Difference between revisions of "IPSec Tunnel w/CA Certs Configuration"

From Teltonika Networks Wiki
 
(55 intermediate revisions by one other user not shown)
Line 1: Line 1:
−
[[IPSec Tunnel w/CA Certs Configuration]]
+
<p style="color:red">The information in this page is updated in accordance with [https://wiki.teltonika-networks.com/view/FW_%26_SDK_Downloads'''00.07.08'''] firmware version.</p>
  
 
==Introduction==
 
==Introduction==
  
−
In computing, '''Internet Protocol Security''' ('''IPsec''') is a secure network protocol suite of IPv4 that authenticates and encrypts the packets of data sent over an IPv4 network. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to use during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). Internet Protocol security (IPsec) uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data-origin authentication, data integrity, data confidentiality (encryption), and replay protection.
+
In computing, '''Internet Protocol Security''' ('''IPsec''') is a secure network protocol suite of IPv4 that authenticates and encrypts the packets of data sent over an IPv4 network. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to use during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). Internet Protocol security (IPsec) uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection.
  
−
This article provides an extensive configuration example with details on how to create a tunnel connection authenticating with CA Certs between two IPsec instances, both of which configured on RUTxxx routers.
+
This article provides an extensive configuration example with details on how to create a tunnel connection authenticating with X.509 Certs between two IPsec instances, both of which are configured on RUTxxx routers.
  
 
==Configuration overview and prerequisites==
 
==Configuration overview and prerequisites==
Line 12: Line 12:
  
 
'''Prerequisites''':
 
'''Prerequisites''':
−
* Two RUTxxx routers of any type
+
* Two RUTxxx routers of any type;
−
* Both RUTxxx routers must be accessible from each other's WAN connection
+
* One RUTxxx router with public IP address;
−
* (Optional) A second end device to configure and test remote LAN access
+
* Both RUTxxx routers must be accessible from each other's WAN connection;
 +
* Firmware for the devices must be 00.07.xx.x or above. This is in part to make sure the StrongSwan service is at least version U5.9.6;
 +
* An end device (PC, Laptop) for configuration;
 +
* (Optional) A second end device to test remote LAN access;
 
----
 
----
  
−
[Image Here showing RUT1 & RUT2 connected via Wan connection]
+
[[File:IPSec RUT1-IPSec RUT2 Example Image.png|none|none]]
−
[RUT1 Wan IP: 10.0.5.1 Lan IP: 192.168.1.1]
 
−
[RUT2 Wan IP: 10.0.5.2 Lan IP: 192.168.2.1]
 
  
 
The figure above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via their WAN interfaces.
 
The figure above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via their WAN interfaces.
Line 27: Line 28:
 
We will start our configuration with RUT1.
 
We will start our configuration with RUT1.
  
−
This configuration guide will generate our own CA cert that will be used to self-sign our own keys and local certs for both devices.
+
To generate certificates via router, you can refer to this link, whereas we will cover: [https://wiki.teltonika-networks.com/view/RUTX11_Administration#Certificates Generating certificate via router]
  
−
===Generating CA Cert===
+
===IPsec RUT1 Config===
 
----
 
----
 +
* Make sure that you have your certificates generated both for '''RUT1''' and '''RUT2''' routers.
 +
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
 +
* Add a new instance with your desired name, in my case I will be using '''RUT1'''
  
−
First we will generate our CA cert.
+
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec.png|border|center|class=tlt-border|1102px]]
  
−
* Login to the router's WebUI and go to '''System → Administration → Certificates'''.  
+
Start by configuring the '''RUT''' device. Login to the WebUI, navigate to '''Services → VPN → IPsec and add a new IPsec instance.''' Configure everything as follows.  
−
The following are the settings used for this example, but values should be changed depending on your specific needs:
+
'''Note:''' ''Not specified fields can be left as is or changed according to your needs.''
 +
====Instance configuration====
 +
----
 +
Make the following changes:
 +
# '''''Enable''''' instance;
 +
# Remote endpoint - '''''RUT2 WAN IP;'''''
 +
# Authentication method - '''''X.509;'''''
 +
# Key - the '''''RUT1.key.pem''''' that you have generated from certificates;
 +
# Local certificate - the '''''RUT1.cert.pem''''' that you have generated from certificates;
 +
# CA certificate - the '''''CA.cert.pem''''' that you have generated from certificates;
 +
# Local identifier – '''''RUT1 LAN IP, which is 192.168.3.1 in this case;'''''
 +
# Remote identifier – '''''RUT2 LAN IP, which is 192.168.14.1 in this case'''''
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec_config_general_instnace.png|border|class=tlt-border|center]]
 +
----
 +
We will need to add RUT2 certificate in the '''Advanced settings''':
 +
# Click on '''Advanced settings''' in the IPsec instance section;
 +
# Remote certificate - the '''''RUT2.cert.pem''''' that you have generated from certificates;
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec_config_general_instnace_advanced.png|border|class=tlt-border|center]]
 +
====Connection general section configuration====
 +
----
 +
Make the following changes:
 +
# Mode - '''''Start;'''''
 +
# Type - '''''Tunnel;'''''
 +
# Local subnet – '''''192.168.3.0/24;'''''
 +
# Remote subnet – '''''192.168.14.0/24;'''''
 +
# Key exchange - '''''IKEv2;'''''
 +
 
