Setting up site-to-site on Barracuda
  • 2 Minutes to read

    Setting up site-to-site on Barracuda


      Article summary

      Note: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

      Configuring the tunnel at the Barracuda Management Interface

      1. Open the Barracuda Management Interface

      2. In the top menu, select Configuration > Virtual Servers > Your virtual server > Assigned Services > VPN (VPN-Service) > Site to Site

      01 Setting up site-to-site on Barracuda.png

      1. Select IPsec IKEv2 Tunnels and create a new tunnel, then fill in the following information:
      Please be aware that the Phase 1 and Phase 2 values may not be accurately reflected in the screenshots supplied below. For maximum security and stability of the VPN connection, it is advised to configure the Phase 1 SA lifetime to 3600 seconds and the Phase 2 SA lifetime to 28800 seconds

      02 Setting up site-to-site on Barracuda.png

      Phase 1:

      • Encryption: AES256
      • Hash: SHA256
      • Diffie-Hellman Group: 14
      • Proposal Handling: Strict
      • Lifetime: 3600

      Phase 2:

      • Encryption: AES256
      • Hash: SHA256
      • DH-Group: 14
      • Proposal Handling: Strict
      • Lifetime: 28800
      • Traffic Volume (KB): Unlimited
      1. Next, you will need to configure the Network Settings, go to the Configuration > Site to Site VPN (vpn) and edit or add a new one:

      03 Setting up site-to-site on Barracuda.png

      • Endpoint Type: IPv4
      • One VPN Tunnel per Subnet Pair: Unchecked
      • Universal Traffic Selectors: Unchecked
      • Force UDP Encapsulation: Unchecked
      • IKE Reauthentication: Checked
      • Next Hop Routing: 0.0.0.0
      • Interface Index: 0

      04 Setting up site-to-site on Barracuda.png

      Network Local:

      • Local Gateway: Barracuda FW Public IP
      • Local ID: Barracuda FW Public IP
      • Network address: Internal-Network Subnets

      05 Setting up site-to-site on Barracuda.png

      Network Remote:

      • Remote Gateway: the IP of your NordLayer dedicated server
      • Remote ID: the IP of your NordLayer dedicated server
      • Network address: 10.6.0.0

      06 Setting up site-to-site on Barracuda.png

      Dead Peer Detection:

      • Action: Restart
      • Delay (seconds): 30

      07 Setting up site-to-site on Barracuda.png

      1. Click OK

      Don't forget to click on Send Changes, Activation Pending and Activate:

      08 Setting up site-to-site on Barracuda.png

      Configuring firewall and static routing

      Be sure to allow-list NordLayer private gateway public IP on your firewall rules to allow for incoming traffic, under Firewall > Forwarding Rules:

      09 Setting up site-to-site on Barracuda.png

      It should appear under the firewalls rules as seen below:

      10 Setting up site-to-site on Barracuda.png

      It is also necessary to add static routes from the NordLayer subnet (10.6.0.0/20) to the local network and from the local network to the NordLayer subnet (10.6.0.0/20) to the local network through the VPN tunnel gateway.

      1. Go to Configuration-> Client Networks

      2. Add a new network and set the following:

      • Network Address: 172.XXX.0.0/16 (or relevant subnet)
      • Gateway: local Barracuda IP
      • Name: NordLayer (or any other name you chose for the tunnel).
      1. Select OK

      11 Setting up site-to-site on Barracuda.png

      Make sure the tunnel is up

      At the Barracuda Management Interface, go to VPN -> Site-to-Site. If the tunnel is up the line will appear in the table:

      12 Setting up site-to-site on Barracuda.png

      Ending note:

      In order to finalize the site-to-site setup on our end, please provide these values via Site-to-site request from in the NordLayer Control Panel:

      • Pre-shared key - you can generate it or we can provide it
      • Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
      • Remote gateway/router public IP (must be reachable while connected to the dedicated server)
      • Remote subnet and mask (the subnet is used in your local network)

      Note: In case you are experiencing different results, make sure that you have you carefully gone through all the steps. Having said that, in case the issue persists please feel free to contact our 24/7 customer support team.


      Was this article helpful?