Secure Remote Access with TP-Link ER7206 Centralized Management and LDAP Authentication

In today’s dynamic work environment, enabling secure and seamless remote access to the company’s local area network (LAN) is crucial. The TP-Link ER7206 Omada Gigabit VPN Router offers robust features, including centralized management and VPN server capabilities. This blog post will guide you through the process of configuring the ER7206 to authenticate VPN users against your organization’s LDAP server, providing a secure and manageable remote access solution.

Prerequisites:

• A TP-Link ER7206 router.
• A properly configured and accessible LDAP server within your organization’s network.
• Basic understanding of networking concepts, WAN/LAN configurations, VPNs, and LDAP.
• Administrative access to the Omada Controller and your LDAP server.

Let’s dive into the configuration steps:

Section 1: WAN Setup

First, ensure your TP-Link ER7206 router has a working internet connection. This involves configuring the Wide Area Network (WAN) interface.

1. Navigate to WAN: In the left-hand menu, click on “WAN.”
2. WAN Mode Selection: Choose your WAN mode type. For example, I am using the default mode. (Image-2)
3. Configure Your WAN Port: Look for the “WAN” settings. In my case, it’s “WAN2.” Fill in the setting information.
4. Choose Connection Type: Select the appropriate connection type based on your internet service provider (e.g., DHCP, Static IP, PPPoE). (Image-3)
5. Enter Connection Details: Provide the necessary information such as IP address, subnet mask, gateway, DNS servers (for Static IP), or username and password (for PPPoE).
6. Apply Changes: Once you have entered the correct details, click “Apply” or “Save” to save the WAN configuration. Ensure the router can successfully connect to the internet.

Section 2: Set VPN IP Pool

Next, we need to define a range of IP addresses that will be assigned to clients connecting via VPN. This IP pool should be different from your local network’s IP address range to avoid conflicts.

1. Navigate to Preferences Settings: In Menu, go to “Preferences” and then find the “VPN IP Poll” section. (Image-4)
2. Create a New IP Pool: Click “Create New IP Pool” or “Add.”
3. Define the IP Pool:
   • Name: Give the IP pool a descriptive name (e.g., “vpnclientips”).
   • Start IP Address: Enter the first IP address in the range you want to allocate for VPN clients.
   • End IP Address: Enter the last IP address in the range.
4. Apply Changes: Click “Apply” or “Save” to save the IP address pool configuration.

Section 3: Setup LDAP Configuration

Now, we’ll configure the ER7206 to communicate with your LDAP server for user authentication.

1. Navigate to Authentication: In the Omada Controller’s “Settings,” look for the “Authentication” section.
2. Go to LDAP: Select the “LDAP” option.
3. Configure LDAP Server: Click “Create New LDAP Server” or “Add.”
4. Enter LDAP Server Details:
   • Name: Give this LDAP configuration a name (e.g., “myldap”).
   • Server Address: Enter the IP address or fully qualified domain name (FQDN) of your LDAP server.
   • Destination Port: Specify the LDAP server’s port (usually 389 for standard LDAP or 636 for LDAPS).
   • Base DN: Enter the base distinguished name (DN) of your LDAP directory tree where user accounts are located (e.g., dc=example,dc=com).
   • Bind Type: Choose the appropriate bind type. In this case, we are using Anonymous bind for the additional file rule.
   • Common Name Identifer: Specify the LDAP attribute that corresponds to the user’s login name (e.g., uid, sAMAccountName).
   • Base Distinguished Name: Enter the Organizational Unit (OU) where your company’s users are located. For example: ou=users,dc=yourcompany,dc=com.
   • Additional Filter (Optional): Use this if you only want certain users in your company to be able to use the VPN service.
5. Apply Changes: Click “Apply” or “Save” to save the LDAP configuration.

Section 4: Setup L2TP VPN Server

With the WAN configured, the IP pool defined, and LDAP integration set up, we can now configure the L2TP VPN server.

1. Navigate to VPN Settings:
2. Go to L2TP :
3. Enable L2TP Server: Ensure the “Enable L2TP Server” option is checked.
4. Select WAN Interface: Choose the WAN interface that external clients will connect to.
5. Authentication Method: Select “LDAP”
6. IP Address Pool: Select the VPN IP pool you created in Section 2 (e.g., “vpnclintips”).
7. Maximum Connections: Set the maximum number of concurrent VPN connections allowed.
8. Secret (Pre-shared Key): Enter a strong and unique pre-shared key that VPN clients will need to configure on their devices. Keep this key confidential.
9. Apply Changes: Click “Apply” or “Save” to save the L2TP VPN server configuration.

Section 5: Setup Computer Client (MacOS)

Finally, let’s configure a macOS client to connect to the L2TP VPN server.

1. Open System Settings: On your macOS computer, go to “System Settings” (or “System Preferences” in older versions).
2. Navigate to Network: Click on “Network.”
3. Add VPN Connection: Click the “+” button at the bottom of the network interface list and select “Add VPN Configuration…”.
4. Choose VPN Type: From the “VPN Type” dropdown menu, select “L2TP over IPsec.”
5. Service Name: Enter a descriptive name for your VPN connection (e.g., “Company VPN”). Click “Create.”
6. Configure VPN Settings:
   • Server Address: Enter the public IP address or domain name of your TP-Link ER7206 router’s WAN interface.
   • Account Name: Enter your LDAP username (the attribute you configured in the LDAP settings, e.g., your employee ID or login).
   • Password: Enter your LDAP password.
   • Authentication Settings: Click on the “Authentication Settings…” button.
     • Shared Secret: Enter the pre-shared key you configured on the ER7206 router in Section 4. Click “OK.”
7. Advanced Settings (Optional): Click on the “Advanced…” button.
   • Send all traffic over VPN connection: Check this box if you want all internet traffic to be routed through the VPN connection.
   • DNS: You can optionally configure specific DNS servers to be used when connected to the VPN.
8. Apply and Connect: Click “Apply” to save the VPN configuration. Then, click “Connect” to establish the VPN connection. You may be prompted for your username and password again.

Conclusion:

By following these steps, you have successfully configured your TP-Link ER7206 router for centralized management and enabled secure remote access to your company’s LAN using L2TP VPN with LDAP authentication. This setup provides a manageable and secure way for your employees to work remotely, leveraging your existing LDAP infrastructure for user authentication. Remember to regularly review your VPN and security configurations to ensure ongoing security and optimal performance.