WeOS
5.29.0

# IPsec in Legacy Mode (IKEv1)

## About

This document provides a configuration example for establishing an IPsec tunnel in a Site-to-Site scenario between WeOS 5 and WeOS 4 devices using the IKEv1 version of the IPsec protocol. It is intended for users who need to interoperate with legacy WeOS 4 installations or third-party devices that only support IKEv1.

## Introduction

Internet Key Exchange version 1 (IKEv1) is the original protocol for negotiating IPsec security associations. While IKEv2 is recommended for new deployments due to its improved security and efficiency, IKEv1 is still required for compatibility with older devices and some third-party equipment.

## Site-to-Site Scenario

A typical site-to-site VPN connects two separate networks securely over the Internet. For example, a company may want to connect two offices using a tunnel, where Site A uses a new WeOS 5 device and Site B uses an older WeOS 4 device as their respective gateways. In this example, WeOS 5 acts as the initiator and WeOS 4 as the responder. Each site has its own local subnet, and the tunnel is established between two VLAN interfaces.

### Network Topology

            [Site A: WeOS 5]                      [Site B: WeOS 4]
          192.168.15.1/24 (vlan1000)         192.168.45.1/24 (vlan1000)
          10.0.1.15/24   (vlan100)           10.0.1.45/24   (vlan100)
                    |                                |
                    |--------- IPsec Tunnel----------|
                    |             (IKEv1)            |

Figure 1: Site-to-site tunnel using IPsec IKEv1.

Both gateways have two interfaces configured: first, `vlan1000`, connected to the respective internal subnet, and second, `vlan100`, exposed to the outside network.

The IPsec tunnel (using IKEv1, supported by both versions of WeOS) securely connects the two sites over the Internet or another untrusted network. This allows devices on the `192.168.15.1/24` network at Site A to communicate securely with devices on the `192.168.45.1/24` network at Site B, as if they were on the same local network.

## Configuration

### WeOS 5 Configuration (Initiator)

Enter configuration mode and set up the VLANs and interfaces. Then configure the IPsec tunnel as follows:

    siteA:/conf/#> tunnel ipsec 1
    siteA:/conf/tunnel/ipsec-1/#> initiator
    siteA:/conf/tunnel/ipsec-1/#> version 1
    siteA:/conf/tunnel/ipsec-1/#> peer 10.0.1.45
    siteA:/conf/tunnel/ipsec-1/#> local-address 10.0.1.15
    siteA:/conf/tunnel/ipsec-1/#> remote-subnet 192.168.45.0/24
    siteA:/conf/tunnel/ipsec-1/#> local-subnet 192.168.15.0/24
    siteA:/conf/tunnel/ipsec-1/#> ike auth sha256 cipher aes256 dh modp2048
    siteA:/conf/tunnel/ipsec-1/#> esp auth sha256 cipher aes256 dh modp2048
    siteA:/conf/tunnel/ipsec-1/#> secret westermo
    siteA:/conf/tunnel/ipsec-1/#> leave

Explanation:

- `initiator` specifies that this device will initiate the tunnel.
- `version 1` selects IKEv1.
- `peer` is the IP address of the remote WeOS 4 device.
- `local-address` and `local-subnet` define the local interface and protected network.
- `remote-subnet` is the network behind the peer.
- The `ike` and `esp` lines set the cryptographic parameters. Note that you cannot leave them at the default `Auto` setting because WeOS 4 does not support that; therefore, select the most secure proposal supported.
- `secret` sets the pre-shared key.

### WeOS 4 Configuration (Responder)

On the WeOS 4 device, configure the VLANs, interfaces, and IPsec tunnel. Use the provided Management Guide for additional help. Below are the essential commands for IPsec configuration:

    siteB:/conf/#> tun ip 1
    siteB:/conf/tunnel/ipsec-1/#> peer 10.0.1.15
    siteB:/conf/tunnel/ipsec-1/#> outbound vlan100
    siteB:/conf/tunnel/ipsec-1/#> remote-subnet 192.168.15.0/24
    siteB:/conf/tunnel/ipsec-1/#> local-subnet 192.168.45.0/24
    siteB:/conf/tunnel/ipsec-1/#> secret westermo
    siteB:/conf/tunnel/ipsec-1/#> leave

Explanation:

- `peer` is the WeOS 5 device.
- `outbound vlan100` specifies the outgoing interface for the tunnel.
- `remote-subnet` and `local-subnet` define the protected networks.
- `secret` must match the pre-shared key on WeOS 5.

## Verification

After applying the configuration, you can verify the tunnel status on both devices.

On WeOS 5:

    siteB:/#> sh tun ipsec
    ID  DESCRIPTION      STATUS               TIME (since last rekey)
    1   ipsec1           Up(Installed)        5 min 25 sec

    siteB:/#> sh tun ipsec 1
    Current state for tunnel ipsec1 is UP(Installed).

    Security-Association(SA) details:
    ipsec1: #33834, ESTABLISHED, IKEv1, d3309517c6364582_i* 4e6a8ddc2932d8ce_r
      local  '10.0.1.15' @ 10.0.1.15[500]
      remote '10.0.1.45' @ 10.0.1.45[500]
      AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
      established 327s ago, rekeying in 13097s
      tunnel1: #55, reqid 1, INSTALLED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_2048
        installed 327s ago, rekeying in 3173s, expires in 3633s
        in  ccc4b9b2,      0 bytes,     0 packets
        out ba951356,      0 bytes,     0 packets
        local  192.168.15.0/24
        remote 192.168.45.0/24

    Loaded configuration for the connection:
    ipsec1: IKEv1, reauthentication every 14400s, dpd delay 30s
      local:  10.0.1.15
      remote: 10.0.1.45
      local pre-shared key authentication:
        id: 10.0.1.15
      remote pre-shared key authentication:
        id: 10.0.1.45
      tunnel1: TUNNEL, rekeying every 3600s, dpd action is start
        local:  192.168.15.0/24
        remote: 192.168.45.0/24

The output should indicate that the tunnel is “Up” and “Installed,” confirming successful negotiation and establishment of the IPsec tunnel.

Similarly verify the status on WeOS 4:

    siteA:/#> show tunnel ipsec

## Troubleshooting

- Ensure that the pre-shared key (`secret`) matches on both devices.
- Verify that the local and remote subnets are correctly configured and do not overlap incorrectly.
- Check that the cryptographic parameters (cipher, auth, DH group) are supported and match on both sides.
- If the tunnel does not come up, review the system logs for errors related to IKE negotiation.

## Summary

This guide demonstrates how to configure a site-to-site IPsec tunnel between WeOS 5 and WeOS 4 using IKEv1. While IKEv1 is considered legacy, it is still required for interoperability with older devices. For new deployments, consider using IKEv2 for improved security and reliability.

« Previous Next »