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec_config_connection.png|border|class=tlt-border|center]]
  
−
- File Type: CA
+
====Connection advanced section configuration====
−
- Key Size: 1024
+
----
−
- Name (CN): CAIPSec // This can be whatever name you choose.
+
Make the following changes:
−
- Subject Information: Toggled On // It is recommended to fill out at least Country Code, State/Province and Organization Name.
+
# Open '''Advanced settings''';
−
- Country Code (CC): US // Fill your country code
+
# '''''Enable Force encapsulation''''';
−
- State or Province Name (ST): TX // Fill your State/Province name
+
# '''''Enable Local firewall''''';
−
- Locality Name (L): CAIPSec // Fill your locality name, or at least a recognizable name for your CA
+
# '''''Enable Remote firewall''''';
−
- Organization Name (O): CAIPSec // Fill your Organization name
+
# Inactivity: '''''3600''''' - Defines the timeout interval, after which the connection is closed;
−
- Organizational Unit Name (OU): CAIPSEC // Fill your specific Unit Name
+
# '''''Enable Dead peer detection''''';
−
- `Generate` Certificate
+
# DPD action – '''''Restart''''';
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec_config_connection_advanced.png|border|class=tlt-border|center]]
 +
====Proposal configuration====
 +
'''Important:''' Both the RUT1 and RUT2 Encryptions must match in order for this configuration to work.
 +
----
 +
'''Note:''' ''This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.''
  
−
[Screenshot Here]
+
Make the following changes:
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=330; style="border-bottom: 1px solid white;></th>
 +
        <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase1_settings_v1.png|border|class=tlt-border|671x336px|center]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 4px solid white>
 +
# Encryption - '''''AES256;'''''
 +
# Authentication - '''''SHA512;'''''
 +
# DH group - '''''MODP4096;'''''
 +
# IKE lifetime - '''86400s'''.
 +
        </td>
 +
    </tr>
 +
</table>
  
−
After you hit Generate the CA cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.key.pem under *Keys* and a CAIPSec.req.pem under *Certificate requests*.
+
----
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=330; style="border-bottom: 1px solid white;></th>
 +
        <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase2_settings_v1.png|border|class=tlt-border|644x331px|center]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 4px solid white>
 +
# Encryption - '''''AES256;'''''
 +
# Authentication - '''''SHA512;'''''
 +
# PFS group - '''''MODP4096;'''''
 +
# Lifetime – '''''86400s;'''''
 +
        </td>
 +
    </tr>
 +
</table>
  
−
[Screenshot Here]
 
  
  
−
Next we need to sign the CAIPSec CA. We will be Self-Signing our own CA.
 
−
Under the `Certificate signing` configure as follows:
 
  
−
- Signed Certificate Name: CAIPSec
+
===IPsec RUT2 Config===
−
- Type of Certificate to Sign: Certificate Authority
+
----
−
- Certificate Request File: CAIPSec.req.pem
+
* Make sure that you have your certificates generated both for '''RUT1''' and '''RUT2''' routers.
−
- Days Valid: 3650 // For this example we will use 3650 days, but you can configure this to be longer if needed. I would caution against too long of a CA.
+
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
−
- Certificate Authority Key: CAIPSec.key.pem
+
* Add a new instance with your desired name, in my case I will be using '''RUT2'''
−
- Leave the rest of the configuration alone
 
−
- `Sign`
 
  
−
After you hit *Sign* the CA cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.cert.pem under *Certificates*.
+
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec.png|border|center|class=tlt-border|1102px]]
  
