How to set up Site-to-Site Manual IPsec VPN Tunnels on Omada Gateway via Omada Controller
G36W-4G , ER7206 , ER8411 , ER707-M2 , ER7412-M2 , G36 , ER706W-4G , ER706W , ER605( V1 V2 V2.6 ) , ER7212PC , G611
Recent updates may have expanded access to feature(s) discussed in this FAQ. Visit your product's support page, select the correct hardware version for your device and check either the Datasheet or the firmware section for the latest improvements added to your product.
Contents
Objective
This article describes how to configure the Manual IPsec function on Omada Gateway via the Omada Controller.
Requirements
- Omada Gateways
- Omada Software Controller/Hardware Controller/Cloud Based Controller
Introduction
IPsec Site-to-Site VPN can connect geographically isolated networks. It is mainly used in large enterprises to establish VPN channels between branches and the headquarter. IPsec VPN connection is established between branch routers through the public network to transmit private network data.
Omada gateways support two types of Site-to-Site IPsec VPN, Auto IPsec and Manual IPsec. The article introduces how to configure Manual IPsec via Omada controller. For the configuration of Auto IPsec, refer to How to set up site-to-site Auto IPsec VPN Tunnels on Omada Gateway in Controller Mode.
Configuration
For example, two gateways (gateway A and gateway B) are deployed at two sites respectively. Follow the steps below to configure Manual IPsec to establish a private tunnel between the two gateways.
Step 1. Get the IPsec configuration settings. Log in to the Omada controller, go to Devices List, and click a gateway to display its properties window. Go to Details > WAN to get Site1_Gateway A’s WAN IP.
Go to Settings > Wired Networks > LAN>Networks to get Site1_Gateway A’s Local Subnet (e.g., LAN1). Repeat the above steps to get Site2_Gateway B’s WAN IP and LAN Network ((for example, 192.168.100.1/24).
Step 2. Go to Settings > VPN > VPN to configure IPsec on gateway A.
Refer to the explanation table below to configure the parameters.
Status |
Check the box to enable the VPN tunnel. |
Remote Gateway |
Enter the WAN IP address of Gateway B in the branch office (sut.com). |
Remote Subnets |
Enter the IP address range of the LAN in the branch office (192.168.100.0/24). |
Local Networks |
Select the networks in the headquarter (LAN 1), and the VPN policy will be applied to the selected networks. |
Pre-Shared Key |
Enter the Pre-Shared Key (PSK) that serves as the authentication key. The gateway in headquarter and the branch 1 office must use the same PSK for authentication. |
WAN |
Select the WAN port on which the VPN tunnel will be established. |
Note:
- If both gateways use public IP, set Negotiation Mode to Initiator Mode and enter the peer IP or domain name in Remote Gateway.
- If only gateway A uses a public IP, set gateway A’s Negotiation Mode to Responder Mode and enter 0.0.0.0 in Remote Gateway, indicating that IPsec negotiations initiated by all IPs are accepted. Set Local ID Type and Remote ID Type to Name according to your network requirement. Set gateway B’s Negotiation Mode to Initiator Mode and enter gateway A’s IP or domain name in Remote Gateway.
Step 3. Go to Settings > VPN > VPN to configure IPsec on gateway B.
Refer to the explanation table below to configure the parameters.
Status |
Check the box to enable the VPN tunnel. |
Remote Gateway |
Enter the WAN IP address of Gateway A in the headquarter office. |
Remote Subnets |
Enter the IP address range of the LAN in the headquarter office (192.168.0.0/24). |
Local Networks |
Select the networks in the branch (LAN 1), and the VPN policy will be applied to the selected networks. |
Pre-Shared Key |
Enter the Pre-Shared Key (PSK) that serves as the authentication key. The gateway in headquarter and the branch 1 office must use the same PSK for authentication. |
WAN |
Select the WAN port on which the VPN tunnel will be established. |
Note:
- It is recommended to use IKEv2 mode for higher security and better performance unless the peer device only supports IKEv1 negotiation mode.
- The gateways at both ends must use the same negotiation mode, pre-shared key, and encryption algorithm to ensure the tunnel is successfully established.
- Avoid conflicts between the Remote Subnet and the Local Subnet.
Verification
Go to Insight > VPN Status > IPsec VPN to check the tunnel status.
Conclusion
You have now successfully connected two sites via IPsec VPN.
Get to know more details of each function and configuration please go to Download Center to download the manual of your product.
Related FAQs
Is this faq useful?
Your feedback helps improve this site.
What’s your concern with this article?
- Dissatisfied with product
- Too Complicated
- Confusing Title
- Does not apply to me
- Too Vague
- Other
Thank you
We appreciate your feedback.
Click here to contact TP-Link technical support.
TP-Link Community
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.
We have updated our Policies. Read Privacy Policy and Terms of Use here.
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy .
We have updated our Policies. Read Privacy Policy and Terms of Use here.
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy .
Basic Cookies
These cookies are necessary for the website to function and cannot be deactivated in your systems.
TP-Link
SESSION, JSESSIONID, accepted_local_switcher, tp_privacy_base, tp_privacy_marketing, tp_smb-select-product_scence, tp_smb-select-product_scenceSimple, tp_smb-select-product_userChoice, tp_smb-select-product_userChoiceSimple, tp_smb-select-product_userInfo, tp_smb-select-product_userInfoSimple, tp_top-banner, tp_popup-bottom, tp_popup-center, tp_popup-right-middle, tp_popup-right-bottom, tp_productCategoryType
Youtube
id, VISITOR_INFO1_LIVE, LOGIN_INFO, SIDCC, SAPISID, APISID, SSID, SID, YSC, __Secure-1PSID, __Secure-1PAPISID, __Secure-1PSIDCC, __Secure-3PSID, __Secure-3PAPISID, __Secure-3PSIDCC, 1P_JAR, AEC, NID, OTZ
Zendesk
OptanonConsent, __cf_bm, __cfruid, _cfuvid, _help_center_session, _pendo___sg__.<container-id>, _pendo_meta.<container-id>, _pendo_visitorId.<container-id>, _zendesk_authenticated, _zendesk_cookie, _zendesk_session, _zendesk_shared_session, ajs_anonymous_id, cf_clearance
Analysis and Marketing Cookies
Analysis cookies enable us to analyze your activities on our website in order to improve and adapt the functionality of our website.
The marketing cookies can be set through our website by our advertising partners in order to create a profile of your interests and to show you relevant advertisements on other websites.
Google Analytics & Google Tag Manager
_gid, _ga_<container-id>, _ga, _gat_gtag_<container-id>
Google Ads & DoubleClick
test_cookie, _gcl_au