Configure an IPsec tunnel

Configuring an IPsec tunnel with a remote device involves configuring the following items:

Required configuration items

IPsec tunnel configuration items:
- A name for the tunnel.
  Note If the tunnel name is more than eight characters, the name will be truncated in the underlying network interface to the first six characters followed by three digits, incrementing from 000. This affects any custom scripts or firewall rules that may be trying to adjust the tunnel’s interface or routing table entries.
- The mode: either tunnel or transport.
- Enable the IPsec tunnel.
  The IPsec tunnel is enabled by default.
- The firewall zone of the IPsec tunnel.
- The routing metric for routes associated with this IPsec tunnel.
- The authentication type and pre-shared key or other applicable keys and certificates.
  If SCEP certificates will be selected as the Authentication type, create the SCEP client prior to configuring the IPsec tunnel. See Configure a Simple Certificate Enrollment Protocol client for instructions.
- The local endpoint type and ID values, and the remote endpoint host and ID values.
IKE configuration items
- The IKE version, either IKEv1 or IKEv2.
- Whether to initiate a key exchange or wait for an incoming request.
- The IKE mode, either main aggressive.
- The IKE authentication protocol to use for the IPsec tunnel negotiation during phase 1 and phase 2.
- The IKE encryption protocol to use for the IPsec tunnel negotiation during phase 1 and phase 2.
- The IKE Diffie-Hellman group to use for the IPsec tunnel negotiation during phase 1 and phase 2.
Enable dead peer detection and configure the delay and timeout.
Destination networks that require source NAT.

Additional configuration items

The following additional configuration settings are not typically configured to get an IPsec tunnel working, but can be configured as needed:

Determine whether the device should use UDP encapsulation even when it does not detect that NAT is being used.
If using IPsec failover, identify the primary tunnel during configuration of the backup tunnel.
The Network Address Translation (NAT) keep alive time.
The protocol, either Encapsulating Security Payload (ESP) or Authentication Header (AH).
The management priority for the IPsec tunnel interface. The active interface with the highest management priority will have its address reported as the preferred contact address for central management and direct device access.
Enable XAUTH client authentication, and the username and password to be used to authenticate with the remote peer.
Enable Mode-configuration (MODECFG) to receive configuration information, such as the private IP address, from the remote peer.
Disable the padding of IKE packets. This should normally not be done except for compatibility purposes.
Destination networks that require source NAT.
Depending on your network and firewall configuration, you may need to add a packet filtering rule to allow incoming IPsec traffic.
Tunnel and key renegotiating
- The lifetime of the IPsec tunnel before it is renegotiated.
- The amount of time before the IKE phase 1 lifetime expires.
- The amount of time before the IKE phase 2 lifetime expires
- The lifetime margin, a randomizing amount of time before the IPsec tunnel is renegotiated.