−
===Generating Rut1 Client Cert===
+
Start by configuring the '''RUT''' device. Login to the WebUI, navigate to '''Services → VPN → IPsec and add a new IPsec instance.''' Configure everything as follows.
 +
'''Note:''' ''Not specified fields can be left as is or changed according to your needs.''
 +
====Instance configuration====
 +
----
 +
Make the following changes:
 +
# '''''Enable''''' instance;
 +
# Authentication method - '''''X.509;'''''
 +
# Key - the '''''RUT2.key.pem''''' that you have generated from certificates;
 +
# Local certificate - the '''''RUT2.cert.pem''''' that you have generated from certificates;
 +
# CA certificate - the '''''CA.cert.pem''''' that you have generated from certificates;
 +
# Local identifier – '''''RUT2 LAN IP, which is 192.168.14.1 in this case;'''''
 +
# Remote identifier – '''''RUT1 LAN IP, which is 192.168.3.1 in this case'''''
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec_config_connection_rut2.png|border|class=tlt-border|center]]
 +
----
 +
We will need to add RUT2 certificate in the '''Advanced settings''':
 +
# Click on '''Advanced settings''' in the IPsec instance section;
 +
# Remote certificate - the '''''RUT1.cert.pem''''' that you have generated from certificates;
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec_config_connection_advanced_rut2.png|border|class=tlt-border|center]]
 +
====Connection general section configuration====
 
----
 
----
 +
Make the following changes:
 +
# Mode - '''''Start;'''''
 +
# Type - '''''Tunnel;'''''
 +
# Local subnet – '''''192.168.14.0/24;'''''
 +
# Remote subnet – '''''192.168.3.0/24;'''''
 +
# Key exchange - '''''IKEv2;'''''
  
−
* Login to the router's WebUI and go to '''System → Administration → Certificates'''.  
+
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec_config_connection_rut2_general.png|border|class=tlt-border|center]]
−
The following are the settings used for this example, but values should be changed depending on your specific needs:
 
  
−
- File Type: Client
+
====Connection advanced section configuration====
−
- Key Size: 1024
+
----
−
- Name (CN): RUT1 // This can be whatever name you choose.
+
Make the following changes:
−
- Subject Information: Toggled On // It is recommended to fill out at least Country Code, State/Province and Organization Name.
+
# Open '''Advanced settings''';
−
- Country Code (CC): US // Fill your country code
+
# '''''Enable Force encapsulation''''';
−
- State or Province Name (ST): TX // Fill your State/Province name
+
# '''''Enable Local firewall''''';
−
- Locality Name (L): RUT1 // Fill your locality name, or at least a recognizable name for your CA
+
# '''''Enable Remote firewall''''';
−
- Organization Name (O): RUT1 // Fill your Organization name
+
# Inactivity: '''''3600''''' - Defines the timeout interval, after which the connection is closed;
−
- Organizational Unit Name (OU): RUT1 // Fill your specific Unit Name
+
# '''''Enable Dead peer detection''''';
−
- `Generate` Certificate
+
# DPD action – '''''Restart''''';
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_add_ipsec_config_connection_advanced.png|border|class=tlt-border|center]]
 +
====Proposal configuration====
 +
'''Important:''' Both the RUT1 and RUT2 Encryptions must match in order for this configuration to work.
 +
----
 +
'''Note:''' ''This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.''
  
−
[Screenshot Here]
+
Make the following changes:
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=330; style="border-bottom: 1px solid white;></th>
 +
        <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase1_settings_v1.png|border|class=tlt-border|671x336px|center]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 4px solid white>
 +
# Encryption - '''''AES256;'''''
 +
# Authentication - '''''SHA512;'''''
 +
# DH group - '''''MODP4096;'''''
 +
# IKE lifetime - '''86400s'''.
 +
        </td>
 +
    </tr>
 +
</table>
  
−
After you hit Generate the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT1.key.pem under *Keys* and a RUT1.req.pem under *Certificate requests*.
+
----
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=330; style="border-bottom: 1px solid white;></th>
 +
        <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase2_settings_v1.png|border|class=tlt-border|644x331px|center]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 4px solid white>
 +
# Encryption - '''''AES256;'''''
 +
# Authentication - '''''SHA512;'''''
 +
# PFS group - '''''MODP4096;'''''
 +
# Lifetime – '''''86400s;'''''
 +
        </td>
 +
    </tr>
 +
</table>
  
  
−
Next we need to sign the RUT1 cert.
+
==Testing the configuration==
−
Under the `Certificate signing` configure as follows:
+
If you have followed all the above steps, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly.
  
