Skip to main content

Connect branches and data centers: Site-to-Site VPN

For your information

This is a guide for configuring a Selectel firewall when creating a Site-to-Site VPN tunnel between a data center and an external site, such as your office or another data center. The guide covers configuration using the IPsec protocol.

You must configure the equipment on the other side of the tunnel yourself according to the manufacturer's documentation. Before configuring, ensure that your equipment supports the IPsec protocol.

  1. Connect to your Selectel firewall.
  2. Configure IKE Phase 1 parameters for each device.
  3. Configure IKE Phase 2 parameters for each device.
  4. Configure allow rules on the firewall for the IPsec protocol to work.
  5. Bring up the tunnel between devices.

1. Connect to the Selectel firewall

  1. Open the following page in your browser:

    https://<ip_address>:5443

    Enter <ip_address> — the IP address of the firewall.

  2. Enter the username and password received in the ticket after ordering a firewall. The main page of the graphical interface with the dashboard will open.

2. Configure IKE Phase 1 parameters

Configure the parameters on the Selectel firewall. You must set identical parameter values on your equipment on the other side of the tunnel.

  1. In the VPN menu, go to the IPsec section.

  2. Open the Tunnels tab.

  3. Click Add P1.

  4. In the Key Exchange Version field, select the key exchange protocol version — IKEv2.

  5. In the Internet Protocol field, select the internet protocol — IPv4.

  6. In the Interface field, select the network interface to be used for the tunnel.

  7. In the Remote Gateway field, enter the IP address of the remote device.

  8. In the Authentication Method field, select the authentication method:

    • Mutual PSK;
    • or Mutual Certificate and fill in the My Certificate and Peer Certificate Authority fields.

  9. In the My Identifier field, select the type and enter the identifier of the device from which you are configuring the tunnel.

  10. In the Peer Identifier field, select the type and enter the identifier of the remote device.

  11. In the Pre-Shared key field, enter the authentication code. This is used when configuring and connecting the remote device.

  12. In the Encryption Algorithm block, configure the encryption algorithm:

    12.1. In the Algorithm field, select AES.

    12.2. In the Key Length field, select 256 bits.

    12.3. In the HASH field, select SHA512.

    12.4. In the DH Group field, select 14.

  13. Click Save → Apply Changes.

3. Configure IKE Phase 2 parameters

Configure the parameters on the Selectel firewall. You must set identical parameter values on your equipment on the other side of the tunnel.

  1. In the VPN menu, go to the IPsec section.

  2. Open the Tunnels tab.

  3. Below the IKE Phase 1 line, click Show Phase 2 Entries.

  4. Click Add P2.

  5. In the Mode field, select the tunnel operation mode — Tunnel IPv4.

  6. In the Local Network field, select the local network type behind the VPN gateway — Network and enter the IP address of the local subnet.

  7. In the Remote Network field, select the remote network type behind the VPN gateway — Network and enter the IP address of the remote subnet.

  8. In the Protocol field, select the data protection protocol — ESP.

  9. In the Encryption Algorithm block, configure the encryption algorithm:

    9.1. Select the AES checkbox and set Key Length to 128 bits.

    9.2. Select the AES256-GCM checkbox and set Key Length to 128 bits.

  10. In the Hash Algorithms field, select the hash algorithm — SHA512.

  11. In the PFS Key Group field, select the additional encryption key protection parameters — 14.

  12. Click Save → Apply Changes.

4. Configure allow rules on the firewall

Create an allow rule for the IPsec protocol on the WAN and IPsec interfaces.

  1. In the Firewall menu, go to the Rules section.
  2. Open the tab with the WAN interface.
  3. Click Add.
  4. In the Action field, select the action for received or sent data packets — Pass.
  5. In the Interface field, select the network interface — IPsec.
  6. In the Source field, select the source subnet for network traffic.
  7. In the Destination field, select the destination address to which network traffic is allowed.
  8. Click Save.
  9. Click Add.
  10. In the Action field, select the action for received or sent data packets — Pass.
  11. In the Interface field, select the network interface — WAN.
  12. In the Source field, select the source of network traffic.
  13. In the Destination field, select the destination address to which network traffic is allowed.
  14. Click Save.
  15. Drag the created rules above the denying ones. Rules are executed in order in the list — from top to bottom.
  16. Click Apply Changes.

5. Bring up the tunnel between devices

  1. In the Status menu, go to the IPsec section.
  2. Open the Overview tab.
  3. Click Connect P1 and P2.