ubnt:ipsec_site-to-site_vpn
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
ubnt:ipsec_site-to-site_vpn [2019/01/31 17:44] derek |
ubnt:ipsec_site-to-site_vpn [2024/09/22 19:51] (current) |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| =====Ipsec Site-to-site Vpn===== | =====Ipsec Site-to-site Vpn===== | ||
| + | Guide to set up a site-to-site VPN between two Ubiquiti Edgerouters | ||
| - | | + | * Generate a temporary |
| - | + | * Setup vpn.site-l.com and vpn.site-r.com as CNAMEs to the root domain for the sites and use those as the peer names | |
| - | Check to make sure IPsec hardware offloading is enabled using '' | + | |
| - | Use '' | + | |
| - | + | ||
| - | | + | |
| * On each of the routers, configure the VPN as below switching the FQDN and subnets as required | * On each of the routers, configure the VPN as below switching the FQDN and subnets as required | ||
| * '' | * '' | ||
| Line 12: | Line 9: | ||
| * '' | * '' | ||
| * '' | * '' | ||
| - | * '' | + | * '' |
| * '' | * '' | ||
| * '' | * '' | ||
| Line 19: | Line 16: | ||
| * '' | * '' | ||
| * '' | * '' | ||
| - | * '' | + | * '' |
| - | * '' | + | * '' |
| * Even using the '' | * Even using the '' | ||
| Line 26: | Line 23: | ||
| * '' | * '' | ||
| * '' | * '' | ||
| - | * '' | + | * '' |
| - | * '' | + | * '' |
| * '' | * '' | ||
| - | * FIXME: TODO Change from pre-shared key to certificate-based authentication. | + | * The above should give a working site-to-site VPN connection, the commands below are for extra useful features |
| + | * Run the following on each of the routers, replacing hostnames as appropriate (This shows commands for er-l): | ||
| < | < | ||
| + | # Run this generate command on each of the routers first and copy the public key to paste into the others settings | ||
| generate vpn rsa-key | generate vpn rsa-key | ||
| configure | configure | ||
| + | |||
| + | # IPsec hardware offloading | ||
| + | set system offload ipsec enable | ||
| + | |||
| + | # Use domain-specific DNS across the VPN | ||
| + | set service dns forwarding listen-on eth0 # (Or pppoe0 if using PPPoE) | ||
| + | set service dns forwarding options server=/ | ||
| + | set service dns forwarding options server=/ | ||
| + | |||
| + | # Change hashing and encryption settings | ||
| + | set vpn ipsec ike-group FOO0 proposal 1 encryption aes256 | ||
| + | set vpn ipsec ike-group FOO0 proposal 1 hash sha256 | ||
| + | set vpn ipsec ike-group FOO0 lifetime 86400 | ||
| + | |||
| + | set vpn ipsec esp-group FOO0 proposal 1 encryption aes128 | ||
| + | set vpn ipsec esp-group FOO0 proposal 1 hash md5 | ||
| + | set vpn ipsec esp-group FOO0 lifetime 43200 | ||
| + | set vpn ipsec esp-group FOO0 pfs disable | ||
| + | |||
| + | # Change IKE Key Exchange from version 1 to version 2 | ||
| + | set vpn ipsec ike-group FOO0 key-exchange ikev2 | ||
| + | |||
| + | # Enable Dead Peer Detection (DPD) | ||
| + | set vpn ipsec ike-group FOO0 dead-peer-detection action restart | ||
| + | set vpn ipsec ike-group FOO0 dead-peer-detection interval 30 | ||
| + | set vpn ipsec ike-group FOO0 dead-peer-detection timeout 120 | ||
| + | |||
| + | # Authentication IDs | ||
| + | set vpn ipsec site-to-site peer er-r.ubnt.com authentication id @er-l.ubnt.com | ||
| + | set vpn ipsec site-to-site peer er-r.ubnt.com authentication remote-id @er-r.ubnt.com | ||
| + | |||
| + | # RSA Authentication | ||
| set vpn rsa-keys local-key file / | set vpn rsa-keys local-key file / | ||
| - | set vpn rsa-keys rsa-key-name er-l rsa-key <er-l public key> | + | set vpn rsa-keys rsa-key-name er-r rsa-key <er-r public key> |
| + | |||
| + | delete vpn ipsec site-to-site peer er-r.ubnt.com authentication mode | ||
| + | delete vpn ipsec site-to-site peer er-r.ubnt.com authentication pre-shared-secret | ||
| - | delete | + | set vpn ipsec site-to-site peer er-r.ubnt.com authentication mode rsa |
| - | delete | + | set vpn ipsec site-to-site peer er-r.ubnt.com authentication |
| - | set vpn ipsec site-to-site peer er-l.ubnt.com authentication mode rsa | + | commit; save |
| - | set vpn ipsec site-to-site peer er-l.ubnt.com authentication rsa-key-name er-l | + | |
| </ | </ | ||
| Line 50: | Line 83: | ||
| * '' | * '' | ||
| * '' | * '' | ||
| - | * Deselect '' | + | |
| - | * Select '' | + | |
| + | * Select '' | ||
| * '' | * '' | ||
| * Or in the cli: | * Or in the cli: | ||
| < | < | ||
| configure | configure | ||
| + | # On the router with PPPoE: | ||
| + | set firewall options mss-clamp interface-type PPPoE | ||
| + | # On the router without PPPoE: | ||
| set firewall options mss-clamp interface-type all | set firewall options mss-clamp interface-type all | ||
| set firewall options mss-clamp mss 1382 | set firewall options mss-clamp mss 1382 | ||
| Line 62: | Line 99: | ||
| </ | </ | ||
| + | ===Notes: | ||
| + | * Reconnect to VPN using '' | ||
| + | * Tail (show last few lines and watch for more) the VPN logs using '' | ||
| - | * FIXME TODO: | + | * Sources: |
| - | * Get DNS across the VPN working (Possibly using DNS-views) | + | * https:// |
| - | * Change the P1 and P2 Security Associations. | + | * https:// |
| - | * Change the IKE Key Exchange from version 1 to version 2? | + | |
| - | | + | |
ubnt/ipsec_site-to-site_vpn.1548956655.txt.gz · Last modified: 2024/09/22 19:51 (external edit)
Page Tools
