Configuring NG Firewall for IPsec Tunnels

Overview

NG Firewall supports IPsec with IKEv1 and IKEv2. Before configuring IPsec tunnels there are a few steps to ensure a successful connection.

These steps include:

Configure a fully qualified Internet hostname
Configure a root certificate that matches your Internet hostname
Configure a server certificate that matches your Internet hostname
Configure the IPsec server
Configure user accounts for client access

Configure a fully qualified Internet hostname

A fully qualified Internet hostname is a hostname that Internet devices resolve through DNS to reach the IP Address of your NG Firewall host. Before completing this step, ensure the DNS for your domain name is properly configured to resolve your Internet hostname.

To configure the Internet hostname in NG Firewall:

In the NG Firewall web administration, go to Config > Network > Hostname.
In the Hostname field, enter the local part of your Internet hostname.
In the Domain Name field, enter the domain part of your Internet hostname.
Select Use Hostname and confirm that the value matches your Internet hostname.
Save your changes.

Configure the root certificate to match your Internet hostname

The root certificate validates self-signed server certificates. The name on the root certificate must match the Internet hostname of your NG Firewall host.

To Configure a new root certificate:

Go to Config > Administration > Certificates.
Click Generate Certificate Authority.
Enter the required information.
Save your changes.

Configure the server certificate to match your Internet hostname

The server certificate is used by IPsec for authentication and authenticity of your NG Firewall host. The name on the server certificate must match your Internet hostname.

Go to Config > Administration > Certificates.
Click Generate Server Certificate.
Enter the required information.
Select your new certificate for HTTPS, SMTPS, and IPSEC.
Save your changes

Configure the IPsec server

After you configure the Internet hostname and certificates, you can install and enable the IPsec VPN server. For more details refer to IPsec VPN in the Edge Threat Management Wiki.

IMPORTANT: To use IKEv2 IPsec you must enable IKEv2 in the VPN Config tab of the IPsec app.

Configure User Accounts for Client Access

To set up client devices to connect via IPsec you need user accounts for authentication. You can set up users in the Local Directory or via the Directory Connector app.

For more information regarding the set up of IPsec tunnels on client devices refer to the links below:

Comments