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click VPN > IPsec.
Click to expand Tunnels.
For Add IPsec tunnel, type a name for the tunnel and click .
The new IPsec tunnel configuration is displayed.
The IPsec tunnel is enabled by default. To disable, toggle off Enable.
(Optional) Preferred tunnel provides an optional mechanism for IPsec failover behavior. See Configure IPsec failover for more information.
(Optional) Enable Force UDP encapsulation to force the tunnel to use UDP encapsulation even when it does not detect that NAT is being used.
For Zone, select the firewall zone for the IPsec tunnel. Generally this should be left at the default of IPsec.
Note Depending on your network configuration, you may need to add a packet filtering rule to allow incoming traffic. For example, for the IPsec zone:
1. Click to expand Firewall > Packet filtering.
2. For Add packet filter, click .
3. For Label, type Allow incoming IPsec traffic.
4. For Source zone, select IPsec.
Leave all other fields at their default settings.
For Metric, enter or select the priority of routes associated with this IPsec tunnel. When more than one active route matches a destination, the route with the lowest metric is used.
For Mode, select Tunnel mode. Transport mode is not currently supported.
Select the Mode, either:
- Tunnel mode: The entire IP packet is encrypted and/or authenticated and then encapsulated as the payload in a new IP packet.
- Transport mode: Only the payload of the IP packet is encrypted and/or authenticated. The IP header is unencrypted.
Select the Protocol, either:
- ESP (Encapsulating Security Payload): Provides encryption as well as authentication and integrity.
- AH (Authentication Header): Provides authentication and integrity only.
Strict routing is disabled by default. Toggle on to enable.
Strict routing makes IPsec behave like a policy-based VPN, rather than a route-based VPN.
Click to expand Authentication.
1. For Authentication type, select one of the following:
  - Pre-shared key: Uses a pre-shared key (PSK) to authenticate with the remote peer.
    1. Type the Pre-shared key.
  - Asymmetric pre-shared keys: Uses asymmetric pre-shared keys to authenticate with the remote peer.
    1. For Local key, type the local pre-shared key. This must be the same as the remote key on the remote host.
    2. For Remote key, type the remote pre-shared key. This must be the same as the local key on the remote host.
  - RSA signature: Uses a private RSA key to authenticate with the remote peer.
    1. For Private key, paste the device's private RSA key in PEM format.
    2. Type the Private key passphrase that is used to decrypt the private key. Leave blank if the private key is not encrypted.
    3. For Peer public key, paste the peer's public RSA key in PEM format.
  - SCEP certificates: Uses Simple Certificate Enrollment Protocol (SCEP) to download a private key, certificates, and an optional Certificate Revocation List (CRL) to the Connect EZ device from a SCEP server.
    You must create the SCEP client prior to configuring the IPsec tunnel. See Configure a Simple Certificate Enrollment Protocol client for instructions.
    1. For SCEP Client, select the SCEP client.
  - X.509 certificate: Uses private key and X.509 certificates to authenticate with the remote peer.
    1. For Private key, paste the device's private RSA key in PEM format.
    2. Type the Private key passphrase that is used to decrypt the private key. Leave blank if the private key is not encrypted.
    3. For Certificate, paste the local X.509 certificate in PEM format.
    4. For Peer verification, select either:
      - Peer certificate: For Peer certificate, paste the peer's X.509 certificate in PEM format.
      - Certificate Authority: For Certificate Authority chain, paste the Certificate Authority (CA) certificates. These must include all peer certificates in the chain up to the root CA certificate, in PEM format.
(Optional) For Management Priority, set the management priority for this IPsec tunnel. A tunnel that is up and has the highest priority will be used for central management and direct device access.
(Optional) To configure the device to connect to its remote peer as an XAUTH client:
1. Click to expand XAUTH client.
2. Click Enable.
3. Type the Username and Password that the device will use to authenticate as an XAUTH client with the peer.
(Optional) Click Enable MODECFG client to receive configuration information, such as the private IP address, from the remote peer.
Click to expand Local endpoint.
1. For Type, select either:
  - Default route: Uses the same network interface as the default route.
  - Interface: Select the Interface to be used as the local endpoint.
2. Click to expand ID.
  1. Select the ID type:
    - Auto: The ID will be automatically determined from the value of the tunnels endpoints.
    - Raw: Enter an ID and have it passed unmodified to the underlying IPsec stack.
      For Raw ID value, type the ID that will be passed.
    - Any: Any ID will be accepted.
    - IPv4: The ID will be interpreted as an IP address and sent as an ID_IPV4_ADDR IKE identity.
      For IPv4 ID value, type an IPv4 formatted ID. This can be a fully-qualified domain name or an IPv4 address.
    - IPv6: The ID will be interpreted as an IP address and sent as an ID_IPV6_ADDR IKE identity.
      For IPv6 ID value, type an IPv6 formatted ID. This can be a fully-qualified domain name or an IPv6 address.
    - RFC822/Email: The ID will be interpreted as an RFC822 (email address).
      For RFC822 ID value, type the ID in internet email address format.
    - FQDN: The ID will be interpreted as FQDN (Fully Qualified Domain Name) and sent as an ID_FQDN IKE identity.
      For FQDN ID value, type the ID as an FQDN.
    - KeyID: The ID will be interpreted as a Key ID and sent as an ID_KEY_ID IKE identity.
      For KEYID ID value, type the key ID.
    - MAC address: The device's primary MAC address will be used as the ID and sent as a ID_KEY_ID IKE identity.
    - Serial number: The device's serial number will be used as the ID and sent as a ID_KEY_ID IKE identity.
Click to expand Remote endpoint.
1. For IP version, select either IPv4 or IPv6.
2. For Hostname list selection, select one of the following:
  - Round robin: Attempts to connect to hostnames sequentially based on the list order.
  - Random: Randomly selects an IPsec peer to connect to from the hostname list.
  - Priority ordered: Selects the first hostname in the list that is resolvable.
3. Click to expand Hostname.
  1. Click  next to Add Hostname.
  2. For Hostname, type a hostname or IPv4 address. If your device is not configured to initiate the IPsec connection (see IKE > Initiate connection), you can also use the keyword any, which means that the hostname is dynamic or unknown.
