IPsec VPN FAQs - Revision history

Græmer: /* What IPsec ciphers does NG Firewall support? */

2023-09-14T21:53:41Z

What IPsec ciphers does NG Firewall support?

← Older revision		Revision as of 21:53, 14 September 2023
Line 22:		Line 22:

	Note: In versions prior to 16.2, the default was to bypass all IPsec tunnel traffic (but not L2TP or Xauth). You may still have a bypass rule in place to ''Bypass all IPsec traffic'' which will cause the traffic to not be scanned by other apps.		Note: In versions prior to 16.2, the default was to bypass all IPsec tunnel traffic (but not L2TP or Xauth). You may still have a bypass rule in place to ''Bypass all IPsec traffic'' which will cause the traffic to not be scanned by other apps.

	~~=== What IPsec ciphers does NG Firewall support? ===~~
	~~Please refer to this listing: [https://support.untangle.com/hc/en-us/articles/11732262350615 IPsec cipher support in NG Firewall]~~

Græmer: /* How do I connect IPsec between NG Firewall and my IPsec Device? */

2023-09-14T21:53:30Z

How do I connect IPsec between NG Firewall and my IPsec Device?

@@ Line 22: / Line 22: @@
 Note: In versions prior to 16.2, the default was to bypass all IPsec tunnel traffic (but not L2TP or Xauth). You may still have a bypass rule in place to ''Bypass all IPsec traffic'' which will cause the traffic to not be scanned by other apps.
 === What IPsec ciphers does NG Firewall support? ===
 Please refer to this listing: [https://support.untangle.com/hc/en-us/articles/11732262350615 IPsec cipher support in NG Firewall]

Græmer: /* What devices can I connect to with IPsec VPN? */

2023-09-14T21:51:41Z

What devices can I connect to with IPsec VPN?

← Older revision		Revision as of 21:51, 14 September 2023
Line 4:		Line 4:
	When using '''tunnel''' mode, you can think of the payload packet as being completely encased in another packet. In addition, IPsec can allow or deny packets access to the tunnel depending on policies. When using '''transport''' mode, communication is limited between two hosts. Only one IP header is present, with the rest of the packet being encrypted. Unless you have very specific needs, you'll most likely want to use '''tunnel''' mode.		When using '''tunnel''' mode, you can think of the payload packet as being completely encased in another packet. In addition, IPsec can allow or deny packets access to the tunnel depending on policies. When using '''transport''' mode, communication is limited between two hosts. Only one IP header is present, with the rest of the packet being encrypted. Unless you have very specific needs, you'll most likely want to use '''tunnel''' mode.


	~~=== What devices can I connect to with IPsec VPN? ===~~

	We have confirmed that IPsec VPN can successfully connect to other firewalls, including Meraki, Fortinet, Palo Alto, and pfSense. We have user-submitted settings for other devices below, but please be aware that the ETM Support team can only access your NG Firewall and they are not experts in other products. Therefore, they have extremely limited ability to troubleshoot tunnels between NG Firewall and a 3rd party device. (ETM Support cannot troubleshoot the non-ETM side of the connection.)

	=== How do I configure MacOS IKEv2 VPN ===		=== How do I configure MacOS IKEv2 VPN ===

Græmer at 18:06, 17 January 2023

2023-01-17T18:06:39Z

← Older revision		Revision as of 18:06, 17 January 2023
Line 41:		Line 41:
	*Sonicwall		*Sonicwall
	*Watchguard		*Watchguard
	*and more
			=== What IPsec ciphers does NG Firewall support? ===
			Please refer to this listing: [https://support.untangle.com/hc/en-us/articles/11732262350615 IPsec cipher support in NG Firewall]

Græmer: /* What devices can I connect to with IPsec VPN? */

2022-10-11T17:35:48Z

What devices can I connect to with IPsec VPN?

