clients to access the required cloud resources. For more information, see Query security group rules and Add a security group rule.

• Make sure that the client can access the internet, and its private CIDR block does not overlap with the private CIDR block of the VPC.

• You have created an Enterprise Edition IDaaS EIAM instance. For more information, see Manage instances.

  Important

  • IDaaS EIAM 1.0 instances are no longer available for purchase. We recommend that you use an IDaaS EIAM 2.0 instance. This topic uses an IDaaS EIAM 2.0 instance as an example. For more information, see [Change Announcement] SSL-VPN two-factor authentication supports IDaaS EIAM 2.0.

  • For information about how to use an IDaaS EIAM 1.0 instance, see IDaaS EIAM 1.0 configuration.

• You have the public IP address and service port of the AD server.

  In this example, the AD system is deployed on a Windows Server 2022 system. The public IP address is 47.XX.XX.62 and the service port is 389.

• You have the Base DN of the AD server.

  In this example, the Base DN of the AD server is dc=zxtest,dc=com.

• You have the DN, username, and password of the administrator on the AD server.

  In this example, the administrator account name is Administrator and the password is 1****2. The DN is cn=Administrator,cn=Users,dc=zxtest,dc=com. For example, in Active Directory Users and Computers, expand the domain node (for example, zxtest.com) and the Users container to locate the Administrator user. The DN is CN=Administrator,CN=Users,DC=zxtest,DC=com.

Procedure

Step 1: Bind the AD server

Bind an AD server to the IDaaS EIAM instance to synchronize account information from the AD server. For more information, see Bind AD - Inbound.

In this example, use the default values for all parameters except for the required ones when binding the AD server. The following shows the account information synchronized to the IDaaS EIAM instance from the AD server.

After the synchronization is complete, go to the Accounts tab. In the account list, the Source of the wangwu account is displayed as AD Import, and its status is normal. The Source of other accounts, such as zhangsan and Lisi, is Self-created. This confirms that the AD accounts are successfully synchronized to the IDaaS EIAM instance.

Step 2: Add the SSL-VPN application

1. Log on to the IDaaS console.

2. On the EIAM page, find the EIAM instance that you created in Prerequisites, and then in the Actions column, click Console.

3. In the left-side navigation pane of the EIAM instance, click Application. On the Application page, click Add Application.

4. On the Add Application page, find the Alibaba Cloud - SSL VPN template and click Add Application.

5. In the Add Application dialog box, enter a name for the application and click Add.

6. On the Sign-In tab of the application details page, configure the following parameters and click Save at the bottom of the tab.

   SSO: Keep this feature enabled.

   Grant Types: The default value is Password Grant. For IdP, select the bound AD server. The system uses the AD server to authenticate employees.

   Authorize: Use the default value Manually. This setting requires you to manually authorize specific accounts to access this application. For more information about authorization scopes, see Authorization scope.

7. Remain on the Sign-In tab and click the Application Authorization tab.

   Grant permissions to the employee accounts that need to establish SSL-VPN connections. For more information, see Application authorization.

Step 3: Create a VPN gateway

1. Log on to the VPN gateway console.

2. On the VPN Gateways page, click Create VPN Gateway.

3. On the VPN Gateway page, configure the VPN gateway as described below, click Buy Now, and complete the payment.

   The following table describes only the parameters that are relevant to this topic. Keep the default values for other parameters. For more information, see Create and manage a VPN Gateway instance.

   Parameter	Description
   Region	Select the region where you want to create the VPN Gateway instance. In this example, China (Hangzhou) is selected. Note Make sure that the VPC and the VPN Gateway instance are in the same region.
   gateway type	Select the type of VPN gateway that you want to create. In this example, Standard is selected.
   Network Type	Select the network type of the VPN Gateway instance. In this example, Public is selected.
   tunnel	The system displays the tunnel modes for IPsec-VPN connections that are supported in the current region.
   VPC	Select the VPC that you want to connect.
   vSwitch 1	Select a vSwitch from the VPC. If you select Single-tunnel, you need to specify only one vSwitch. If you select Dual-tunnel, you need to specify two vSwitches. After the IPsec-VPN feature is enabled, the system creates an elastic network interface (ENI) for each of the two vSwitches as an interface to communicate with the VPC over an IPsec-VPN connection. Each ENI occupies one IP address in the vSwitch. Note The system selects a vSwitch by default. You can change or use the default vSwitch. After a VPN gateway is created, you cannot modify the vSwitch associated with the VPN gateway. You can view the vSwitch associated with the VPN gateway, the zone to which the vSwitch belongs, and the ENI in the vSwitch on the details page of the VPN gateway.
   vSwitch 2	Select the second vSwitch from the VPC. Specify two vSwitches in different zones in the associated VPC to implement disaster recovery across zones for IPsec-VPN connections. For a region that supports only one zone, disaster recovery across zones is not supported. We recommend that you specify two vSwitches in the zone to implement high availability of IPsec-VPN connections. You can also select the same vSwitch as the first one. Note If the VPC does not have a second vSwitch, you can create one. For more information, see Create and manage a vSwitch.
   IPsec-VPN	Specifies whether to enable the IPsec-VPN feature. In this example, select Disable.
   SSL-VPN	Specifies whether to enable the SSL-VPN feature. In this example, select Enable.
   SSL connections	Select the maximum number of clients that can connect at the same time. Note You can configure SSL Connections only after you enable the SSL-VPN feature.

