Configure the gateway at the branch office

Go to Assistants -> Internet-> Internet Connections -> New.

For Connection Type, select Internal ADSL Modem .

Click on Next to configure a new Internet connection.

Enter the required data for the connection.

Under Description enter e. g. PPPoE1 .

For Type, select User-defined via PPP over Ethernet (PPPoE) .

For User Name, enter the name that your provider has given you, e. g. ADSL-Username .

Enter the Password that your provider has given you, e. g. test12345 .

Enable the Always active option.

Press OK to confirm your entries.

Go to VPN -> IPSec -> Phase 1 Profiles -> New

For Description, give the phase 1 profile a unique name, e. g. Branch1_Peer1 .

For Proposals, a combination of encryption and authentication algorithm is selected, e. g. AES / SHA1 . This setting must match that of the head office gateway.

Select the DH Group, (Diffie-Hellmann group) which is to be used in key calculation for creating the IPSec phase 1. This setting must match that of the head office gateway, e. g. DH Group 2 (1024 Bit) .

The Lifetime specifies the validity of the calculated key. The default value of 14400 seconds can be adopted here. This setting must match that of the head office gateway.

In our example, the VPN IPSec tunnels are authenticated using the Preshared Keys Authentication Method. A shared password is issued for this purpose when the IPSec peer is being configured.

Because, in this example, Internet accesses with dynamic addresses and preshared keys are used for the IPSec authentication, the Mode must be set to Aggressive . This setting must match that of the head office gateway.

The Local ID Type specifies the type of the local ID value. In our example, a local ID of type E-mail address is used.

The Local ID Value must be unique and match the peer ID option at the head office gateway. In this example, Branch1_Peer1@bintec-elmeg.com is used for the phase 1 profile of the first IPSec connection.

Press OK to confirm your entries.

Go to VPN -> IPSec -> Phase 1 Profiles -> New

For Description, give the phase 1 profile a unique name, e. g. Branch1_Peer2 .

For Proposals, a combination of encryption and authentication algorithm is selected, e. g. AES / SHA1 . This setting must match that of the head office gateway.

Select the DH Group, (Diffie-Hellmann group) which is to be used in key calculation for creating the IPSec phase 1. This setting must match that of the head office gateway, e. g. DH Group 2 (1024 Bit) .

The Lifetime specifies the validity of the calculated key. The default value of 14400 seconds can be adopted here. This setting must match that of the head office gateway.

In our example, the VPN IPSec tunnels are authenticated using the Preshared Keys Authentication Method. A shared password is issued for this purpose when the IPSec peer is being configured.

Because, in this example, Internet accesses with dynamic addresses and preshared keys are used for the IPSec authentication, the Mode must be set to Aggressive . This setting must match that of the head office gateway.

The Local ID Type specifies the type of the local ID value. In our example, a local ID of type E-mail address is used.

The Local ID Value must be unique and match the peer ID option at the head office gateway. In this example, Branch1_Peer2@bintec-elmeg.com is used for the phase 1 profile of the first IPSec connection.

Press OK to confirm your entries.

Go to VPN -> IPSec -> Phase 1 Profiles.

Go to VPN -> IPSec -> IPSec Peers -> New.

Set the Administrative Status to Up . The peer is available for setting up a tunnel immediately after saving the configuration.

For Description, enter a description of the peer which identifies it, e. g. Headoffice_Peer-1 .

For Peer Address, enter the static IP address or the host name used to access the first Internet access of the head office gateway. In our example, this is the static IP address 62.146.53.200 .

The Peer ID must match the local ID value of the head office gateway. In this example, the type E-mail address and the ID value central@bintec-elmeg.com are used.

Select the version of the Internet Key Exchange protocol for IKE (Internet Key Exchange). In this scenario, IKEv1 must be used.

For Preshared Key, enter the password for the encrypted connection (e. g. test12345 .

For IPv4 Address Assignment, select the configuration mode Static .

Select whether the route to this IPSec peer is to be defined as the default route. In this scenario, the Default route option is not set.

The Local IP Address is the IP address that is linked to the tunnel interface, here e. g. 1.0.0.2 . An address from a previously unused network is used here. The VPN IPsec tunnel is monitored with this address.

The IP address / netmask of the destination network is defined as the route entry. If additional destination networks are to be routed over the tunnel, these can be added with the Add button.

Two routing entries are required in our example.

Enter the IP address that is used as the local IP address of the tunnel interface at the head office gateway, e. g. 1.0.0.1 . A routing entry also needs to be created for the head office network, 192.168.0.0/24 in this example.

As the Phase-1 Profile, you must select the IPSec phase 1 profile that was created previously for the first VPN IPSec tunnel, e. g. Branch1_Peer1 .

