We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

How to Configure a Site-to-Site IPsec IKEv2 VPN Tunnel

  • Last updated on

The Barracuda NextGen Firewall F-Series can establish IPsec VPN tunnels to any standard compliant IKEv2 IPsec VPN gateway. The Site-to-Site IPsec VPN tunnel must be configured with identical settings on both F-Series Firewalls and the third-party IKEv2 IPsec gateway.

ipsec_IKEv2.png

In this article:

Before You Begin

Create a VPN and Firewall service. For more information, see How to Configure Services.

Step 1. Create an IKEv2 IPsec Tunnel on the F-Series Firewall

  1. Go to CONFIGURATION > Configuration Tree > Box > Virtual Servers > your virtual server > Assigned Services > VPN-Service > Site to Site.
  2. Click the IPsec IKEv2 Tunnels tab.
  3. Click Lock.
  4. Right-click the table and select New IKEv2 Tunnel. The IKEv2 Tunnel window opens.
  5. Enter a Tunnel Name.
  6. Set Initiates Tunnel:
    • yes – The firewall is the active unit and continuously attempts to connect to the remote VPN gateway until a VPN tunnel is established.
    • no – The firewall is the passive unit and waits for connection attempts from the remote VPN gateway.
  7. Set Restart child on close:
    • yes – Restart the connection if the tunnel terminates unexpectedly.
    • no –  Close the VPN connection if the tunnel terminates unexpectedly.
    S2S_IKEv2_01.png
  8. Select the Authentication Method:
    • Pre-shared key – Enter the Shared Secret to use a shared passphrase to authenticate.
    • CA certificate – Select a Server CertificateCA Root certificate, and enter a X509 Condition to use certificate authentication.
    • X509 certificate (explicit) – Select a Server Certificate and import an Explicit X509 certificate.
    • Box SCEP certificate (CA signed) – Enter a Shared Secret, CA Root certificate, X509 Condition, and upload an Explicit X509 certificate to use SCEP to authenticate.
    S2S_IKEv2_02.png
  9. Select the Phase 1 settings:
    • Encryption – Select the encryption algorithm: AES, 3DES, Blowfish, or AES256.
    • Hash – Select the hashing algorithm: MD5, SHA, SHA256, or SHA512.
    • DH-Group –  Select the Diffie-Hellman Group. Supported groups are: 1, 2, 5, 14 - 30.
    • Lifetime (seconds) – Enter the number of seconds until the IPsec SA is re-keyed. Default: 3600
  10. Select the Phase 2 settings:
    • Encryption – Select the encryption algorithm: AES, 3DES, Blowfish, or AES256.
    • Hash – Select the hashing algorithm: MD5, SHA, SHA256, or SHA512.
    • DH-Group –  Select the Diffie-Hellman Group. Supported groups are: 1, 2, 5, 14 - 30.
    • Lifetime (seconds) – Enter the number of seconds until the IPsec SA is re-keyed. Default: 3600.
    • Lifetime (KB) – Enter the number of KB after which the IPsec SA is re-keyed.
    S2S_IKEv2_03.png 
  11. Enter the Network Local settings:
    • Local Gateway – Enter the external IP address of the F-Series Firewall. If you are using a dynamic WAN IP address, enter 0.0.0.0.

    • Local ID– Enter an IP address, FQDN, email or a distinguished name if left blank the local gateway IP is used.
    • Network Address – Add the local networks you want to reach through the VPN tunnel, and click Add.
  12. Enter the Network Remote settings:
    • Remote GatewayEnter the external IP address of the third-party appliance. If the remote appliance is using dynamic IP addresses, enter 0.0.0.0.
    • Remote ID – Enter a unique ID.
    • Network Address – Add the IP address of the remote network, and click Add.
    S2S_IKEv2_04.png
  13. Enter the Dead Peer Detection settings:
    • Action:
      • None – Disable DPD.
      • Clear Connection with the dead peer is stopped, routes removed. 
      • Hold Connection is put in hold state.
      • Restart – Connection is restarted.
    • Delay (seconds) – Enter the number of seconds, after which an empty INFORMATIONAL message is sent to check if the remote peer is still available.
    S2S_IKEv2_05.png
  14. Click OK.
  15. Click Send Changes and Activate.

Step 2. Create an IPsec Tunnel on the Remote Appliance

Configure the remote F-Series Firewall or third-party VPN gateway with the same settings. Only the local and remote networks and the IP address for the remote VPN gateway must be interchanged.

Step 3. Create Access Rules for VPN Traffic

To allow traffic in and out of the VPN tunnel, create a PASS access rule.

For more information, see How to Create Access Rules for Site-to-Site VPN Access.

Monitoring a VPN Site-to-Site Tunnel

To verify that the VPN tunnel was initiated successfully and traffic is flowing, go to VPN > Site-to-Site or VPN > Status 

S2S_IKEv2_monitor.png

Go to LOGS and select the //IKEv2 log file

S2S_IKEv2_logfile.png

Last updated on