4. Return to the VPN Gateways page to view the VPN Gateway instance.

   A new VPN Gateway instance is in the Preparing state. After 1 to 5 minutes, the state changes to Normal. The Normal state indicates that the VPN Gateway instance is initialized.

Step 4: Create an SSL server

1. In the left navigation pane, choose Interconnections > VPN > SSL Servers.

2. In the top navigation bar, select the region for the SSL server.

   Note

   Make sure that the SSL server and the VPN Gateway instance are in the same region.

3. On the SSL Server page, click Create SSL Server.

4. In the Create SSL Server panel, configure the SSL server as described in the following table, and click OK.

   The following table describes only the parameters that are relevant to this topic. Keep the default values for other parameters. For more information, see Create and manage an SSL server.

   Parameter	Description
   VPN Gateways	Select the VPN Gateway instance that you created.
   Local Network	Enter the CIDR block of the VPC that you want to access. In this example, 192.168.0.0/16 is used.
   Client CIDR Block	Enter the CIDR block that is used by the client to access the VPC. In this example, 10.0.0.0/24 is used. Important The subnet mask of the client CIDR block must be 16 to 29 bits in length. The client CIDR block must not overlap with the Local Network, the VPC CIDR block, or any CIDR blocks routed on the client. Use private CIDR blocks such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or their subnets. To use a public IP range, configure it as a user-defined CIDR block in the VPC for proper routing. VPC FAQ and VPC FAQ. After you create the SSL server, the system adds a route for the client CIDR block to the VPC route table. Do not manually add this route, as it may disrupt SSL-VPN traffic. If a vSwitch is associated with a custom route table, the system does not automatically add the route for the client CIDR block to that custom route table. You must manually add a route entry whose destination CIDR block is the client CIDR block and whose next hop is the VPN gateway. Otherwise, hosts in the CIDR blocks associated with the custom route table cannot communicate with SSL-VPN clients.
   Advanced Settings	Enable two-factor authentication. This topic uses EIAM 2.0. Keep the default values for the other settings. IDaaS Instance Region: Select China (Hangzhou). IDaaS Instance: Select the EIAM instance that you created in the prerequisites. IDaaS Application: Select the Alibaba Cloud SSL-VPN application that you added. Note When creating an SSL server in the UAE (Dubai) region, bind an IDaaS EIAM 2.0 instance in the Singapore region to reduce cross-region latency.

Step 5: Create an SSL client certificate

1. In the navigation pane on the left, choose Interconnections > VPN > SSL Clients.

2. On the SSL Client page, click Create SSL Client.

3. In the Create SSL Client panel, enter a name for the SSL client certificate, select the corresponding SSL Server, and then click OK.

4. On the SSL Client page, find the SSL client certificate that you created and click Download Certificate in the Actions column.

   Save the downloaded SSL client certificate. You will need it to configure the client.

Step 6: Configure the client

Step 7: Test the connectivity

After completing the preceding steps, the client can remotely access resources in the VPC. The following section describes how to test the connectivity between a Linux client and the VPC.

1. Open the command-line window on the client.

2. Run the ping command to access the ECS1 instance in the VPC and verify the connectivity.

   ping <IP address of the ECS1 instance>

   If you receive reply packets like those shown below, the client is successfully connected to the VPC.

   [root@iZuf6         ihcZ conf]# ping 192.168.10.154
   PING 192.168.10.154 (192.168.10.154) 56(84) bytes of data.
   64 bytes from 192.168.10.154: icmp_seq=1 ttl=63 time=11.9 ms
   64 bytes from 192.168.10.154: icmp_seq=2 ttl=63 time=11.7 ms
   64 bytes from 192.168.10.154: icmp_seq=3 ttl=63 time=11.7 ms
   64 bytes from 192.168.10.154: icmp_seq=4 ttl=63 time=11.8 ms
   64 bytes from 192.168.10.154: icmp_seq=5 ttl=63 time=11.5 ms
   ^Z
   [8]+  Stopped                 ping 192.168.10.154
   [root@iZuf6hgotc     :Z conf]#

IDaaS EIAM 1.0 configuration

To use an IDaaS EIAM 1.0 instance, perform the following steps. You need to enable LDAP authentication and bind the EIAM 1.0 instance when you create the SSL server. The other steps are the same as for EIAM 2.0.

Procedure