Site-to-site IPsec VPN between VPNaaS (SIM-Cloud) and pfSense router (remote office)

Description

Consider the configuration of the IPsec site-to-site VPN connection between the VPNaaS, on the cloud infrastructure side, and the pfSense-based router on the side of the remote office.
Both routers have real IP addresses on WAN interfaces, i.e. they do not use NAT.
This article contains configuration examples using a management interface (GUI)

Initial conditions

  • Both nodes between which the VPN tunnel is to be built have real IP addresses.

  • Site A is the cloud-based VPNaaS provided by SIM-Cloud

  • Site B is the client’s infrastructure, based on pfSense.

  • Each site has its own private subnet:

    • Site “A” - 10.5.4.0/24

    • Site “B” - 192.168.255.0/24

  • VPNaaS version: 12.0.5

  • pfSense version: CE-2.4.4-RELEASE-p3-amd64

Warning

Depending on the OS version of the router or software, subsequent configuring may vary.

Note

To set up a VPN connection, the following required conditions must be satisfied:

  • Network availability between routers:

  • Protocol: UDP, port 500 (for IKE, to manage encryption keys).

  • Protocol: UDP, port 4500 (for IPsec NAT-Traversal mode).

  • Protocol: ESP, value 50 (for IPsec).

  • Protocol: AH, value 51 (for IPsec).

  • The firewall rules must not block network traffic between the routers and the private subnets.

  • Private subnets that will be connected by means of IPsec must be different and must not include each other.

“Summary table”

VPN Router

VPN Peer IP

Private Network

Private Network GW IP

Private Network Host IP

Site “A” (VPNaaS)

156.67.54.218

10.5.4.0/24

10.5.4.1/32

10.5.4.7

Site “B” (pfSense)

156.67.53.177

192.168.255.0/24

192.168.255.22/32

192.168.255.29

In this example the initial configuration of the secure IPsec site-to-site VPN connection is carried out. To do this, we link the private networks 10.5.4.0/24 and 192.168.255.0/24, situated behind the routers.

Site A configuration (VPNaaS)

The VPNaaS is configured in accordance with the instructions:

A1. Configure IKE Policy. For this step the following parameters are used:

“IKE Policy”

Name

ikepolicy

Authorization algorithm

sha1

Encryption algorithm

3des

IKE version

v2

Lifetime value for IKE keys

86400

Perfect Forward Secrecy

group5

IKE Phase1 negotiation mode

main

A2. Configure IPsec Policy. For this step the following parameters are used:

“IPsec Policy”

Name

ipsecpolicy

Authorization algorithm

sha1

Encapsulation mode

tunnel

Encryption algorithm

3des

Lifetime value for IKE keys

3600

Perfect Forward Secrecy

group5

Transform Protocol

esp

A3. Configure VPN service. For this step the following parameters are used:

“VPN service”

Name

VPNservice

Router

Select from list of cloud project routers

A4. Configure Endpoint Groups. For this step the following parameters are used:

“Endpoint Groups”

Endpoint group name

Type

Value

local_epg

SUBNET

10.5.4.0/24

remote_epg

CIDR

192.168.255.0/24

A5. Configure IPsec site connection. For this step the following parameters are used:

“IPsec site connection”

Name

ipsecsiteconn

VPN service associated with this connection

VPNservice

Endpoint group for local subnet(s)

local_epg

IKE policy associated with this connection

ikepolicy

IPsec policy associated with this connection

ipsecpolicy

Peer gateway public IPv4/IPv6 Address or FQDN

156.67.53.177

Peer router identity for authentication (Peer ID)

156.67.53.177

Endpoint group for remote peer CIDR(s)

remote_epg

Pre-Shared Key (PSK) string

Baejii9ahwoo

MTU

1500

A6. Once all these changes have been made, it can be seen that the IPsec site connection has been successfully created and has the status ‘Down’. When the tunnel is configured at the other end and successfully established, this status changes to ‘Active’.

Site B configuration (pfSense)

Guidance for configuring the VPN on the pfSense software is taken from the original chapter from the software manufacturer - “Configuring a Site-to-Site IPsec VPN”.

