Site-to-site VPNs: IPsec Fundamentals

Site-to-site VPNs allow two networks in different locations to communicate as if they were directly connected, using the public internet for encryption. This setup is commonly used for office-to-office, home-to-cloud VPC, or lab-to-lab connections.

flowchart LR
  A[Site A LAN] --> FA[Firewall A]
  FA -- IPsec tunnel over the internet --> FB[Firewall B]
  FB --> B[Site B LAN]

Overview

The job of a site-to-site VPN is to make two networks behave like they are connected by a private cable over the public internet. Unlike remote-access VPNs where devices need special software to dial in, routers and firewalls handle the tunneling process, ensuring that devices behind them do not require any additional software.

IPsec Vocabulary: The Decoder Ring

To understand site-to-site IPsec, here are some essential terms:

IKE (Internet Key Exchange): A protocol used for negotiating secure connections. IKE operates in two phases:
- Phase 1: Authenticates the two gateways and establishes a secure control channel.
- Phase 2: Negotiates traffic encryption parameters and defines which networks will use the tunnel.
"Phase 1 up, Phase 2 down" is a common state where the gateways trust each other but disagree on the networks to be tunneled. This often leads to issues.
IKEv2 (Internet Key Exchange version 2): The preferred version due to its cleaner rekeying process and better support for mobility. IKEv1 is only used for legacy interoperability.
ESP (Encapsulating Security Payload): The protocol that carries the encrypted packets. It uses IP protocol number 50, but NAT-T wraps it in UDP port 4500 when a NAT device is present. Firewalls need to open ports udp 500 and udp 4500.
Policy-based vs Route-based Tunnels:
- Policy-based: Traffic matching the selectors gets encrypted (older, less flexible).
- Route-based: The tunnel acts as a virtual interface that can be used with routing protocols for more flexibility.

Matching Settings

Both ends of the IPsec connection must match certain settings exactly to avoid failures. Common issues include:

IKE Version: Ensure both ends use the same IKE version.
Encryption/Hash/DH Group Proposals: These must be identical on both sides.
Pre-Shared Key (PSK): Must be the same for authentication.
Phase 2 Selectors: The local and remote subnets should match exactly.

Logs often show "no proposal chosen" when these settings do not match, indicating a configuration issue.

Common Pitfalls

Overlapping Subnets: Both sites using the same subnet (e.g., 192.168.1.0/24) can cause routing conflicts. Renumber one site or use double-NAT to avoid this.
Firewall Policies: Ensure that firewall policies are set up correctly on both ends of the tunnel, even after it is established.

Conclusion

For home lab environments, while IPsec might seem complex, it remains a fundamental technology used by enterprise gear and cloud VPC gateways. Understanding IPsec will help you configure robust site-to-site connections over public networks.