ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    EdgeRouter 4: IPSec, S2S vpn

    Scheduled Pinned Locked Moved IT Discussion
    edgerouteredgerouter 4vpnsite-to-site
    40 Posts 6 Posters 2.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gtech @JaredBusch
      last edited by

      @JaredBusch This is very detailed. I am going through it, thanks. Should have mentioned my needs, VPN for a few stuff as needed. I will be setting up few vlans namely default, phones, camera, guest, staff(internet only), IT etc. I know the meraki has a VLAN for VPN clients so wondering if I should have the same on the ER4?

      scottalanmillerS JaredBuschJ 2 Replies Last reply Reply Quote 0
      • scottalanmillerS
        scottalanmiller @gtech
        last edited by

        @gtech said in EdgeRouter 4: IPSec, S2S vpn:

        I know the meraki has a VLAN for VPN clients so wondering if I should have the same on the ER4?

        So the question is... is the VLAN useful to you? Having a VLAN for VPN clients is perfectly fine, it gives you a chance to limit access to the entire VPN connected group of machines no a network level (basically makes three tiers... internet, VPN, and LAN.) Do you have limits that you will set, or will you simple route the VLAN to the LAN defeating its purpose?

        If you are just going to route, then the VLAN serves no purpose. If you are going to treat it like a DMZ and limit the access to only a few services on the LAN, then it can be very useful.

        G 2 Replies Last reply Reply Quote 0
        • JaredBuschJ
          JaredBusch @gtech
          last edited by

          @gtech said in EdgeRouter 4: IPSec, S2S vpn:

          @JaredBusch This is very detailed. I am going through it, thanks. Should have mentioned my needs, VPN for a few stuff as needed. I will be setting up few vlans namely default, phones, camera, guest, staff(internet only), IT etc. I know the meraki has a VLAN for VPN clients so wondering if I should have the same on the ER4?

          That was for site to site connections.

          If you need roaming staff, then you want L2TP.

          set vpn l2tp remote-access authentication local-users username usera password PasswordUserA
          set vpn l2tp remote-access authentication local-users username userb password PasswordUserB
          set vpn l2tp remote-access authentication local-users username userc password 'PasswordU$erC'
          set vpn l2tp remote-access authentication mode local
          set vpn l2tp remote-access authentication require mschap-v2
          set vpn l2tp remote-access client-ip-pool start 10.254.203.2
          set vpn l2tp remote-access client-ip-pool stop 10.254.203.10
          set vpn l2tp remote-access dhcp-interface eth0
          set vpn l2tp remote-access dns-servers server-1 8.8.8.8
          set vpn l2tp remote-access dns-servers server-2 8.8.4.4
          set vpn l2tp remote-access idle 1800
          set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
          set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret SomeLongPSKGoesHere
          set vpn l2tp remote-access ipsec-settings ike-lifetime 3600
          set vpn l2tp remote-access ipsec-settings lifetime 3600
          set vpn l2tp remote-access mtu 1492
          
          G 1 Reply Last reply Reply Quote 1
          • G
            gtech @scottalanmiller
            last edited by

            This post is deleted!
            1 Reply Last reply Reply Quote 0
            • G
              gtech @scottalanmiller
              last edited by

              @scottalanmiller good point

              1 Reply Last reply Reply Quote 0
              • G
                gtech @JaredBusch
                last edited by gtech

                @JaredBusch I saw that, sure the info will come in useful for future projects . This weekend hopefully I can move to the ER4 with no major issues. All I am left to do is move firewall rules across/ port forwards to the ER4 and setup VPN.

                1 Reply Last reply Reply Quote 0
                • FATeknollogeeF
                  FATeknollogee
                  last edited by

                  I appreciate the config @JaredBusch this'll come in handy when I deploy ER's on both sides.

                  For now I'm still searching for a solution: ER (on one side) <--> Meraki MX (on the other side).

                  scottalanmillerS JaredBuschJ 2 Replies Last reply Reply Quote 0
                  • scottalanmillerS
                    scottalanmiller @FATeknollogee
                    last edited by

                    @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                    For now I'm still searching for a solution: ER (on one side) <--> Meraki MX (on the other side).

                    Ugh, that won't be any fun.

                    1 Reply Last reply Reply Quote 0
                    • JaredBuschJ
                      JaredBusch @FATeknollogee
                      last edited by JaredBusch

                      @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                      I appreciate the config @JaredBusch this'll come in handy when I deploy ER's on both sides.

                      For now I'm still searching for a solution: ER (on one side) <--> Meraki MX (on the other side).