B1. Configuring the VPN IPsec tunnel. Phase 1

Go to ‘VPN > IPsec’ menu and press ‘+ Add P1’ on the ‘Tunnels‘ tab.
The following parameters are to be used:
General Information

Disabled

Unchecked

To enable tunnel to work, leave unchecked

Key Exchange version

V2

Must match the version specified in the VPNaaS

Internet Protocol

IPv4

Interface

WAN

An interface facing the Internet network must be selected

Remote gateway

156.67.54.218

In this case, the public IP address of the VPNaaS

Description

VPNaaS

Description
Phase 1 Proposal (Authentication)

Authentication method

Mutual PSK

Use Pre-shared Key

My identifier

My IP address

Simple identification if using a fixed IP

Peer identifier

Peer IP address

Simple identification if using a fixed IP

Pre-Shared Key

Baejii9ahwoo

Random characters, must be same as the sequence entered at the other end
Phase 1 Proposal (Encryption Algorithm)

Encryption algorithm / Algorithm

3DES

Must match the version specified in the VPNaaS

Encryption algorithm / Hash

SHA1

Must match the version specified in the VPNaaS

Encryption algorithm / DH group

5

Must match the version specified in the VPNaaS

Lifetime

86400

Must match the version specified in the VPNaaS
Advanced Options

Disable Rekey

Unchecked

Re-request key if action times out

Disable Reauth

Unchecked

For IKEv2 only re-authenticate peer on rekeying

Dead Peer Detection

Enabled

Leave settings as default

Save changes by clicking the ‘Save‘ button.

B2. Configuring the VPN IPsec tunnel. Phase 2

Go to the ‘VPN > IPsec’ menu in the ‘Tunnels‘ tab. After pressing the ‘+ Show Phase-2 entries’ button an empty list appears; here press ‘+ Add P2’ to add a record for ‘Phase 2’.
The following parameters are to be used:
General Information

Disabled

Unchecked

To enable tunnel to work, leave unchecked

Mode

Tunnel IPv4

Select Tunnel mode

Local Network / Type

LAN subnet

Route the local LAN subnet

Remote Network / Type

Network

Route a remote network

Remote Network / Address

10.5.4.0/24

The remote LAN subnet

Description

Local network in VPNaaS

Description
Phase 2 Proposal (SA/Key Exchange)

Protocol

ESP

Select ESP for encryption

Encryption algorithms

3DES

Must match the version specified in the VPNaaS

Hash algorithms

SHA1

Must match the version specified in the VPNaaS

PFS Key group

5(1536bits)

Must match the version specified in the VPNaaS

Lifetime

3600

Must match the version specified in the VPNaaS

Save your changes by clicking ‘Save’ and adopt them by clicking ‘Apply changes’.

B3. Activating the VPN IPsec tunnel.

To activate the IPsec connection go to the ‘VPN > IPsec’ menu in the ’Tunnels’ tab.
Click the Restart Service pictogram:
../../../_images/vpn_ipsec_restart.png

B4. Add rules to the firewall to allow traffic to pass through the IPsec tunnel to our local network.

To do this, go to the ‘Firewall > Rules’ menu in the ‘IPsec’ tab and add the rule according to the table:

“Edit IPsec Firewall rules”

Action

Interface

Address Family

Protocol

Source

Destination

Description

Pass

IPsec

IPv4

any

any

LAN net

Allow IPsec traffic to LAN net

Save the rule by clicking Save and adopt it by clicking ‘Apply changes’.

Tunnel function check

When these changes are complete the VPN tunnel should be established and traffic between the local networks should be able to flow through it.
This can be verified with a ping command between the hosts on opposite local networks.

Note

If the tunnel is not established, restart the VPN service from both sides.

  • To check the tunnel status in pfSense, go to the ‘Status > IPsec’ menu in the ‘Overview‘ tab. Click the button ‘Show child SA entries’ to see the details for ‘Phase 2‘.

  • The status of the IPsec site connection in the VPNaaS has changed to Active.