How to Connect the Barracuda CloudGen Firewall to Teridion via IPSec
Teridion Connect provides numerous PoPs (Points of Presence) across the globe, including China, to allow access to their network backbone. The Barracuda CloudGen Firewall can connect to the TCR (Teridion Cloud Router) deployed in one of the PoPs by using IPSec or GRE tunneling to leverage their backbone to improve the connectivity. In addition, BGP can be used as a dynamic routing protocol to learn and propagate networks. For more information, visit the Teridion website.
Connect a Barracuda CloudGen Firewall to the Teridion Network via IPSec
Before You Begin
Deploy and set up your Teridion infrastructure. For assistance on the Teridion setup, please contact Teridion.
Step 1. Collect Site Information
Log into your Teridion portal and collect the following information:
From the Site Configuration, collect the information on the PoE IP from the site you need to connect to.
Tunnel Type
High Availability (optional)
Gateways IPs
Transfer Network
Static Routing
Dynamic Routing with BGP (optional)
IPSec IKEv2 Settings
In this example, we have collected the following settings:
PoE (IP Teridion Router): 52.252.228.31
SiteID (Firewall Internal IP): 10.2.0.4
Gateway #1 IP (Firewall Public IP): 23.99.253.105
Transfer Network TCR IP: 169.254.0.1/30
Transfer Network Gateway IP: 169.254.0.2/30
IKEv2 Authentication Settings
Phase 1 | Phase 2 | ||
|---|---|---|---|
Encryption | AES128 | Encryption | AES256 |
Hash | MD5 | Hash | MD5 |
DH-Group | Group 5 | DH-Group | Group5 |
Proposal Handling | Strict | Proposal Handling | Strict |
Lifetime [s] | 28800 | Lifetime | 3600 |
BGP (Optional)
Teridion ASN: 64500
Site ASN: 64512
Step 2. Configure IPSec IKEv2 Static Routing
On the Barracuda CloudGen Firewall, do the following:
Go to Configuration > Configuration Tree > Box > Assigned Services > VPN Service > Site to Site.
Click on the IPSec IKEv2 tunnel tab.
Click Lock.
Right-click the table and select New IKEv2 tunnel. The IKEv2 Tunnel window opens.
In the IKEv2 Tunnel Name field, enter your tunnel name.
Set Initiates Tunnel to Yes.
Step 3. Configure Authentication and Encryption
Step 3.1 Configure the Phase 1 encryption settings matching your Teridion setup
Encryption – Select AES.
Hash Meth. – Select MD5.
DH Group – Select Group 5.
Proposal Handling – Select Strict.
Lifetime – Enter
28800.
Step 3.2 Configure the Phase 2 encryption settings
Encryption – Select AES-256.
Hash Meth. – Select MD5.
DH Group – Select Group 5.
Proposal Handling – Select Strict.
Lifetime (seconds) – Enter
3600.LIfetime (KB) – Enter
0.
Step 4. Configure Network Settings
In the Network Settings, set the following values:
Universal Traffic selector – Select the check box
IKE Reauthentication - Select the check box
Local Gateway – Enter your internal IP, e.g.,
10.2.0.4Remote Gateway – Enter your PoE IP for TCR, e.g.,
52.252.228.31Remote ID – Enter your PoE IP for TCR, e.g.,
52.252.228.31Add your Local Network.
Add your Remote Networks that are reachable via Teridion.
Set up DPD to match your Teridion configuration.