Introduction
Alaris system provides the ability to install IPsec tunnels between the sites of the System owner and partner.
In this article, we will tell you how to do this. It is worth noting in advance that after installing the IPsec-tunnel, it will be possible to create both client and vendor SMPP over VPN channels.
Difference in VPN for hosted and non-hosted clients
- For hosting clients, there are no restrictions on installing a VPN tunnel.
- If your system is installed on your infrastructure, then you need to install the VPN connection yourself or coordinate each VPN connection with your account manager.
What do you need first to install a VPN tunnel?
To install a VPN tunnel, you need to either send a VPN form to Alaris support from your partner, or provide your partner with your VPN form to fill out.
If you do not yet have a completed VPN form, then you need to contact Alaris support and ask for such a form. The form template can be found on the Example Alaris VPN Form.
The partner sent his VPN form with completed parameters. What to do next?
You need to make sure that all the necessary IP addresses are present in the form. First: encryption domain or traffic selectors, as well as Peer IP or Gateway IP.
Also, it is important to make sure that all parameters for encryption, hashing and group DH are the same. If not, please check these parameters with your partner and change them to the required ones so that all parameters match.
If all parameters are present and match, then this form must be sent to Alaris support.
Example of partner's VPN form with full parameters:
Pre-shared key from partner
PSK should not be in VPN form. Due to our internal security policy, if a PSK was sent to a support email, then such a PSK cannot be used and the partner should generate a new PSK.
All PSK need to be sent to a special mail address : vpn@alarislabs.com
Please indicate the TT number in the subject of the mail. The format can be as follows:
- Subject: PSK TT No.
NOTE: only VPN engineers have access to this mail, so it is necessary to notify Alaris support that the PSK was sent to the mail.
Also, address vpn@alarislabs.com is used ONLY to receive or send PSK, it is not used by engineers to communicate with partners. Any communication regarding VPN must go through support@alarislabs.com
Pre-shared key from Alaris
If, for some reason, a partner cannot generate a PSK, we can do it on our part. You should contact Alaris support and ask to generate a PSK. We can provide it with an OTP link or send it to email.
Installing SMPP over VPN channels
- After a backend setup of a VPN connection, SMS channels should be configured.
- You should fill the Hostname field in the Carriers⇾SMS Channels with the partner's encryption domain, which you can find in the VPN form you provided, or ask Alaris support to show the status of the tunnel.
All addresses will be visible in this output. This will be discussed in more detail below.
Local Address field in the Carriers⇾SMS Channels must be set as System owner's encryption domain
How to find out from the VPN connection status output which IP addresses can be used to establish an SMPP over VPN session?
SMPP over VPN session can only be established between encryption domains (or traffic selectors, which is a synonym).
Let's look at an example of the VPN tunnel status output:
Routed Connections:Internal_1{1}: ROUTED, TUNNEL, reqid 1Internal_1{1}: 10.201.7.1/32 === 10.100.1.1/32Security Associations (1 up, 0 connecting):Internal_1[4]: ESTABLISHED 8 hours ago, 62.67.222.1[62.67.222.1]...1.1.1.1[1.1.1.1]Internal_1{329}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: c92b3ab2_i c7e349fe_oInternal_1{329}: 10.201.7.1/32 === 10.100.1.1/32
- When the only tunnel's status is ROUTED, it means that the connection is configured, but the VPN tunnel is offline.
- When the only tunnel's status is ESTABLISHED, it means that the 1st phase of VPN connection is up, but there is a mismatch in the 2nd phase settings or the partner does not respond to requests for installing the 2nd phase. VPN tunnel is not operational.
- When the only tunnel's status is INSTALLED, it means that the 2nd phase of the VPN connection is up as well and the VPN tunnel is fully operational.
62.67.222.1...1.1.1.1: it is a Peer IP addresses of the System owner (62.67.222.1) and partner (1.1.1.1). IKE_SA is installed between these addresses. These IPs do not need to be specified in SMS Channels.10.201.7.1/32 === 10.100.1.1/32: These are encryption domains (or traffic selectors) of System owner (10.201.7.1/32) and partner side (10.100.1.1/32). These are the addresses that will be used in SMPP over VPN. You need to specify your system owner's encryption domain (in our example: 10.201.7.1/32) as the local address in the SMS Channels and partner's encryption domain (in our example: 10.100.1.1/32) as the Hostname.
How to check the VPN tunnel status?
If you have “bound” SMPP over VPN channels, then the VPN tunnel is online. But to be sure of the VPN tunnel status, contact Alaris support.
The partner wants an SMPP over VPN connection using only public IP addresses as an encryption domains. What to do?
If you do not yet have a public ED address, then you need to contact your account manager to allocate such an address. After confirmation from the account manager, contact Alaris support.
Additional features
- By default, you need to specify partner's Peer IP in the Trace analyzer/Hostname field. But in this case, without an installed internal module for decrypting traces, you can see what is hidden behind the ESP (encrypted) packets only after receiving "esp_sa" file from the Alaris support. To clarify how to use this file, contact Alaris support.
- Alaris system provides the ability to capture decrypted traces using Trace analyzer. If you need this functionality, contact Alaris support.
AKBSMS - Alaris Knowledge Base
Related Questions:
How to establish an SMPP over VPN session with a partner?
How to get a VPN form?
Where to send PSK from a partner?
How to check the VPN tunnel status?
How to capture VPN over VPN traces?
How to allocate public ED address?