Multi-Path Room - Connect to a UniFi Gateway Console

This article explains how to connect a UniFi Gateway Console VPN (Virtual Network) to a Tehama Multi-Path Room.

Overview

What is a Tehama Multi-Path Room?
A Multi-Path Room is a short way of referring to a Tehama Room that has network access type "Multi-Path". This network access type is capable of securely connecting to networks through IPSec. Multi-Path Rooms support many such connections.

See the Multi-Path Room Connectivity User Guide for more details about Multi-Path Rooms.

Currently, only Standard Rooms support the "Multi-Path" network access type. Domain Join Rooms do not, as yet, support it.

Find out what your Room's network access type is from the Room's connection page. See section View a Room's network access setting in the Room/Desktop Connectivity - Types, Status and Settings guide for details.

What is a UniFi Gateway Console?
A UniFi Gateway Console, is a Ubiquiti Gateway device that runs the proprietary UniFi Network Application  The UniFi Gateway Console manages all UniFi devices on a network.  UniFi provides an interface to enable site-to-site IPsec VPN communication between the UniFi Gateway Console and other networks. See the Ubiquiti Support page for more information about Ubiquiti products.

Assumptions

• You have a Tehama organization and are an Admin or Org Manager user in that organization.
• You have a Ubiquiti UniFi Gateway Console that which is connected to company resources, data, etc., that you want to access, securely, from a Tehama Room.

The process to connect a private network that has a UniFi Console (version UniFi OS 3.0.18+) is divided into three parts:

• Create a Tehama Multi-Path Room
      (optional - you can also make a connection to an existing Multi-Path Room.)
• Add and Configure a New Connection
• Check the Status of the Connection

Create a Tehama Multi-Path Room

If you want to connect your private network to one of your existing Tehama Multi-Path Rooms, simply note the Room's name and skip to the next step.

Either:

• Create a new Tehama Multi-Path Room by following the steps found in the Getting Started with Tehama Room Creation guide, under section 'Create and connect a Standard Room', selecting 'Multi-Path' as the Room's Network Access type.

or

• Convert one of your existing Rooms with 'Tehama Gateway' or 'Internet-Only' network access to use 'Multi-Path' network access, by following the steps found in the Room/Desktop Connectivity - Types, Status and Settings guide, under section 'Change a Room's Network Access setting'.

Take note of your Multi-Path Room's name, for use in the creation of your connection.

Add and Configure a New Connection

Add and configure a connection to your private network, through UniFi, from your Tehama Multi-Path Room as follows:

First, gather some information about your private network.

• A) UniFi - Find Your Public IP address and Subnet information

Next, add a connection between your Multi-Path Room and your UniFi Gateway.

• B) Tehama - Create a New Connection in Your Multi-Path Room
• C) Unifi - Create and Configure a New VPN Connection on your UniFi Gateway Console

Finally, update your Multi-Path Room's firewall rules (and optionally its DNS Filtering) to allow access to resources in your private network from your Room's Tehama Desktops.

• D) Tehama - Update Firewall Rules/DNS Filtering

Let's get started with step A.

 A:  UniFi Console: Find Your Private Network Info

In this step, we will use the UniFi Console's Web Interface  to look up your public network IP Address, and also determine which Network(s) subnets you wish to connect to your Multi-Path Room.   You will need to know how to access your UniFi Console Web Interface. (Ask your IT dept for assistance, if necessary.)

 B: Tehama WebUI:  Create a New Connection in Your Multi-Path Room

In this step, we create a new connection in your Multi-Path Room. This generates the pre-shared key for the connection. This key is needed for the next step, in the UniFi interface.

If you forget to copy the values before initiating the connection, you can get to them from the CONNECTION page for the Room:

 C:  UniFi Console:  Create and Configure a Site-to-Site VPN Connection

In this step, you will create and configure a new Site-to-Site VPN connection, on your UniFi Console to connect to your Multi-Path Room.

     
Name: tehama-room 
VPN Protocol: Manual-IPsec
Pre-shared Key:  AAAAAA
Server Address:  BBBBBB
Shared Remote Subnets:  CCCCCC     < be sure to click the Add Button
Advanced Settings:  Manual
IPsec Profile:  Customized
Key Exchange Version:  IKEv2
Encryption: AES-256
Hash:  SHA256
IKE DH Group:  14
ESP DH Group:  14
Perfect Forward Secrecy (PFS):  Enable is checked
Route-Based VPN:  Enable is checked
Route Distance: 45



        

 D) Update Firewall Rules/DNS Filtering

Finally, this last step is to update your Multi-Path Room's firewall rules to allow access to resources in your private network from your Room's Tehama Desktops.

If you wish to completely open access to everything in your private network, add custom firewall rules to your Multi-Path Room allowing access to the entire subnet for your private network. Otherwise, add more granular rules.

See instructions on how to add firewall rules in section Add Custom Firewall Rule in the Firewall Rules User Guide.

You can optionally add an extra layer of access control on top of firewall rules through the Room's DNS Filtering feature. See the DNS Filtering guide for more details.

Check the Status of the Connection

Check the Status of the UniFi VPN connection you configured between your private network and your Multi-Path Room.

• Check connection status in the Tehama Web UI

 Check connection status in Tehama

 Troubleshoot connection status in Router

If the status in the Tehama Web UI is not green, you can view the UniFi Connection Status for the connection through the UniFiOS CLI: