How to set up Site-to-Site Manual IPsec VPN Tunnels on Omada Gateway via Omada Controller

Contents

Objective

Requirements

Introduction

Configuration

Verification

Conclusion

Objective

This article describes how to configure the Manual IPsec function on Omada Gateway via the Omada Controller.

Requirements

• Omada Gateways
• Omada Software Controller/Hardware Controller/Cloud Based Controller

Introduction

IPsec Site-to-Site VPN can connect geographically isolated networks. It is mainly used in large enterprises to establish VPN channels between branches and the headquarter. IPsec VPN connection is established between branch routers through the public network to transmit private network data.

Omada gateways support two types of Site-to-Site IPsec VPN, Auto IPsec and Manual IPsec. The article introduces how to configure Manual IPsec via Omada controller. For the configuration of Auto IPsec, refer to How to set up site-to-site Auto IPsec VPN Tunnels on Omada Gateway in Controller Mode.

Configuration

For example, two gateways (gateway A and gateway B) are deployed at two sites respectively. Follow the steps below to configure Manual IPsec to establish a private tunnel between the two gateways.

Step 1. Get the IPsec configuration settings. Log in to the Omada controller, go to Devices List, and click a gateway to display its properties window. Go to Details > WAN to get Site1_Gateway A’s WAN IP.

Go to Settings > Wired Networks > LAN>Networks to get Site1_Gateway A’s Local Subnet (e.g., LAN1). Repeat the above steps to get Site2_Gateway B’s WAN IP and LAN Network ((for example, 192.168.100.1/24).

Step 2. Go to Settings > VPN > VPN to configure IPsec on gateway A.

Refer to the explanation table below to configure the parameters.

Note:

• If both gateways use public IP, set Negotiation Mode to Initiator Mode and enter the peer IP or domain name in Remote Gateway.

• If only gateway A uses a public IP, set gateway A’s Negotiation Mode to Responder Mode and enter 0.0.0.0 in Remote Gateway, indicating that IPsec negotiations initiated by all IPs are accepted. Set Local ID Type and Remote ID Type to Name according to your network requirement. Set gateway B’s Negotiation Mode to Initiator Mode and enter gateway A’s IP or domain name in Remote Gateway.

Step 3. Go to Settings > VPN > VPN to configure IPsec on gateway B.

Refer to the explanation table below to configure the parameters.

Note:

• It is recommended to use IKEv2 mode for higher security and better performance unless the peer device only supports IKEv1 negotiation mode.
• The gateways at both ends must use the same negotiation mode, pre-shared key, and encryption algorithm to ensure the tunnel is successfully established.
• Avoid conflicts between the Remote Subnet and the Local Subnet.

Verification

Go to Insight > VPN Status > IPsec VPN to check the tunnel status.

Conclusion

You have now successfully connected two sites via IPsec VPN.

Get to know more details of each function and configuration please go to Download Center to download the manual of your product.