Site-to-Site VPN with Static Routing (2024)

Configure a Layer 3 interface.

This interface is used for the IKE phase-1 tunnel.

Select

Network

Interfaces

Ethernet

andthen select the interface you want to configure for VPN.

Select

Layer3

from the

InterfaceType

.

On the

Config

tab, select the

SecurityZone

to which the interface belongs:

The interface must be accessible from a zone outsideof your trust network. Consider creating a dedicated VPN zone forvisibility and control over your VPN traffic.

If you haven’t yet created the zone, select

New Zone

from the

Security Zone

, define a

Name

for the new zone, and then click

OK

.

Select the

Virtual Router

touse.

To assign an IP address to the interface, select the

IPv4

tab,click

Add

in the IP section, and enter theIP address and network mask to assign to the interface, for example 192.168.210.26/24.

To save the interface configuration, click

OK

.

In this example, the configuration for VPN Peer A is:

Interface

—ethernet1/7

Security Zone

—untrust

Virtual Router

—default

IPv4

—192.168.210.26/24

Theconfiguration for VPN Peer B is:

Interface

—ethernet1/11

See Also

Connection Over Site-to-Site VPNConnection Over Site-to-Site VPN

Security Zone

—untrust

Virtual Router

—default

IPv4

—192.168.210.120/24

Create a tunnel interface and attach it to a virtualrouter and security zone.

Select

Network

Interfaces

Tunnel

andclick

Add

.

In the

Interface Name

field,specify a numeric suffix, such as

.1

.

On the

Config

tab, expand the

SecurityZone

to define the zone as follows:

To use your trust zone as the termination pointfor the tunnel, select the zone.

(

Recommended

) To create a separate zone for VPN tunnel termination, click

New Zone

. In the Zone dialog, define a

Name

for a new zone (for example vpn-tun), and then click

OK

.

Select the

Virtual Router

.

(

Optional

) Assign an IP address to the tunnelinterface, select the

IPv4

or

IPv6

tab,click

Add

in the IP section, and enter theIP address and network mask to assign to the interface.

With static routes, the tunnel interface doesn’t require an IP address. For traffic that is destined to a specified subnet/IP address, the tunnel interface will automatically become the next hop. Consider adding an IP address if you want to enable tunnel monitoring.

To save the interface configuration, click

OK

.

In this example, the configuration for VPN Peer A is:

Interface

—tunnel.10

Security Zone

—vpn_tun

Virtual Router

—default

IPv4

—172.19.9.2/24

Theconfiguration for VPN Peer B is:

Interface

—tunnel.11

Security Zone

—vpn_tun

Virtual Router

—default

IPv4

—192.168.69.2/24

Configure a static route, on the virtual router, to thedestination subnet.

Select

Network

Virtual Router

and click therouter you defined in the prior step.

Select

Static Route

, click

Add

,and enter a new route to access the subnet that is at the otherend of the tunnel.

In this example, the configuration for VPN Peer A is:

Destination

—192.168.69.0/24

Interface

—tunnel.10

Theconfiguration for VPN Peer B is:

Destination

—172.19.9.0/24

Interface

—tunnel.11

Set up the crypto profiles (IKE Crypto profile for phase 1 and IPSec Crypto profile for phase 2).

Complete this task on both peers and make sure to set identical values.

Select

Network

Network Profiles

IKE Crypto

. In this example, we use the default profile.

Select

Network

Network Profiles

IPSec Crypto

. In this example, we use the default profile.

Set up the IKE Gateway.

Select

Network

Network Profiles

IKE Gateway

.

Click

Add

and configure theoptions in the

General

tab.

In this example, the configuration for VPN Peer A is:

Interface

—ethernet1/7

Local IP address

—192.168.210.26/24

Peer IP type/address

—static/192.168.210.120

Preshared keys

—enter a value

Local identification

—None; this meansthat the local IP address will be used as the local identificationvalue.

The configuration for VPN Peer B is:

Interface

—ethernet1/11

Local IP address

—192.168.210.120/24

Peer IP type/address

—static/192.168.210.26

Preshared keys

—enter same value ason Peer A

Local identification

—None

Select

Advanced Phase 1 Options

andselect the IKE Crypto profile you created earlier to use for IKEphase 1.

Set up the IPSec Tunnel.

Select

Network

IPSec Tunnels

.

Click

Add

and configure theoptions in the

General

tab.

In this example, the configuration for VPN Peer A is:

Tunnel Interface

—tunnel.10

Type

—Auto Key

IKE Gateway

—Select the IKE Gatewaydefined above.

IPSec Crypto Profile

—Select the IPSec Crypto profile defined in step 4.

Theconfiguration for VPN Peer B is:

TunnelInterface

—tunnel.11

Type

—Auto Key

IKE Gateway

—Select the IKE Gatewaydefined above.

IPSec Crypto Profile

—Select the IPSec crypto defined in step 4.

(

Optional

) Select

Show AdvancedOptions

, select

Tunnel Monitor

,and specify a Destination IP address to ping for verifying connectivity.Typically, the tunnel interface IP address for the VPN Peer is used.

(

Optional

) To define the action on failureto establish connectivity, see Definea Tunnel Monitoring Profile.

Create policy rules to allow traffic between the sites (subnets).

Select

Policies

Security

.

Create rules to allow traffic between the untrust and the vpn-tun zone and the vpn-tun and the untrust zone for traffic originating from specified source and destination IP addresses.

Commit any pending configuration changes.

Click

Commit

.

Troubleshoot Your IPSec VPN Tunnel Connection.

See also Viewthe Status of the Tunnels.

{{ } else { }}