Setting up site-to-site on Barracuda

Note: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

Configuring the tunnel at the Barracuda Management Interface

Open the Barracuda Management Interface
In the top menu, select Configuration > Virtual Servers > Your virtual server > Assigned Services > VPN (VPN-Service) > Site to Site

Barracuda Firewall admin console showing VPN service configuration tree with site-to-site option highlighted

Select IPsec IKEv2 Tunnels and create a new tunnel, then fill in the following information:

Barracuda IKEv2 tunnel configuration showing NordLayer with pre-shared key authentication and encryption settings

Phase 1:

Encryption: AES256
Hash: SHA256
Diffie-Hellman Group: 14
Proposal Handling: Strict
Lifetime: 28800

Phase 2:

Encryption: AES256
Hash: SHA256
DH-Group: 14
Proposal Handling: Strict
Lifetime: 3600
Traffic Volume (KB): Unlimited

Next, you will need to configure the Network Settings, go to the Configuration > Site to Site VPN (vpn) and edit or add a new one:

Barracuda site-to-site VPN page showing NordLayer tunnel with context menu and network configuration

Endpoint Type: IPv4
One VPN Tunnel per Subnet Pair: Unchecked
Universal Traffic Selectors: Unchecked
Force UDP Encapsulation: Unchecked
IKE Reauthentication: Checked
Next Hop Routing: 0.0.0.0
Interface Index: 0

Barracuda IPsec IKEv2 tunnel settings showing IPv4 endpoint with reauthentication enabled

Network Local:

Local Gateway: Barracuda FW Public IP
Local ID: Barracuda FW Public IP
Network address: Internal-Network Subnets

Barracuda network local settings showing gateway configuration with CIDR network address field

Network Remote:

Remote Gateway: the IP of your NordLayer server with a dedicated IP
Remote ID: the IP of your NordLayer server with a dedicated IP
Network address: 10.6.0.0

Barracuda network remote settings showing gateway configuration with remote network address field

Dead Peer Detection:

Action: Restart
Delay (seconds): 30

Barracuda dead peer detection settings showing restart action with 30 second delay configuration

Click OK

Don't forget to click on Send Changes, Activation Pending and Activate:

Barracuda VPN activation pending with send changes button and activate confirmation dialog

Configuring firewall and static routing

Be sure to allow-list NordLayer private gateway public IP on your firewall rules to allow for incoming traffic, under Firewall > Forwarding Rules:

Barracuda firewall rule editor showing NordLayer VPN traffic pass rule with bidirectional network settings

It should appear under the firewalls rules as seen below:

Barracuda firewall rules page showing NordLayer VPN rule highlighted in forwarding configuration table

It is also necessary to add static routes from the NordLayer subnet (10.6.0.0/20) to the local network and from the local network to the NordLayer subnet (10.6.0.0/20) to the local network through the VPN tunnel gateway.

Go to Configuration-> Client Networks
Add a new network and set the following:

Network Address: 172.XXX.0.0/16 (or relevant subnet)
Gateway: local Barracuda IP
Name: NordLayer (or any other name you chose for the tunnel).

Select OK

Barracuda client network dialog showing NordLayer static route with IPv4 network and gateway configuration

Make sure the tunnel is up

At the Barracuda Management Interface, go to VPN -> Site-to-Site. If the tunnel is up the line will appear in the table:

Barracuda VPN site-to-site dashboard showing NordLayer IPsec IKEv2 tunnel with connection status and encryption details

Ending note:

In order to finalize the site-to-site tunnel, please create a setup in Sites tab of the NordLayer Control Panel.

Pre-shared key - you can generate it or we can provide it
Encryption details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
Remote subnet and mask (the subnet is used in your local network)

Note: In case you have any questions or issues, press 'Chat with support' at the bottom of the page.