Required Information

Before attempting to configure an IPsec tunnel, several pieces of information are required in order for both sides to build a tunnel. Typically the administrators of both tunnel endpoints will negotiate and agree upon the values to use for an IPsec tunnel.

At a minimum, these pieces of information should be known to both endpoints before attempting to configure a tunnel:

Local Address

The IP address on TNSR which will be used to send and accept IPsec traffic from the peer.

Local IKE Identity

The IKE identifier for TNSR, typically an IP address and the same as Local Address.

Local Network(s)

A list of local networks which will communicate through the IPsec tunnel to hosts on Remote Network(s). This is not entered into the configuration on TNSR for routed IPsec, but will be needed by the peer.

Remote Address

The IP address of the IPsec peer.

Remote IKE Identity

The identifier for the IPsec peer, typically the same as Remote Address.

Remote Network(s)

A list of networks at the peer location with which hosts in the Local Network(s) will communicate. If using static routing, routes must be manually added for these networks using the Remote IPsec Address and ipsec0 interface. If BGP is used with IPsec, this will be handled automatically.

IKE Version

Either 1 for IKEv1 or 2 for IKEv2. IKEv2 is stronger and more capable, but not all IPsec equipment can properly handle IKEv2.

IKE Lifetime

The maximum amount of time that an IKE session can stay alive until it is renegotiated.

IKE Encryption

The encryption algorithm used to encrypt IKE messages.

IKE Integrity

The integrity algorithm used to authenticate IKE messages

IKE DH/MODP Group

Diffie-Hellman group for key establishment, given in bits.

IKE Authentication

The type of authentication to use to verify the peer’s identity.

Pre-Shared Key

When using Pre-Shared Key for IKE Authentication, this key is used on both sides to authenticate the peer.

SA Lifetime

The amount of time that a child security association can be active before it is rekeyed.

SA Encryption

The encryption algorithm used to encrypt tunneled traffic.

SA Integrity

The integrity algorithm used to authenticate tunneled traffic.

SA DH/MODP Group

Diffie-Hellman group for security associations, in bits.

Local IPsec Address

The local IP address for the ipsec0 interface, used for routing traffic to/from IPsec peers.

Remote IPsec Address

The remote IP address for the peer on ipsec0, used as a gateway for routing, or a BGP neighbor.

Example IPsec Configuration

Item

Value

Local Address

203.0.113.2

Local IKE Identity

203.0.113.2

Local Network(s)

10.2.0.0/16

Remote Address

203.0.113.25

Remote IKE Identity

203.0.113.25

Remote Network(s)

10.25.0.0/16

IKE Version

1

IKE Lifetime

28800

IKE Encryption

AES-128

IKE Integrity

SHA1

IKE DH/MODP Group

2048 (14)

IKE Authentication

Pre-Shared Key

Pre-Shared Key

mysupersecretkey

SA Lifetime

3600

SA Encryption

AES-128

SA Integrity

SHA1

SA DH/MODP Group

2048 (14)

Local IPsec Address

172.32.0.1/30

Remote IPsec Address

172.32.0.2

Warning

If NAT is active on the same interface acting as an IPsec endpoint, then NAT forwarding must also be enabled. See NAT Forwarding.