As the Phase-2 Profile, the default phase 2 profile that was automatically generated, here the *Multi-Proposal , is used.

The XAUTH profile is not used in this scenario.

Number of Admitted Connections can be left at the default value One user .

As the VPN IPSec connections are always created from the branch office gateway to the head office gateway, the Start Mode here must be set to Always up .

Leave the remaining settings unchanged and confirm them with OK.

Go to VPN -> IPSec -> IPSec Peers -> New.

Set the Administrative Status to Up . The peer is available for setting up a tunnel immediately after saving the configuration.

For Description, enter a description of the peer which identifies it, e. g. Headoffice_Peer-2 .

For Peer Address, enter the static IP address or the host name used to access the first Internet access of the head office gateway. In our example, this is the static IP address 62.146.53.201 .

The Peer ID must be unique and match the remote terminal's local ID value. In our example, the type E-mail address and the ID value central@bintec-elmeg.com are used.

Select the version of the Internet Key Exchange protocol for IKE (Internet Key Exchange). In this scenario, IKEv1 must be used.

For Preshared Key, enter the password for the encrypted connection (e. g. test12345 .

For IPv4 Address Assignment, select the configuration mode Static .

In this scenario, the Default route option is not set.

The Local IP Address is the IP address that is linked to the tunnel interface, here e. g. 2.0.0.2 . An address from a previously unused network is used here. The VPN IPsec tunnel is monitored with this address.

The target IP address / netmask of the destination network is defined as the route entry. If additional destination networks are to be routed over the tunnel, these can be added with the Add button.

Two routing entries are required in our example.

Enter the IP address that is used as the local IP address of the tunnel interface at the head office gateway, e. g. 2.0.0.1 . For the head office Network, in this example 192.168.1.0/24 , another routing entry is also required.

As the Phase-1 Profile, you must select the IPSec phase 1 profile that was created previously for the first VPN IPSec tunnel, e. g. Branch1_Peer2 .

As the Phase-2 Profile, the default phase 2 profile that was automatically generated, here the *Multi-Proposal , is used.

The XAUTH profile is not used in this scenario.

Number of Admitted Connections can be left at the default value One user .

As the VPN IPSec connections are always created from the branch office gateway to the head office gateway, the Start Mode here must be set to Always up .

Leave the remaining settings unchanged and confirm them with OK.

Go to Local Services->Surveillance->Hosts->New.

The host surveillance can be linked to groups using the group ID. In this scenario, each instance of host surveillance must use a unique group ID.

For Monitored IP Address, enter the IP address of the host that is to be monitored. For the monitoring of the first VPN IPSec tunnel, in our example the monitoring of the branch office gateway is done with the address 1.0.0.1 .

By setting the Source IP Address for host surveillance, you ensure that the ping packet with the local IP address of the VPN tunnel interface has been sent so that the branch office gateway can, in turn, reply via this same route. Select Specific and enter the local IP address of the first VPN IPSec interface, e. g. 1.0.0.2 .

For Interval, enter the time interval (in seconds) which is to be used for checking that the host is available, here e. g. 3 seconds.

For Successful Trials, enter the number of pings that must remain unanswered for the host to be regarded as unavailable. Here, e. g., after 3 failed attempts.

For Unsuccessful Trials, enter the number of pings that must be answered for the host to be regarded as available once more. In our example, a host is regarded as available again after 3 successful ping requests/replies. This function is aimed at preventing frequent jitters in the connections.

Under Actions to be performed, select the Monitor option, because the status of interfaces is not to be changed.

Confirm with OK.

Go to Network -> Load Balancing -> Load Balancing Groups -> New.

Under Group Description, enter a name for the load balancing group, e. g. IPSec_headoffice .

For Distribution Policy, select the method that will be used to distribute the data, here Session-Round-Robin (for load distribution based on IP sessions).

For Interface, select the first VPN IPSec interface for connecting the head office, here IPSEC_HEADOFFICE_PEER-1 .

Enter 50 % for Distribution Ratio. This option specifies the ratio in which new IP sessions are distributed to the interfaces in the IP load balancing group.

In this example, the Route selector is left at None , since no interfaces have been assigned more than once in different load balancing groups.

The Tracing IP Address option is used to select an IP address from the configured host monitoring, e. g. 1.0.0.1 . When the host surveillance detects that the connection has been broken, no more IP sessions are set up via this VPN IPSec tunnel.

Click Apply.

Add the second VPN IPSec interface with Add.

For Interface, select IPSEC_HEADOFFICE_PEER-2 .

Enter 50 % for Distribution Ratio.

Select the Tracing IP Address, e. g. 2.0.0.1 .

Click Apply.