−
- Signed Certificate Name: RUT1
+
Using the <code><span class="highlight">'''ipsec status'''</span></code> or we can use <code><span class="highlight">'''ipsec statusall'''</span></code> command for a more verbose output. With these commands we can see that the IPsec tunnel is successfully established on RUTxxx router. The command output on a '''RUT1''' device:
−
 
+
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_ipsec_status.png|border|class=tlt-border|center]]
−
===Generating Rut2 Client Cert===
+
----
 +
Also, we can try to ping the RUT2 device by executing this command <code><span class="highlight" >'''ping 192.168.14.1'''</span></code>, by which you should get a response if the IPsec tunnel has been established properly.
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_ipsec_ping_rut1_to_rut2.png|border|class=tlt-border|center]]
 +
----
 +
To check if IPsec tunnel is working properly from '''RUT2''', we can try pinging our '''RUT1''' device by using this command in command line interface on RUT2<code><span class="highlight" >'''ping 192.168.3.1'''</span></code>:
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_ipsec_ping_rut2_to_rut1.png|border|class=tlt-border|center]]
 
----
 
----
 +
Also we can check it by executing the <code><span class="highlight">'''ipsec status'''</span></code> or we can use <code><span class="highlight">'''ipsec statusall'''</span></code> command for a more verbose output. With these commands we can see that the IPsec tunnel is successfully established on RUTxxx router. The command output on a '''RUT2''' device:
 +
[[File:RutOS_IPsec_tunnel_with_certificates_7.8_ipsec_status_rut2.png|border|class=tlt-border|center]]

Latest revision as of 14:26, 6 August 2024

The information in this page is updated in accordance with 00.07.08 firmware version.

Introduction

In computing, Internet Protocol Security (IPsec) is a secure network protocol suite of IPv4 that authenticates and encrypts the packets of data sent over an IPv4 network. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to use during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). Internet Protocol security (IPsec) uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection.

This article provides an extensive configuration example with details on how to create a tunnel connection authenticating with X.509 Certs between two IPsec instances, both of which are configured on RUTxxx routers.

Configuration overview and prerequisites

Before we begin, let's overview the configuration that we are attempting to achieve and the prerequisites that make it possible.

Prerequisites:

  • Two RUTxxx routers of any type;
  • One RUTxxx router with public IP address;
  • Both RUTxxx routers must be accessible from each other's WAN connection;
  • Firmware for the devices must be 00.07.xx.x or above. This is in part to make sure the StrongSwan service is at least version U5.9.6;
  • An end device (PC, Laptop) for configuration;
  • (Optional) A second end device to test remote LAN access;
IPSec RUT1-IPSec RUT2 Example Image.png

The figure above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via their WAN interfaces.

Router configuration

We will start our configuration with RUT1.

To generate certificates via router, you can refer to this link, whereas we will cover: Generating certificate via router

IPsec RUT1 Config

  • Make sure that you have your certificates generated both for RUT1 and RUT2 routers.
  • Login to the router's WebUI and go to System → Services → VPN -> IPsec
  • Add a new instance with your desired name, in my case I will be using RUT1
RutOS IPsec tunnel with certificates 7.8 add ipsec.png

Start by configuring the RUT device. Login to the WebUI, navigate to Services → VPN → IPsec and add a new IPsec instance. Configure everything as follows. Note: Not specified fields can be left as is or changed according to your needs.

Instance configuration

Make the following changes:

  1. Enable instance;
  2. Remote endpoint - RUT2 WAN IP;
  3. Authentication method - X.509;
  4. Key - the RUT1.key.pem that you have generated from certificates;
  5. Local certificate - the RUT1.cert.pem that you have generated from certificates;
  6. CA certificate - the CA.cert.pem that you have generated from certificates;
  7. Local identifier – RUT1 LAN IP, which is 192.168.3.1 in this case;
  8. Remote identifier – RUT2 LAN IP, which is 192.168.14.1 in this case
RutOS IPsec tunnel with certificates 7.8 add ipsec config general instnace.png

We will need to add RUT2 certificate in the Advanced settings:

  1. Click on Advanced settings in the IPsec instance section;
  2. Remote certificate - the RUT2.cert.pem that you have generated from certificates;
RutOS IPsec tunnel with certificates 7.8 add ipsec config general instnace advanced.png

Connection general section configuration

Make the following changes:

  1. Mode - Start;
  2. Type - Tunnel;
  3. Local subnet – 192.168.3.0/24;
  4. Remote subnet – 192.168.14.0/24;
  5. Key exchange - IKEv2;
RutOS IPsec tunnel with certificates 7.8 add ipsec config connection.png

Connection advanced section configuration

Make the following changes:

  1. Open Advanced settings;
  2. Enable Force encapsulation;
  3. Enable Local firewall;
  4. Enable Remote firewall;
  5. Inactivity: 3600 - Defines the timeout interval, after which the connection is closed;
  6. Enable Dead peer detection;
  7. DPD action – Restart;
RutOS IPsec tunnel with certificates 7.8 add ipsec config connection advanced.png

Proposal configuration

Important: Both the RUT1 and RUT2 Encryptions must match in order for this configuration to work.