← Older revision		Revision as of 17:35, 11 October 2022
Line 7:		Line 7:
	=== What devices can I connect to with IPsec VPN? ===		=== What devices can I connect to with IPsec VPN? ===

	We have ~~currently verified~~ that IPsec VPN can successfully connect to other ~~NG Firewalls~~ and pfSense. We have user-submitted settings for other devices below, but please be aware Support ~~cannot debug~~ tunnels between NG Firewall and a 3rd party device. ~~We only support IPsec tunnels between two NG Firewall boxes~~.		We have confirmed that IPsec VPN can successfully connect to other firewalls, including Meraki, Fortinet, Palo Alto, and pfSense. We have user-submitted settings for other devices below, but please be aware that the ETM Support team can only access your NG Firewall and they are not experts in other products. Therefore, they have extremely limited ability to troubleshoot tunnels between NG Firewall and a 3rd party device. (ETM Support cannot troubleshoot the non-ETM side of the connection.)

	=== How do I configure MacOS IKEv2 VPN ===		=== How do I configure MacOS IKEv2 VPN ===

Græmer: /* How do I connect IPsec between NG Firewall and my IPsec Device? */

2022-05-03T18:12:25Z

How do I connect IPsec between NG Firewall and my IPsec Device?

← Older revision		Revision as of 18:12, 3 May 2022
Line 27:		Line 27:
	Note: In versions prior to 16.2, the default was to bypass all IPsec tunnel traffic (but not L2TP or Xauth). You may still have a bypass rule in place to ''Bypass all IPsec traffic'' which will cause the traffic to not be scanned by other apps.		Note: In versions prior to 16.2, the default was to bypass all IPsec tunnel traffic (but not L2TP or Xauth). You may still have a bypass rule in place to ''Bypass all IPsec traffic'' which will cause the traffic to not be scanned by other apps.

	=== How do I connect IPsec between ~~Untangle~~ and my IPsec Device? ===		=== How do I connect IPsec between NG Firewall and my IPsec Device? ===

	IPsec on ~~Untangle~~ should work with any compatible endpoint, but unfortunately ~~Untangle doesn~~'t have the resources to test against all known IPSec devices. ~~Untangle recommends~~ documenting the Phase1/Phase2 settings of the 3rd party IPSec device then matching those settings on ~~Untangle~~, which can be entered under the Manual Configuration available in all tunnel configurations. ~~Untangle support~~ has successfully deployed IPSec connections to various models from the following 3rd party manufacturers:		IPsec on NG Firewall should work with any compatible endpoint, but unfortunately we don't have the resources to test against all known IPSec devices. We recommend documenting the Phase1/Phase2 settings of the 3rd party IPSec device then matching those settings on NG Firewall, which can be entered under the Manual Configuration available in all tunnel configurations. NG Firewall Support has successfully deployed IPSec connections to various models from the following 3rd party manufacturers:

	*Cisco		*Cisco
Line 41:		Line 41:
	*Sonicwall		*Sonicwall
	*Watchguard		*Watchguard
	*and ~~many others....~~		*and more

Græmer: /* Does IPsec traffic go through other Untangle applications? */

2022-05-03T18:11:29Z

Does IPsec traffic go through other Untangle applications?

← Older revision		Revision as of 18:11, 3 May 2022
Line 21:		Line 21:
	It is generally recommended to use IPsec VPN only on NG Firewall servers configured with static IPs. However, technically it can work with DHCP, but you will need to reconfigure the tunnel whenever the IP address actually changes. On some ISPs this is rare and servers will often have the same IP for months. On other ISPs IPs change daily.		It is generally recommended to use IPsec VPN only on NG Firewall servers configured with static IPs. However, technically it can work with DHCP, but you will need to reconfigure the tunnel whenever the IP address actually changes. On some ISPs this is rare and servers will often have the same IP for months. On other ISPs IPs change daily.

	=== Does IPsec traffic go through other ~~Untangle~~ applications? ===		=== Does IPsec traffic go through other NG Firewall applications? ===

	'''Yes and Maybe'''. IPsec tunnel traffic and traffic from L2TP and Xauth clients will pass through all the other apps just like any other LAN traffic. However, if you want IPsec tunnel traffic to bypass scanning by other applications you can add a [[Bypass Rules\|bypass rule]].		'''Yes and Maybe'''. IPsec tunnel traffic and traffic from L2TP and Xauth clients will pass through all the other apps just like any other LAN traffic. However, if you want IPsec tunnel traffic to bypass scanning by other applications you can add a [[Bypass Rules\|bypass rule]].

