---
title: "Setting up site-to-site on Barracuda"
slug: "site-to-site-barracuda"
description: "In the Barracuda Management Interface, create a new VPN tunnel using IPsec IKEv2 Tunnels.If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead."
updated: 2026-05-07T09:12:03Z
published: 2026-05-07T09:12:03Z
canonical: "help.nordlayer.com/site-to-site-barracuda"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up site-to-site on Barracuda

**Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

## Configuring the tunnel at the Barracuda Management Interface

1. Open the Barracuda Management Interface
2. In the top menu, select Configuration > Virtual Servers > Your virtual server > Assigned Services > VPN (VPN-Service) > Site to Site

![01 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/01%20Setting%20up%20site-to-site%20on%20Barracuda.png)

1. Select IPsec IKEv2 Tunnels and create a new tunnel, then fill in the following information:

![02 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/02%20Setting%20up%20site-to-site%20on%20Barracuda%281%29.png)

### Phase 1:

- **Encryption**: AES256
- **Hash**: SHA256
- **Diffie-Hellman Group**: 14
- **Proposal Handling**: Strict
- **Lifetime**: 28800

### Phase 2:

- **Encryption**: AES256
- **Hash**: SHA256
- **DH-Group**: 14
- **Proposal Handling**: Strict
- **Lifetime**: 3600
- **Traffic Volume (KB)**: Unlimited

1. Next, you will need to configure the Network Settings, go to the Configuration > Site to Site VPN (vpn) and edit or add a new one:

![03 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/03%20Setting%20up%20site-to-site%20on%20Barracuda.png)

- **Endpoint Type**: IPv4
- **One VPN Tunnel per Subnet Pair**: Unchecked
- **Universal Traffic Selectors**: Unchecked
- **Force UDP Encapsulation**: Unchecked
- **IKE Reauthentication**: Checked
- **Next Hop Routing**: 0.0.0.0
- **Interface Index**: 0

![04 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/04%20Setting%20up%20site-to-site%20on%20Barracuda.png)

### Network Local:

- **Local Gateway**: Barracuda FW Public IP
- **Local ID**: Barracuda FW Public IP
- **Network address**: Internal-Network Subnets

![05 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/05%20Setting%20up%20site-to-site%20on%20Barracuda.png)

### Network Remote:

- **Remote Gateway**: the IP of your NordLayer server with a dedicated IP
- **Remote ID**: the IP of your NordLayer server with a dedicated IP
- **Network address**: 10.6.0.0

![06 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/06%20Setting%20up%20site-to-site%20on%20Barracuda.png)

### Dead Peer Detection:

- **Action**: Restart
- **Delay (seconds)**: 30

![07 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/07%20Setting%20up%20site-to-site%20on%20Barracuda.png)

1. Click OK

Don't forget to click on Send Changes, Activation Pending and Activate:

![08 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/08%20Setting%20up%20site-to-site%20on%20Barracuda.png)

## Configuring firewall and static routing

Be sure to allow-list NordLayer private gateway public IP on your [firewall](https://nordlayer.com/learn/firewall/what-is-firewall/) rules to allow for incoming traffic, under Firewall > Forwarding Rules:

![09 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/09%20Setting%20up%20site-to-site%20on%20Barracuda.png)

It should appear under the firewalls rules as seen below:

![10 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/10%20Setting%20up%20site-to-site%20on%20Barracuda.png)

It is also necessary to add static routes from the NordLayer subnet (10.6.0.0/20) to the local network and from the local network to the NordLayer subnet (10.6.0.0/20) to the local network through the VPN tunnel gateway.

1. Go to Configuration-> Client Networks
2. Add a new network and set the following:

- **Network Address**: 172.XXX.0.0/16 (or relevant subnet)
- **Gateway:** local Barracuda IP
- **Name**: NordLayer (or any other name you chose for the tunnel).

1. Select OK

![11 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/11%20Setting%20up%20site-to-site%20on%20Barracuda.png)

Make sure the tunnel is up

At the Barracuda Management Interface, go to VPN -> Site-to-Site. If the tunnel is up the line will appear in the table:

![12 Setting up site-to-site on Barracuda.png](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/12%20Setting%20up%20site-to-site%20on%20Barracuda.png)

## Ending note:

In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site).

- Pre-shared key - you can generate it or we can provide it
- Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
- Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
- Remote subnet and mask (the subnet is used in your local network)

**Note**: In case you are experiencing different results, make sure that you have you carefully gone through all the steps. Having said that, in case the issue persists please feel free to contact our [24/7 customer support team](/docs/how-do-i-contact-nordlayer-customer-support).