                      Change the authentication in ER to PSK.

                      set vpn ipsec site-to-site peer site.domain.com authentication mode pre-shared-secret
                      set vpn ipsec site-to-site peer site.domain.com authentication pre-shared-secret ex3VRe3FAGv769sGwrpLPhqQ
                      set vpn ipsec site-to-site peer site.domain.com connection-type initiate
                      set vpn ipsec site-to-site peer site.domain.com description 'HQ to PSK Site A'
                      set vpn ipsec site-to-site peer site.domain.com ike-group myike
                      set vpn ipsec site-to-site peer site.domain.com ikev2-reauth inherit
                      set vpn ipsec site-to-site peer site.domain.com local-address 123.123.123.123
                      set vpn ipsec site-to-site peer site.domain.com tunnel 1 allow-nat-networks disable
                      set vpn ipsec site-to-site peer site.domain.com tunnel 1 allow-public-networks disable
                      set vpn ipsec site-to-site peer site.domain.com tunnel 1 esp-group myesp
                      set vpn ipsec site-to-site peer site.domain.com tunnel 1 local prefix 10.254.103.0/24
                      set vpn ipsec site-to-site peer site.domain.com tunnel 1 remote prefix 10.254.0.0/24
                      

                      And then change the IKE and ESP sections from the last post to match WTF ever the Meraki uses.

                      FATeknollogeeF 1 Reply Last reply Reply Quote 1
                      • FATeknollogeeF
                        FATeknollogee @JaredBusch
                        last edited by FATeknollogee

                        @JaredBusch :thumbs_up: :thumbs_up_medium_skin_tone: :thumbs_up_medium-dark_skin_tone:
                        I'll give that a try.

                        1 Reply Last reply Reply Quote 0
                        • FATeknollogeeF
                          FATeknollogee
                          last edited by FATeknollogee

                          This post is deleted!
                          1 Reply Last reply Reply Quote 0
                          • FATeknollogeeF
                            FATeknollogee
                            last edited by FATeknollogee

                            That previous error was due to copy/paste issues.

                            Here is the error I'm getting:

                            [ service nat ]
                            NAT configuration error: rule type not specified/valid
                            
                            JaredBuschJ 1 Reply Last reply Reply Quote 0
                            • JaredBuschJ
                              JaredBusch @FATeknollogee
                              last edited by JaredBusch

                              @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                              That previous error was due to copy/paste issues.

                              Here is the error I'm getting:

                              [ service nat ]
                              NAT configuration error: rule type not specified/valid
                              

                              The NAT above was exported from a live router using show configuration command service | grep nat

                              Are you running 2.0? maybe something changed?

                              Edit: Nope
                              7028e6cd-8f03-4e36-aed9-0fe3cfcf981f-image.png

                              ba161b2e-4d41-457c-9630-3cfe41a58251-image.png

                              1 Reply Last reply Reply Quote 0
                              • JaredBuschJ
                                JaredBusch
                                last edited by JaredBusch

                                Never mind. I read the error closer.. I missed a line when I copy/pasted
                                fixed above also.

                                set service nat rule 5000 type masquerade
                                
                                FATeknollogeeF 1 Reply Last reply Reply Quote 1
                                • FATeknollogeeF
                                  FATeknollogee @JaredBusch
                                  last edited by

                                  @JaredBusch said in EdgeRouter 4: IPSec, S2S vpn:

                                  Never mind. I read the error closer.. I missed a line when I copy/pasted
                                  fixed above also.

                                  set service nat rule 5000 type masquerade
                                  

                                  Haha, just added that line like 2 mins ago!!
                                  Thanks for fixing!!

                                  1 Reply Last reply Reply Quote 0
                                  • FATeknollogeeF
                                    FATeknollogee
                                    last edited by

                                    ER4 <--> Meraki MX S2S is "up"
                                    Many thanks to @JaredBusch for all the help.

                                    1 Reply Last reply Reply Quote 2
                                    • FATeknollogeeF
                                      FATeknollogee
                                      last edited by

                                      @JaredBusch
                                      S2S #1: ER4 (ip 1.2.3.4) <--> Meraki MX is up
                                      S2S #2: ER4 (ip 1.2.3.4) <--> Unifi USG not working, just says "connecting" (when I run "show vpn ipsec sa)

                                      Any tricks or tips to make S2S #2 work?

                                      JaredBuschJ 1 Reply Last reply Reply Quote 0
                                      • JaredBuschJ
                                        JaredBusch @FATeknollogee
                                        last edited by

                                        @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                                        @JaredBusch
                                        S2S #1: ER4 (ip 1.2.3.4) <--> Meraki MX is up
                                        S2S #2: ER4 (ip 1.2.3.4) <--> Unifi USG not working, just says "connecting" (when I run "show vpn ipsec sa)

                                        Any tricks or tips to make S2S #2 work?

                                        USG sucks...

                                        FATeknollogeeF 1 Reply Last reply Reply Quote 0
                                        • FATeknollogeeF
                                          FATeknollogee @JaredBusch
                                          last edited by

                                          @JaredBusch Don't talk bad about my USG :grinning_face_with_smiling_eyes:
                                          In a few week I plan on replacing the USG w an ER4.

                                          For now, I was able to get the ER4 <--> USGp4 connection up & running...:thumbs_up:

                                          1 Reply Last reply Reply Quote 0
                                          • FATeknollogeeF
                                            FATeknollogee
                                            last edited by

                                            I have 2 public IPs on the USGp4 (using WAN 1 & 2)
                                            For some reason, the second peer (of my S2S) ER4 refuses to connect to the USGp4 WAN1 IP.
                                            I finally tried WAN2 & it connected.

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 2 / 2
                                            • First post
                                              Last post