# IPSec VPN

## <mark style="color:green;">**Overview**</mark> <a href="#overview" id="overview"></a>

IPsec VPN offers site-to-site connectivity between an HI GIO and remote sites with third-party hardware routers or VPN gateways that support IPSec.

On HI GIO, you can create VPN tunnels between:

* Organization virtual data center networks in the same organization
* Organization virtual data center networks in different organizations
* Between an organization's virtual data center network and an external network

## <mark style="color:green;">**Procedure**</mark> <a href="#procedure" id="procedure"></a>

{% tabs %}
{% tab title="I. Prepare VPN’s parameters" %}
Fulfill [IPSec parameters](https://docs.higiocloud.vn/network/2.-vpn/ipsec-parameters).
{% endtab %}

{% tab title="II. Create IPSec VPN" %}
**Step 1:** In the top navigation bar, click **Networking** and click the **Edge Gateways** tab.

**Step 2:** Click the **edge gateway**.

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FYTsVcTNjS7XYJHYEcfpB%2Fimage.png?alt=media&#x26;token=706a4a49-6341-4d82-8305-4577c2213866" alt=""><figcaption></figcaption></figure>

**Step 3:** Under **Services**, click **IPSec VPN**.

**Step 4:** To configure an IPSec VPN tunnel, click **New**.

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FqLwjlGGvxU41kZz9tK5W%2Fimage.png?alt=media&#x26;token=552c6d4c-5df3-4911-aaac-3f5db5ca6a78" alt=""><figcaption></figcaption></figure>

**Step 5:** Enter a **Name and** a *description* (optional) for the IPSec VPN tunnel.

**Step 6:** To enable the tunnel upon creation, toggle on the **Status** option.

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FSnm9GRTl8APEcBsfQpiO%2Fimage.png?alt=media&#x26;token=f4d7b2b1-f168-4f3f-a356-0b5087b493f5" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
For the Security Profile – we keep it as Default and configure it later once the VPN tunnel has been created.
{% endhint %}

**Step 7:** Click **NEXT** to select Authentication mode.

**Step 8:** Select a peer authentication mode and **NEXT.**

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2Fvr4kiOR1lWnPh3mVojBy%2Fimage.png?alt=media&#x26;token=a8a8d8f9-7f29-42cc-bac5-7ffb7458ea72" alt=""><figcaption></figcaption></figure>

**HI GIO supported 02 option for Authentication Mode:**

| **Option**         | **Description**                                                                                                 |
| ------------------ | --------------------------------------------------------------------------------------------------------------- |
| **Pre-Shared Key** | Choose a pre-shared key to enter. The pre-shared key must be the same on the other end of the IPSec VPN tunnel. |
| **Certificate**    | Select site and CA certificates to be used for authentication.                                                  |

**Step 9:** On *Endpoint Configuration* windows, we put some parameters (follow [IPSec parameters](https://higio-support.atlassian.net/wiki/spaces/v2/pages/40206337) in the prepare step):

*<mark style="color:blue;">**IP address \[Local Endpoint]:**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">Enter public IP (HI GIO’s public IP).</mark>*

*<mark style="color:blue;">**Networks \[Local Endpoint]:**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">Enter at least one local (HI GIO’s network) IP subnet address for the IPSec VPN tunnel.</mark>*

*<mark style="color:blue;">**IP address \[Remote Endpoint]:**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">Enter public IP (remote site, ex: Office’s public IP).</mark>*

*<mark style="color:blue;">**Networks \[Remote Endpoint]:**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">Enter at least one remote IP (ex: Office’s network) subnet address for the IPSec VPN tunnel.</mark>*

**Step 10:** Enter the **remote ID** (optional) for the peer site.

{% hint style="warning" %}
In case we use a Certificate for Authentication mode
{% endhint %}

The remote ID must match the SAN (Subject Alternative Name) of the remote endpoint certificate, if available. If the remote certificate does not contain a SAN, the remote ID must match the distinguished name of the certificate that is used to secure the remote endpoint, for example, C=US, ST=Massachusetts, O=VMware, OU=VCD, CN=Edge1.

