Overview

Kerio Control IPsec VPN Server offers clients such as desktops, notebooks, mobile devices, etc. a secure way to connect to the network. To implement Kerio IPsec VPN Server you need to make changes in the configuration both on the server-side and on the client-side.

For securing the communication, Kerio Control supports a Preshared key, so-called PSK or shared secret, and an SSL certification authentication.

Solution

Configuring the server-side

Configuring IPsec VPN server with a preshared key

Note: The preshared key is a shared password for all users using an IPsec VPN.

1. In the administration interface, go to Interfaces.
2. Double-click on VPN Server.
3. In the VPN Server Properties dialog box, check Enable IPsec VPN Server. Note that Kerio Control can provide the Kerio VPN server and IPsec VPN server simultaneously.
4. On tab IPsec VPN, select a valid SSL certificate in the Certificate pop-up list.
5. Check Use preshared key and type the key.
   
6. Check 'Enable MS-CHAP v2 authentication'.
7. Save the settings.

Configuring IPsec server with an SSL certificate

1. In the administration interface, go to Interfaces.
2. Double-click VPN Server.
3. In the VPN Server Properties dialog, check Enable IPsec VPN Server.
4. On tab IPsec VPN, select a valid SSL certificate in the Certificate pop-up list.
   
5. On tab IPsec VPN, check Use certificate for clients.
6. Check 'Enable MS-CHAP v2 authentication'
7. Save the settings.

Configuring the client-side

Note: Each user must provide their credentials for authentication.

Configuring clients with a preshared key

Inform users what to prepare for the configuration of their clients:

1. VPN type: L2TP IPsec PSK.
2. Kerio Control hostname or IP address.
3. preshared key (PSK, shared secret).
4. username and password for access to the firewall.

Example settings for Mac:

Configuring clients with an SSL certificate

All client machines need to have the certificate imported into the Certification Trusted store. Instruct your users to contact their internal help desk in case of a message of an invalid certificate.

Note: Many mobile devices support IPsec VPN and may work with Kerio Control. However, Kerio Control officially supports the following list:

1. Android 4 and higher
2. iOS 6 and higher

For more information, please refer to Configuring VPN on iOS and Android devices.