Skip to main content

Network Engineering Guide

Network engineering documentation covering OpenConnect protocol, network topology, firewall configuration, and troubleshooting.

Overview​

This section is designed for network engineers who need to:

  • Understand the OpenConnect protocol in depth
  • Design network topologies for VPN deployments
  • Configure firewalls, routing, and NAT
  • Optimize DNS and DHCP integration
  • Tune performance and troubleshoot issues
  • Analyze network traffic and protocols

Network Engineering Topics​

1. Protocol Deep Dive​

Understand OpenConnect protocol internals:

2. Network Topology​

Design VPN network architectures:

3. Firewall & Routing​

Configure network infrastructure:

4. DNS & DHCP​

Configure name resolution and addressing:

5. Performance Tuning​

Optimize VPN performance:

6. Troubleshooting​

Diagnose and resolve network issues:

OpenConnect Protocol Overview​

The OpenConnect protocol (also known as AnyConnect protocol) uses:

Phase 1: HTTPS Authentication (TCP 443)​

Client                          Server
  |                               |
  |--- TLS ClientHello ---------->|
  |<-- TLS ServerHello -----------|
  |--- Certificate Auth --------->|
  |<-- Authentication Response ---|
  |--- Username/Password -------->|
  |<-- CONNECT Response ----------|
  |<-- XML Configuration ---------|

Phase 2: DTLS Tunnel (UDP 443)​

Client                          Server
  |                               |
  |--- DTLS ClientHello --------->|
  |<-- DTLS ServerHello ----------|
  |--- DTLS Master Secret ------->|
  |<-- DTLS Connected ------------|
  |                               |
  |<====== IP Traffic ==========>|
  |    (Encrypted UDP tunnel)     |

Network Requirements​

Minimum Requirements​

ComponentRequirement
Bandwidth1 Mbps per user (minimum)
Latency< 100ms (recommended)
PortsTCP/UDP 443 (standard)
IP Range/24 network minimum (254 addresses)
DNSInternal DNS server or forwarding

Firewall Rules​

Inbound (Server):

  • TCP 443 (HTTPS authentication)
  • UDP 443 (DTLS tunnel)

Outbound (Client):

  • TCP 443 to VPN server
  • UDP 443 to VPN server

Internal (VPN Network):

  • Allow forwarding between VPN and LAN
  • Configure NAT for internet access

Common Network Topologies​

1. Simple Remote Access​

[Remote Clients] ---> [WolfGuard] ---> [Corporate LAN]
                       (Split Tunnel)

2. Hub-and-Spoke​

[Branch Office 1] ─┐
                    ├─> [WolfGuard Hub] ---> [Data Center]
[Branch Office 2] ─┘

3. Multi-Region HA​

[Clients] ---> [Load Balancer]
                   ├─> [WolfGuard US-East]
                   ├─> [WolfGuard US-West]
                   └─> [WolfGuard EU]

Quick Start for Network Engineers​

1. Understand the Protocol​

Start with OpenConnect Overview to understand the protocol flow, then review:

2. Plan Your Network​

Choose your topology:

3. Configure Firewall​

Set up your firewall:

  1. Review Port Requirements
  2. Configure iptables or your firewall
  3. Set up NAT Traversal if needed
  4. Configure Routing

4. Set Up DNS​

Configure name resolution:

5. Optimize Performance​

Tune for your environment:

Protocol Analysis Tools​

Packet Capture​

# Capture VPN traffic
tcpdump -i any -w vpn-capture.pcap \
  'port 443 and host vpn.example.com'

# Analyze with Wireshark
wireshark vpn-capture.pcap

Connection Testing​

# Test TCP connectivity
nc -zv vpn.example.com 443

# Test UDP connectivity
nc -zvu vpn.example.com 443

# Test TLS handshake
openssl s_client -connect vpn.example.com:443

# Test DTLS (if supported by tool)
openssl s_client -dtls -connect vpn.example.com:443

DNS Testing​

# Test DNS resolution
dig vpn.example.com

# Test reverse DNS
dig -x 192.0.2.1

# Test split DNS from VPN client
nslookup internal.corp.com

Performance Benchmarks​

MetricExpected Value
Throughput1-10 Gbps (depends on hardware)
Latency+1-5ms (VPN overhead)
Handshake Time100-500ms
Reconnect Time< 2 seconds
Concurrent Users1000+ (per server)

Troubleshooting Quick Reference​

SymptomLikely CauseSolution
Cannot connectFirewall blockingCheck Port Requirements
Slow performanceMTU issuesReview MTU Optimization
Frequent disconnectsDPD timeoutAdjust DPD Timers
DNS not workingSplit DNS misconfiguredCheck Split DNS
Some sites unreachableRouting problemReview Routing Config

Advanced Topics​

IPsec vs OpenConnect​

FeatureIPsecOpenConnect
TransportESP/UDPHTTPS/DTLS
Firewall FriendlyNoYes
NAT TraversalComplexBuilt-in
Setup ComplexityHighMedium
Client SupportNativeRequires client

OpenConnect vs SSL VPN​

OpenConnect is an SSL VPN protocol. It uses:

  • TLS for authentication and control
  • DTLS for high-performance data tunnel
  • Fallback to TLS if UDP is blocked

Security Considerations​

  1. Use TLS 1.3 - Disable older versions
  2. Strong cipher suites - See Cryptography
  3. Perfect Forward Secrecy - Use ephemeral key exchange
  4. Certificate pinning - Pin server certificates
  5. Network segmentation - Isolate VPN network
  6. Intrusion detection - Monitor for anomalies

Standards & RFCs​

Need help with network configuration? Start with Protocol Overview or Troubleshooting