This is the documentation for the 21.07 version. Looking for the documentation of the latest version? Have a look here.

Required InformationΒΆ

Before attempting to configure an IPsec tunnel, several pieces of information are required in order for both sides to build a tunnel. Typically the administrators of both tunnel endpoints will negotiate and agree upon the values to use for an IPsec tunnel.

At a minimum, these pieces of information should be known to both endpoints before attempting to configure a tunnel:

Local Address

The IP address on TNSR which will be used to send and accept IPsec traffic from the peer.

Local IKE Identity

The IKE identifier for TNSR, typically an IP address and the same as Local Address.

Local Network(s)

A list of local networks which will communicate through the IPsec tunnel to hosts on Remote Network(s). This is not entered into the configuration on TNSR for routed IPsec, but will be needed by the peer.

Remote Address

The IP address of the IPsec peer.

Remote IKE Identity

The identifier for the IPsec peer, typically the same as Remote Address.

Remote Network(s)

A list of networks at the peer location with which hosts in the Local Network(s) will communicate. If using static routing, routes must be manually added for these networks using the Remote IPsec Address and ipipX interface. If BGP is used with IPsec, this will be handled automatically.

IKE Version

Either 1 for IKEv1 or 2 for IKEv2. IKEv2 is stronger and more capable, but not all IPsec equipment can properly handle IKEv2.

IKE Lifetime

The maximum amount of time that an IKE session can stay alive until it is renegotiated.

IKE Encryption

The encryption algorithm used to encrypt IKE messages.

IKE Integrity

The integrity algorithm used to authenticate IKE messages


Diffie-Hellman group for key establishment, given in bits.

IKE Authentication

The type of authentication used to verify the identity of the peer.

Pre-Shared Key

When using Pre-Shared Key for IKE Authentication, this key is used on both sides to authenticate the peer.

SA Lifetime

The amount of time that a child security association can be active before it is rekeyed.

SA Encryption

The encryption algorithm used to encrypt tunneled traffic.

SA Integrity

The integrity algorithm used to authenticate tunneled traffic.


Diffie-Hellman group for security associations, in bits.

Local IPsec Address

The local IP address for the ipipX interface, used for routing traffic to/from IPsec peers.

Remote IPsec Address

The remote IP address for the peer on ipipX, used as a gateway for routing, or a BGP neighbor.


If NAT is active on the same interface acting as an IPsec endpoint, then NAT forwarding must also be enabled. See NAT Forwarding.