  3. Click  again to add additional hostnames.
4. Click to expand ID.
  1. Select the ID type:
    - Auto: The ID will be automatically determined from the value of the tunnels endpoints.
    - Raw: Enter an ID and have it passed unmodified to the underlying IPsec stack.
      For Raw ID value, type the ID that will be passed.
    - Any: Any ID will be accepted.
    - IPv4: The ID will be interpreted as an IPv4 address and sent as an ID_IPV4_ADDR IKE identity.
      For IPv4 ID value, type an IPv4 formatted ID. This can be a fully-qualified domain name or an IPv4 address.
    - IPv6: The ID will be interpreted as an IPv6 address and sent as an ID_IPV6_ADDR IKE identity.
      For IPv6 ID value, type an IPv6 formatted ID. This can be a fully-qualified domain name or an IPv6 address.
    - RFC822/Email: The ID will be interpreted as an RFC822 (email address).
      For RFC822 ID value, type the ID in internet email address format.
    - FQDN: The ID will be interpreted as FQDN (Fully Qualified Domain Name) and sent as an ID_FQDN IKE identity.
      For FQDN ID value, type the ID as an FQDN.
    - KeyID: The ID will be interpreted as a Key ID and sent as an ID_KEY_ID IKE identity.
      For KEYID ID value, type the key ID.
    - MAC address: The device's primary MAC address will be used as the ID and sent as a ID_KEY_ID IKE identity.
    - Serial number: The device's serial number will be used as the ID and sent as a ID_KEY_ID IKE identity.
Click to expand Policies.
Policies define the network traffic that will be encapsulated by this tunnel.
1. Click  to create a new policy.
  The new policy configuration is displayed.
2. Click to expand Local traffic selector.
3. For Type, select one of the following:
  - Address: The address of a local network interface.
    For Address, select the appropriate interface.
  - Network: The subnet of a local network interface.
    For Address, select the appropriate interface.
  - Custom network: A user-defined network.
    For Custom network, enter the IPv4 address and optional netmask.
  - Request a network: Requests a network from the remote peer.
  - Dynamic: Uses the address of the local endpoint.
4. For Protocol, select one of the following:
  - Any: Matches any protocol.
  - TCP: Matches TCP protocol only.
  - UDP: Matches UDP protocol only.
  - ICMP: Matches ICMP requests only.
  - Other protocol: Matches an unlisted protocol.
    If Other protocol is selected, type the number of the protocol.
5. For Port, type the port matching criteria.
  Allowed values are a port number, a range of port numbers, or any.
6. (Optional) Click to expand Remote traffic selector.
7. For Remote network, enter the IP address and optional netmask of the remote network.
8. For Protocol, select one of the following:
  - Any: Matches any protocol.
  - TCP: Matches TCP protocol only.
  - UDP: Matches UDP protocol only.
  - ICMP: Matches ICMP requests only.
  - Other protocol: Matches an unlisted protocol.
    If Other protocol is selected, type the number of the protocol.
9. For Port, type the port matching criteria.
  Allowed values are a port number, a range of port numbers, or any.
Click to expand IKE.
1. For IKE version, select either IKEv1 or IKEv2. This setting must match the peer's IKE version.
2. Initiate connection instructs the device to initiate the key exchange, rather than waiting for an incoming request. This must be disabled if Remote endpoint > Hostname is set to any.
3. For Mode, select either Main mode or Aggressive mode.
4. For IKE fragmentation, select one of the following:
  - If supported by the peer: Send oversized IKE messages in fragments, if the peer supports receiving them.
  - Always: Always send IKEv1 messages in fragments. For IKEv2, this option is equivalent to If supported by the peer.
  - Never: Do not send oversized IKE messages in fragments.
  - Accept: Do not send oversized IKE messages in fragments, but announce support for fragmentation to the peer.
  The default is Always.
5. For Enable padding, click to disable the padding of IKE packets. This should normally not be disabled except for compatibility purposes.
6. For Phase 1 lifetime, enter the amount of time that the IKE security association expires after a successful negotiation and must be re-authenticated.
  Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}.
  For example, to set Phase 1 lifetime to ten minutes, enter 10m or 600s.
7. For Phase 2 lifetime, enter the amount of time that the IKE security association expires after a successful negotiation and must be rekeyed.
  Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}.
  For example, to set Phase 2 lifetime to ten minutes, enter 10m or 600s.
8. For Lifetime margin, enter a randomizing amount of time before the IPsec tunnel is renegotiated.
  Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}.
  For example, to set Lifetime margin to ten minutes, enter 10m or 600s.
9. Click to expand Phase 1 Proposals.
  1. Click  to create a new phase 1 proposal.
  2. For Cipher, select the type of encryption.
  3. For Hash, select the type of hash to use to verify communication integrity.
  4. For Diffie-Hellman group, select the type of Diffie-Hellman group to use for key exchange.
  5. You can add additional Phase 1 proposals by clicking  next to Add Phase 1 Proposal.
10. Click to expand Phase 2 Proposals.
  1. Click  to create a new phase 2 proposal.
  2. For Cipher, select the type of encryption.
  3. For Hash, select the type of hash to use to verify communication integrity.
  4. For Diffie-Hellman group, select the type of Diffie-Hellman group to use for key exchange.
  5. You can add additional Phase 2 proposals by clicking  next to Add Phase 2 Proposal.
(Optional) Click to expand Dead peer detection. Dead peer detection is enabled by default. Dead peer detection uses periodic IKE transmissions to the remote endpoint to detect whether tunnel communications have failed, allowing the tunnel to be automatically restarted when failure occurs.
1. To enable or disable dead peer detection, click Enable.
2. For Delay, type the number of seconds between transmissions of dead peer packets. Dead peer packets are only sent when the tunnel is idle.
3. For Timeout, type the number of seconds to wait for a response from a dead peer packet before assuming the tunnel has failed.
(Optional) Click to expand NAT to create a list of destination networks that require source NAT.
1. Click  next to Add NAT destination.
2. For Destination network, type the IPv4 address and optional netmask of a destination network that requires source NAT. You can also use any, meaning that any destination network connected to the tunnel will use source NAT.
(Optional) Click Advanced to set various IPsec-related time out, keep alive, and related values.
Click Apply to save the configuration and apply the change.