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FoNSy231xWdBnHhmZF0Mr%2Fimage.png?alt=media&#x26;token=e67c1bb1-33fb-4642-b520-1ce7c0f714a5" alt=""><figcaption></figcaption></figure>

**Step 11:** Click **Next**.

**Step 12:** Review your settings and click **Finish**.

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FkWPwVp2y7W1fEG13ckhQ%2Fimage.png?alt=media&#x26;token=85261d17-3e45-48bf-8f80-8c820e95d138" alt=""><figcaption></figcaption></figure>

The newly created IPSec VPN tunnel is listed in the **IPSec VPN** view. The IPSec VPN tunnel is created with a default security profile.

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FnSvdA8TF2U6BZB3EwGPW%2Fimage.png?alt=media&#x26;token=ba697221-56fc-4e40-93fc-5f1739fcb4fb" alt=""><figcaption></figcaption></figure>

**Step 13:** To verify that the tunnel is functioning, select it and click **View Statistics**.

If the tunnel is functioning, **Tunnel Status** and **IKE Service Status** both display Up.

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2F4F4Q2Sb4U3tYfUWM0uig%2Fimage.png?alt=media&#x26;token=c4ac164b-0478-4385-b336-4fa0398413b7" alt=""><figcaption></figcaption></figure>

&#x20;
{% endtab %}

{% tab title="III. Configure the Security Profile of the IPSec VPN Tunnel" %}
Once the IPSec VPN tunnel has been created. We can change the IPSec VPN configuration by **security profile,** it must fit with the remote site.

**Step 1:** In the top navigation bar, click **Networking** and click the **Edge Gateways** tab.

**Step 2:** Click the **edge gateway**.

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2Fw5BXBu6PrfVG0Kt2whZy%2Fimage.png?alt=media&#x26;token=ed7cd81b-c3ca-4232-bcc3-b0b12091d3c5" alt=""><figcaption></figcaption></figure>

**Step 3:** Under **Services**, click **IPSec VPN**.

**Step 4:** Select the IPSec VPN tunnel and click **Security Profile Customization**.

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FYykGQO2mdNvs3k0QIFKj%2Fimage.png?alt=media&#x26;token=5328538f-1038-4916-afec-e77524b7d663" alt=""><figcaption></figcaption></figure>

**Step 5:** Change the configures of the VPN tunnel as you prepared ([IPSec parameters](https://higio-support.atlassian.net/wiki/spaces/v2/pages/40206337)).

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FBThtZLs9sFuo4anKL4sT%2Fimage.png?alt=media&#x26;token=9d8167f9-1fc4-44e4-8277-6e480091d7ce" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
Remember that the security settings must match the remote site's security settings.
{% endhint %}
{% endtab %}

{% tab title="IV. Setup firewall rule for VPN tunnel." %}
**Step 1:** Preparing IP set for firewall rule (can use dynamic\static group also). [More detail](https://docs.higiocloud.vn/network/1.-working-with-network/using-edge-gateway-firewall)

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FM1WXbnRr67gY4SPAc9Pv%2Fimage.png?alt=media&#x26;token=e0e5024c-7090-4ba1-b18f-da9d6aaa86e9" alt=""><figcaption></figcaption></figure>

**IP set detail:**

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FmTBgVGr3FIPDyRbB2NxR%2Fimage.png?alt=media&#x26;token=5e7834cf-a45f-4c35-87ef-b2fb7b89837c" alt=""><figcaption><p>IPsec-Higio</p></figcaption></figure>

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FF306256q0M3HeK9teY4W%2Fimage.png?alt=media&#x26;token=0f1b8419-2b2a-4da7-9740-2182dcef009f" alt=""><figcaption><p>IPsec-Local-Subnet</p></figcaption></figure>

**Step 2:** Create 02 the firewall rules (Edge gateway firewall) for the IPsec tunnel:

\+ HI GIO to Local (remote site)

\+ And Local (remote site) to HI GIO

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FVxHSLX87MIkoSDditGFA%2Fimage.png?alt=media&#x26;token=7dd110ac-ba6c-4a6c-a2e0-c44d80628d12" alt=""><figcaption></figcaption></figure>

If we used **Distributed firewall**, we also need to create firewall rules to allow VPN’s traffic (remote site to HI GIO).

\*\*\* Please also set the firewall rules for VPN traffic on the remote routers.

**VALIDATE: Tunnel static is UP with Traffic**

<figure><img src="https://3953927389-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbvay7AR0CH8vZKgD3dSy%2Fuploads%2FRyLGFxdRLm2RWBckIpSM%2Fimage.png?alt=media&#x26;token=6bf2901d-0a72-4e23-a0bf-3aea755dc3f1" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}