Note: This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.

Make the following changes:

Networking webui manual IPsec configuration proposal phase1 settings v1.png
  1. Encryption - AES256;
  2. Authentication - SHA512;
  3. DH group - MODP4096;
  4. IKE lifetime - 86400s.
Networking webui manual IPsec configuration proposal phase2 settings v1.png
  1. Encryption - AES256;
  2. Authentication - SHA512;
  3. PFS group - MODP4096;
  4. Lifetime – 86400s;



IPsec RUT2 Config

  • Make sure that you have your certificates generated both for RUT1 and RUT2 routers.
  • Login to the router's WebUI and go to System → Services → VPN -> IPsec
  • Add a new instance with your desired name, in my case I will be using RUT2
RutOS IPsec tunnel with certificates 7.8 add ipsec.png

Start by configuring the RUT device. Login to the WebUI, navigate to Services → VPN → IPsec and add a new IPsec instance. Configure everything as follows. Note: Not specified fields can be left as is or changed according to your needs.

Instance configuration

Make the following changes:

  1. Enable instance;
  2. Authentication method - X.509;
  3. Key - the RUT2.key.pem that you have generated from certificates;
  4. Local certificate - the RUT2.cert.pem that you have generated from certificates;
  5. CA certificate - the CA.cert.pem that you have generated from certificates;
  6. Local identifier – RUT2 LAN IP, which is 192.168.14.1 in this case;
  7. Remote identifier – RUT1 LAN IP, which is 192.168.3.1 in this case
RutOS IPsec tunnel with certificates 7.8 add ipsec config connection rut2.png

We will need to add RUT2 certificate in the Advanced settings:

  1. Click on Advanced settings in the IPsec instance section;
  2. Remote certificate - the RUT1.cert.pem that you have generated from certificates;
RutOS IPsec tunnel with certificates 7.8 add ipsec config connection advanced rut2.png

Connection general section configuration

Make the following changes:

  1. Mode - Start;
  2. Type - Tunnel;
  3. Local subnet – 192.168.14.0/24;
  4. Remote subnet – 192.168.3.0/24;
  5. Key exchange - IKEv2;
RutOS IPsec tunnel with certificates 7.8 add ipsec config connection rut2 general.png

Connection advanced section configuration

Make the following changes:

  1. Open Advanced settings;
  2. Enable Force encapsulation;
  3. Enable Local firewall;
  4. Enable Remote firewall;
  5. Inactivity: 3600 - Defines the timeout interval, after which the connection is closed;
  6. Enable Dead peer detection;
  7. DPD action – Restart;
RutOS IPsec tunnel with certificates 7.8 add ipsec config connection advanced.png

Proposal configuration

Important: Both the RUT1 and RUT2 Encryptions must match in order for this configuration to work.

Note: This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.

Make the following changes:

Networking webui manual IPsec configuration proposal phase1 settings v1.png
  1. Encryption - AES256;
  2. Authentication - SHA512;
  3. DH group - MODP4096;
  4. IKE lifetime - 86400s.
Networking webui manual IPsec configuration proposal phase2 settings v1.png
  1. Encryption - AES256;
  2. Authentication - SHA512;
  3. PFS group - MODP4096;
  4. Lifetime – 86400s;


Testing the configuration

If you have followed all the above steps, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly.

Using the ipsec status or we can use ipsec statusall command for a more verbose output. With these commands we can see that the IPsec tunnel is successfully established on RUTxxx router. The command output on a RUT1 device:

RutOS IPsec tunnel with certificates 7.8 ipsec status.png

Also, we can try to ping the RUT2 device by executing this command ping 192.168.14.1, by which you should get a response if the IPsec tunnel has been established properly.

RutOS IPsec tunnel with certificates 7.8 ipsec ping rut1 to rut2.png

To check if IPsec tunnel is working properly from RUT2, we can try pinging our RUT1 device by using this command in command line interface on RUT2ping 192.168.3.1:

RutOS IPsec tunnel with certificates 7.8 ipsec ping rut2 to rut1.png

Also we can check it by executing the ipsec status or we can use ipsec statusall command for a more verbose output. With these commands we can see that the IPsec tunnel is successfully established on RUTxxx router. The command output on a RUT2 device:

RutOS IPsec tunnel with certificates 7.8 ipsec status rut2.png
Retrieved from "https://wiki.teltonika-networks.com/index.php?title=IPSec_Tunnel_w/CA_Certs_Configuration&oldid=130050"