Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 22 replies
  • Answers 1 answer
  • Subscribers 6 subscribers
  • Views 60999 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM SSL VPN and GrandStream Phones

JayMan

 GrandStream phones have an OpenVPN client built in but they only allow the .ca. crt. key to be uploaded to the phone as well as putting inthe VPN server IP, port and protocol. It doesn't allow a login/password field.  Contacting Grandstream support they just tell me not to use a login/password. Is this even possible with the UTM.  Keeping in mine I have about 150 VPN users so making a major change to the SSL VPN isn't an option because those 150 would need to redownload configs.

 

Can you make a local user who is cert based only?

 

all our others users are AD/Radius backend sync



This thread was automatically locked due to age.
Parents
  • 0

    If they don't have a builtin user and password, you're out of luck with the UTM's implementation of OpenVPN.  There's no way to create a blank user with a blank password.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    That is what I was afraid of.  And they are telling me to just turn off the login/pass option on the OpenVPN server and just use certs.

  • 0 in reply to JayMan

    That option doesn't exist in WebAdmin.  I'm no OpenVPN guru (and there is at least one here), but maybe you can achieve that from the command line with

    cc set ssl_vpn user_auth_optional 1

    Set it back to not-optional with

    cc set ssl_vpn user_auth_optional 0

    Did turning optional on allow you to connect from the phone and also from a PC or smart phone using authentication?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Setting it optional wouldn't pass our audits I thought of that.

     

    And now the grandstream devs are saying Sophos isn't openVPN at all because they call it SSL so I sent them screenshots of my openvpn client connected up.

  • 0 in reply to JayMan

    Hi JayMan,

    Wow, been using Grandstream for years and I didn't expect them to be that Obtuse about the OpenVPN that Sophos uses but calls it SSL VPN...

    Are there any other options like L2TP with Radius auth?

    Emile

  • 0 in reply to Emile Belcourt

    only option they have is OpenVPN. via uploading the certs only.

  • 0 in reply to Emile Belcourt

    These are the types of replies I am getting.

     

    "

    server side make sure that you config it to not have user name or password

    set blowfish encryption cause our phones can't handle anything to high
  • 0 in reply to JayMan

    I kinda wish they would understand adding 2 fields and I could be buying 20-50 phones in short order.  2 fields can't be that hard to put in the firmware.

  • 0 in reply to JayMan

    Hi Jayman,

    My rebuttal to them is that they are using an insecure method of connecting via VPN. Setting up an open vpn server as to how you need it would be a security risk in my eyes. What do they say if you comment the security implications of hamstringing your security infrastructure to use deprecated VPN methods and deprecated/weak encryption protocols to perform the connection?

    Sadly this sounds more like a political issue tban a technical one. Could you post an internal openvpn server that the UTM would forward the phones onto?

    Emile

  • 0 in reply to Emile Belcourt

    Funny you said that.    12hours ago I posted to them.

     

    We cannot change our server side to remove logins/passwords. It is NOT a secure way to run a VPN. If you use only certs someone can get those certs and gain full access without logins to stop them as certs can be transferred via email and other methods with or without someones knowledge. 

    Your phone firmware should provide a place to put logins/passwords it is 2 fields it shouldn't be very difficult to add rather than asking customers to redesigned there network infrastructure.

    If I was able to change the server side I would need to have 200 VPN users in my company redownload all the configs to change the client side which I am not willing to do.

Reply
  • 0 in reply to Emile Belcourt

    Funny you said that.    12hours ago I posted to them.

     

    We cannot change our server side to remove logins/passwords. It is NOT a secure way to run a VPN. If you use only certs someone can get those certs and gain full access without logins to stop them as certs can be transferred via email and other methods with or without someones knowledge. 

    Your phone firmware should provide a place to put logins/passwords it is 2 fields it shouldn't be very difficult to add rather than asking customers to redesigned there network infrastructure.

    If I was able to change the server side I would need to have 200 VPN users in my company redownload all the configs to change the client side which I am not willing to do.

Children
Unfiltered HTML