How to set up Site-to-Site Manual IPsec VPN Tunnels on Omada Gateway via Omada Controller
Contents
Objective
This article describes how to configure the Manual IPsec function on Omada Gateway via the Omada Controller.
Requirements
- Omada Gateways
- Omada Software Controller/Hardware Controller/Cloud Based Controller
Introduction
IPsec Site-to-Site VPN can connect geographically isolated networks. It is mainly used in large enterprises to establish VPN channels between branches and the headquarter. IPsec VPN connection is established between branch routers through the public network to transmit private network data.
Omada gateways support two types of Site-to-Site IPsec VPN, Auto IPsec and Manual IPsec. The article introduces how to configure Manual IPsec via Omada controller. For the configuration of Auto IPsec, refer to How to set up site-to-site Auto IPsec VPN Tunnels on Omada Gateway in Controller Mode.
Configuration
For example, two gateways (gateway A and gateway B) are deployed at two sites respectively. Follow the steps below to configure Manual IPsec to establish a private tunnel between the two gateways.
Step 1. Get the IPsec configuration settings. Log in to the Omada controller, go to Devices List, and click a gateway to display its properties window. Go to Details > WAN to get Site1_Gateway A’s WAN IP.
Go to Settings > Wired Networks > LAN>Networks to get Site1_Gateway A’s Local Subnet (e.g., LAN1). Repeat the above steps to get Site2_Gateway B’s WAN IP and LAN Network ((for example, 192.168.100.1/24).
Step 2. Go to Settings > VPN > VPN to configure IPsec on gateway A.
Refer to the explanation table below to configure the parameters.
|
Status |
Check the box to enable the VPN tunnel. |
|
Remote Gateway |
Enter the WAN IP address of Gateway B in the branch office (sut.com). |
|
Remote Subnets |
Enter the IP address range of the LAN in the branch office (192.168.100.0/24). |
|
Local Networks |
Select the networks in the headquarter (LAN 1), and the VPN policy will be applied to the selected networks. |
|
Pre-Shared Key |
Enter the Pre-Shared Key (PSK) that serves as the authentication key. The gateway in headquarter and the branch 1 office must use the same PSK for authentication. |
|
WAN |
Select the WAN port on which the VPN tunnel will be established. |
Note:
- If both gateways use public IP, set Negotiation Mode to Initiator Mode and enter the peer IP or domain name in Remote Gateway.
- If only gateway A uses a public IP, set gateway A’s Negotiation Mode to Responder Mode and enter 0.0.0.0 in Remote Gateway, indicating that IPsec negotiations initiated by all IPs are accepted. Set Local ID Type and Remote ID Type to Name according to your network requirement. Set gateway B’s Negotiation Mode to Initiator Mode and enter gateway A’s IP or domain name in Remote Gateway.
Step 3. Go to Settings > VPN > VPN to configure IPsec on gateway B.
Refer to the explanation table below to configure the parameters.
|
Status |
Check the box to enable the VPN tunnel. |
|
Remote Gateway |
Enter the WAN IP address of Gateway A in the headquarter office. |
|
Remote Subnets |
Enter the IP address range of the LAN in the headquarter office (192.168.0.0/24). |
|
Local Networks |
Select the networks in the branch (LAN 1), and the VPN policy will be applied to the selected networks. |
|
Pre-Shared Key |
Enter the Pre-Shared Key (PSK) that serves as the authentication key. The gateway in headquarter and the branch 1 office must use the same PSK for authentication. |
|
WAN |
Select the WAN port on which the VPN tunnel will be established. |
Note:
- It is recommended to use IKEv2 mode for higher security and better performance unless the peer device only supports IKEv1 negotiation mode.
- The gateways at both ends must use the same negotiation mode, pre-shared key, and encryption algorithm to ensure the tunnel is successfully established.
- Avoid conflicts between the Remote Subnet and the Local Subnet.
Verification
Go to Insight > VPN Status > IPsec VPN to check the tunnel status.
Conclusion
You have now successfully connected two sites via IPsec VPN.
Get to know more details of each function and configuration please go to Download Center to download the manual of your product.