	Note: In versions prior to 11.2, the default was to bypass all IPsec tunnel traffic (but not L2TP or Xauth). You may still have a bypass rule in place to ''Bypass all IPsec traffic'' which will cause the traffic to not be scanned by other apps.		Note: In versions prior to 16.2, the default was to bypass all IPsec tunnel traffic (but not L2TP or Xauth). You may still have a bypass rule in place to ''Bypass all IPsec traffic'' which will cause the traffic to not be scanned by other apps.

	=== How do I connect IPsec between Untangle and my IPsec Device? ===		=== How do I connect IPsec between Untangle and my IPsec Device? ===

Græmer: /* Can I use IPsec on a server that uses DHCP to get its external address? */

2022-05-03T18:11:06Z

Can I use IPsec on a server that uses DHCP to get its external address?

← Older revision		Revision as of 18:11, 3 May 2022
Line 19:		Line 19:
	=== Can I use IPsec on a server that uses DHCP to get its external address? ===		=== Can I use IPsec on a server that uses DHCP to get its external address? ===

	It is generally recommended to use IPsec VPN only on ~~Untangle~~ servers configured with static IPs. However, technically it can work with DHCP, but you will need to reconfigure the tunnel whenever the IP address actually changes. On some ISPs this is rare and servers will often have the same IP for months. On other ISPs IPs change daily.		It is generally recommended to use IPsec VPN only on NG Firewall servers configured with static IPs. However, technically it can work with DHCP, but you will need to reconfigure the tunnel whenever the IP address actually changes. On some ISPs this is rare and servers will often have the same IP for months. On other ISPs IPs change daily.


	=== Does IPsec traffic go through other Untangle applications? ===		=== Does IPsec traffic go through other Untangle applications? ===

Græmer: /* If I install Untangle behind a NAT device, what do I need to forward to Untangle for IPsec VPN to connect? */

2022-05-03T18:10:56Z

If I install Untangle behind a NAT device, what do I need to forward to Untangle for IPsec VPN to connect?

← Older revision		Revision as of 18:10, 3 May 2022
Line 13:		Line 13:
	See [https://support.untangle.com/hc/en-us/articles/360024715334 Configuring An IKEv2 IPsec Connection From macOS To NG Firewall].		See [https://support.untangle.com/hc/en-us/articles/360024715334 Configuring An IKEv2 IPsec Connection From macOS To NG Firewall].

	=== If I install ~~Untangle~~ behind a NAT device, what do I need to forward to ~~Untangle~~ for IPsec VPN to connect? ===		=== If I install NG Firewall behind a NAT device, what do I need to forward to NG Firewall for IPsec VPN to connect? ===

	You will need to forward ESP, AH, and UDP port 500 from the public IP to the Untangle server. You may also need to enable NAT traversal. It is recommended to give Untangle a public IP if you want to set up IPsec tunnels.

			You will need to forward ESP, AH, and UDP port 500 from the public IP to the NG Firewall server. You may also need to enable NAT traversal. It is recommended to give NG Firewall a public IP if you want to set up IPsec tunnels.

	=== Can I use IPsec on a server that uses DHCP to get its external address? ===		=== Can I use IPsec on a server that uses DHCP to get its external address? ===

Græmer: /* How do I configure MacOS IKEv2 VPN */

2022-05-03T18:10:40Z

How do I configure MacOS IKEv2 VPN

← Older revision		Revision as of 18:10, 3 May 2022
Line 11:		Line 11:
	=== How do I configure MacOS IKEv2 VPN ===		=== How do I configure MacOS IKEv2 VPN ===

	See [https://support.untangle.com/hc/en-us/articles/360024715334 Configuring An IKEv2 IPsec Connection From ~~MacOS~~ To ~~Untangle~~ NG Firewall].		See [https://support.untangle.com/hc/en-us/articles/360024715334 Configuring An IKEv2 IPsec Connection From macOS To NG Firewall].

	=== If I install Untangle behind a NAT device, what do I need to forward to Untangle for IPsec VPN to connect? ===		=== If I install Untangle behind a NAT device, what do I need to forward to Untangle for IPsec VPN to connect? ===