This article shows the configuration required to establish communication between the following sites: Headquarters, Branch1, and Branch2. The goal is to ensure that the following communications are successful:
- Headquarters (192.168.110.0/24) <-> Branch1 (192.168.150.0/24)
- Headquarters (192.168.110.0/24) <-> Branch2 (192.168.170.0/24)
- Branch1 (192.168.150.0/24) <-> Branch2 (192.168.170.0/24)
- Branch1 (192.168.150.0/24) <-> Headquarters (192.168.110.0/24)
- Branch2 (192.168.170.0/24) <-> Headquarters (192.168.110.0/24)
- Branch2 (192.168.170.0/24) <-> Branch1 (192.168.150.0/24)
- Initial configuration prerequisites
- To ensure that the tunnels are operational and stable, it is recommended that all of them have a public IP address on their WAN and are not behind CG-NAT
- In the proposed example, and due to the laboratory environment in which this configuration was performed, the routers do not have a public IP address because they are behind an ISP router. In this case, the ports used by the IPSec protocol were opened/forwarded.
- Headquarters router configuration:
- First, we must access the device's web interface and create a Policy under the IPSec section
- The following parameters are the most important:
- Policy Type: Server
- Key Exchange Version: IKEv2
- Subnets: 192.168.0.0/16 -> This is one of the most important parameters; this mask is used so that Branch1 can reach Branch2 and vice versa through Headquarters.
- Pre-shared Key: A pre-shared key is configured for the tunnel
- Local ID Type: IP
- Peer ID Type: Name -> If all the VPN routers had a public IP address on their WAN, IP would be specified in this field
- Branch1 router configuration:
- First, we must access the device's web interface and create a Policy under the IPSec section
- The following parameters are the most important:
- Policy Type: Client
- Key Exchange Version: IKEv2
- Subnets: 192.168.150.0/24 | 192.168.0.0/16 -> This is one of the most important parameters; this mask is used so that Branch1 can reach Branch2 and vice versa through Headquarters.
- Pre-shared Key: A pre-shared key is configured for the tunnel
- Local ID Type: Name -> If all the VPN routers had a public IP address on their WAN, IP would be specified in this field
- Peer ID Type: IP
- Branch2 router configuration:
- First, we must access the device's web interface and create a Policy under the IPSec section
- The following parameters are the most important:
- Policy Type: Client
- Key Exchange Version: IKEv2
- Subnets: 192.168.170.0/24 | 192.168.0.0/16 -> This is one of the most important parameters; this mask is used so that Branch1 can reach Branch2 and vice versa through Headquarters.
- Pre-shared Key: A pre-shared key is configured for the tunnel
- Local ID Type: Name -> If all the VPN routers had a public IP address on their WAN, IP would be specified in this field
- Peer ID Type: IP
Finally, we check that the tunnels have been established correctly in the IPSec Connection Status section: