Before attempting to configure an IPsec tunnel, several pieces of information are required in order for both sides to build a tunnel. Typically the administrators of both tunnel endpoints will negotiate and agree upon the values to use for an IPsec tunnel.
At a minimum, these pieces of information should be known to both endpoints before attempting to configure a tunnel:
- Local Address
The IP address on TNSR which will be used to send and accept IPsec traffic from the peer.
- Local IKE Identity
The IKE identifier for TNSR, typically an IP address and the same as Local Address.
- Local Network(s)
A list of local networks which will communicate through the IPsec tunnel to hosts on Remote Network(s). This is not entered into the configuration on TNSR for routed IPsec, but will be needed by the peer.
- Remote Address
The IP address of the IPsec peer.
- Remote IKE Identity
The identifier for the IPsec peer, typically the same as Remote Address.
- Remote Network(s)
A list of networks at the peer location with which hosts in the Local Network(s) will communicate. If using static routing, routes must be manually added for these networks using the Remote IPsec Address and
ipsecXinterface. If BGP is used with IPsec, this will be handled automatically.
- IKE Version
1for IKEv1 or
2for IKEv2. IKEv2 is stronger and more capable, but not all IPsec equipment can properly handle IKEv2.
- IKE Lifetime
The maximum amount of time that an IKE session can stay alive until it is renegotiated.
- IKE Encryption
The encryption algorithm used to encrypt IKE messages.
- IKE Integrity
The integrity algorithm used to authenticate IKE messages
- IKE DH/MODP Group
Diffie-Hellman group for key establishment, given in bits.
- IKE Authentication
The type of authentication used to verify the identity of the peer.
- Pre-Shared Key
When using Pre-Shared Key for IKE Authentication, this key is used on both sides to authenticate the peer.
- SA Lifetime
The amount of time that a child security association can be active before it is rekeyed.
- SA Encryption
The encryption algorithm used to encrypt tunneled traffic.
- SA Integrity
The integrity algorithm used to authenticate tunneled traffic.
- SA DH/MODP Group
Diffie-Hellman group for security associations, in bits.
- Local IPsec Address
The local IP address for the
ipsecXinterface, used for routing traffic to/from IPsec peers.
- Remote IPsec Address
The remote IP address for the peer on
ipsecX, used as a gateway for routing, or a BGP neighbor.
If NAT is active on the same interface acting as an IPsec endpoint, then NAT forwarding must also be enabled. See NAT Forwarding.