How to configure Point-to-Multipoint IPsec VPN on firewall?

Service Demands

In a point-to-point scenario, a pre-shared key needs to be specified for each peer. When defining an IPsec policy,  you also need to specify the IP address or domain name of the peer. As the number of peers increases, duplicate configurations also increase, making maintenance difficult. In addition, if a peer does not have a fixed IP address, the IPsec tunnel cannot be established.

To solve the preceding problems, a point-to-multipoint solution is proposed, as shown in Figure. In apoint-to-multi point scenario, the hub site needs to establish tunnels with multiple spoke sites. All the spoke sites use the same pre-shared key as the hub site. The hub site does not initiate connections. Instead, the spoke sites initiate connections to establish IPsec tunnels.

Restrictions and Guidelines

• Currently, if the RG-WALL 1600-Z series firewall acts as a hub site on an IPsec VPN, allspoke sites must use the same pre-shared key to negotiate with the hub site.
  
• The following describes how to configure Spoke A. The configuration for Spoke B issimilar.
  
  

Prerequisites

You have completed basic network configurations for Site A and Site B, including interface IP addresses and default routes. Pay attention to the following points during configuration:

Ensure that the IP address of the hub site is fixed.

All spoke sites obtain the pre-shared key configured on the hub site in out-of-band (OOB) mode.

Using a Configuration Wizard

• Configuring the Hub Site
  
  

(1) Perform basic configuration

(a) Choose Network> IPsec VPN > Config Wizard. The basic configuration page of the configuration wizard is displayed.

(b) Set Scenario to Point-to-Multipoint, and set the other parameters according to the following figure.

(c) After completing the configuration, click Next.

(2) Configure authentication.

(a) Configure parameters according to the following figure.

(b) After completing the configuration, click Next.

(3) Configure interesting traffic.

(a) Click Create. Configure parameters for interesting traffic according to the following figure.

(b) After completing the configuration, click Next.

(4) Verify configuration.

(a) After verifying the configuration, click Finish.

• Configuring Spoke A
  
  

(1) Perform basic configuration.

(a) Choose Network> IPsec VPN > Config Wizard. The basic configuration page of the configuration wizard is displayed.

(b) Set Scenario to Point-to-Point, and set the other parameters according to the following figure.

(c) After completing the configuration, click Next.

(2) Configure authentication.

(a) Configure parameters according to the following figure.

(b) After completing the configuration, click Next.

(3) Configure interesting traffic.

(a) Click Create. Configure parameters for interesting traffic according to the following figure.

(b) After completing the configuration, click Next.

(4) Verify configuration.

(a) After verifying the configuration, click Finish.

I configured the VPN but it doesn't work: in front of the gateway server I have a firewall which ports do I have to open to make the link work?

User 71614 replied at 2024-12-18 15:50
I configured the VPN but it doesn't work: in front of the gateway server I have a firewall which por ...

Hello,

IPSEC is using udp port 500 and 4500
If you need more information, pls refer to this post : https://community.ruijienetworks.com/forum.php?mod=viewthread&tid=2510&extra=page%3D1

Best regards,
Micca