How to Configure BGP Routing over an IKEv1 IPsec VPN Tunnel

Follow the instructions in this article to configure the BGP service with an intermediary /30 network between a local and remote VPN gateway. The BGP service uses the IPsec tunnel to dynamically learn the routes of the remote network. You must configure both the local and remote Barracuda CloudGen Firewalls.

Open

Before you configure BGP over an IPsec VPN, obtain the following:

• A free /30 subnet. E.g., 192.168.22.0/30

• Autonomous system numbers (ASNs) for the remote and local networks. The ASNs can be private or public because the VPN is not directly connected to the Internet.

Add a VPN next hop interface using a /30 subnet.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > VPN Settings.

2. Click Lock.

3. In the left menu, select Routed VPN.

4. Next to the Next Hop Interface Configuration table, click Add.

5. Configure the VPN next hop interface settings:

   • In the VPN Interface Index field, enter a number between 0 and 999. E.g., 13

   • In the IP Addresses field, enter the VPN interface IP address. E.g., 192.168.22.1/30 for the local firewall or 192.168.22.2/30 for the remote firewall.

   • Click OK. The VPN next hop interface is listed in the VPN Next Hop Interface Configuration table.

6. Click Send Changes and Activate.

Introduce the IP address of the VPN next hop interface on the firewall.

1. Go to CONFIGURATION > Configuration Tree > Box > Network.

2. In the left menu, select IP Configuration.

3. Click Lock.

4. In the Shared Networks and IPs section, click +. The Shared Network and IPs window opens.

   1. Select the virtual Interface.

   2. In the Network Address field, enter the network the virtual interface resides in.

   3. In the Shared IPs in this Network table, click + and add the intermediary VPN IP address of the VPN interface. E.g., 192.168.22.1 for the local firewall or 192.168.22.2 for the remote firewall. 

   4. Click OK.

5. Click Send Changes and Activate.

Configure a site-to-site VPN IPsec tunnel including the VPN next hop interface.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > Site to Site.

2. Click Lock.

3. Click the IPsec IKEv1 Tunnels tab.

4. Right-click the table under the IPsec IKEv1 Tunnels tab and then select New IPsec IKEv1 tunnel.

5. In the IPsec IKEv1 Tunnel window:

   1. In the Local Networks tab, enter:

      • Local IKE Gateway – Enter the local public IP address the VPN service is listening on.

      • Network Address – Add the intermediary VPN subnet. E.g., 192.168.22.0/30

   2. In the Remote Networks tab, enter:

      • Remote IKE Gateway – Enter the remote public IP address the remote VPN service is listening on.

      • Network Address – Add the intermediary VPN subnet. E.g., 192.168.22.0/30

   3. Click the Peer Identification tab and then enter a passphrase the Shared Secret.

      The password can consist of small and capital characters, numbers, and non-alpha-numeric symbols, except the hash sign (#).

   4. Click the Advanced tab and enter:

      • VPN Next Hop Routing – Enter the IP address of the remote (opposite) VPN next hop interface. E.g., 192.168.22.2 for the local firewall or 192.168.22.1 for the remote firewall.
        

      • Interface Index – Enter the interface number of the VPN next hop interface configured in Step 1. E.g. 13

   5. Click OK.

6. Click Send Changes and Activate.