--- title: "Setting up site-to-site on Barracuda" slug: "site-to-site-barracuda" description: "In the Barracuda Management Interface, create a new VPN tunnel using IPsec IKEv2 Tunnels.If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead." updated: 2026-09-08T13:13:21Z published: 2026-09-08T13:13:21Z canonical: "help.nordlayer.com/site-to-site-barracuda" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Setting up site-to-site on Barracuda **Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead. ## Configuring the tunnel at the Barracuda Management Interface 1. Open the Barracuda Management Interface 2. In the top menu, select Configuration > Virtual Servers > Your virtual server > Assigned Services > VPN (VPN-Service) > Site to Site ![Barracuda Firewall admin console showing VPN service configuration tree with site-to-site option highlighted](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/01%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) 1. Select IPsec IKEv2 Tunnels and create a new tunnel, then fill in the following information: ![Barracuda IKEv2 tunnel configuration showing NordLayer with pre-shared key authentication and encryption settings](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/02%20Setting%20up%20site-to-site%20on%20Barracuda(1)(1).png) ### Phase 1: - **Encryption**: AES256 - **Hash**: SHA256 - **Diffie-Hellman Group**: 14 - **Proposal Handling**: Strict - **Lifetime**: 28800 ### Phase 2: - **Encryption**: AES256 - **Hash**: SHA256 - **DH-Group**: 14 - **Proposal Handling**: Strict - **Lifetime**: 3600 - **Traffic Volume (KB)**: Unlimited 1. Next, you will need to configure the Network Settings, go to the Configuration > Site to Site VPN (vpn) and edit or add a new one: ![Barracuda site-to-site VPN page showing NordLayer tunnel with context menu and network configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/03%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) - **Endpoint Type**: IPv4 - **One VPN Tunnel per Subnet Pair**: Unchecked - **Universal Traffic Selectors**: Unchecked - **Force UDP Encapsulation**: Unchecked - **IKE Reauthentication**: Checked - **Next Hop Routing**: 0.0.0.0 - **Interface Index**: 0 ![Barracuda IPsec IKEv2 tunnel settings showing IPv4 endpoint with reauthentication enabled](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/04%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) ### Network Local: - **Local Gateway**: Barracuda FW Public IP - **Local ID**: Barracuda FW Public IP - **Network address**: Internal-Network Subnets ![Barracuda network local settings showing gateway configuration with CIDR network address field](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/05%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) ### Network Remote: - **Remote Gateway**: the IP of your NordLayer server with a dedicated IP - **Remote ID**: the IP of your NordLayer server with a dedicated IP - **Network address**: 10.6.0.0 ![Barracuda network remote settings showing gateway configuration with remote network address field](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/06%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) ### Dead Peer Detection: - **Action**: Restart - **Delay (seconds)**: 30 ![Barracuda dead peer detection settings showing restart action with 30 second delay configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/07%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) 1. Click OK Don't forget to click on Send Changes, Activation Pending and Activate: ![Barracuda VPN activation pending with send changes button and activate confirmation dialog](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/08%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) ## Configuring firewall and static routing Be sure to allow-list NordLayer private gateway public IP on your [firewall](https://nordlayer.com/learn/firewall/what-is-firewall/) rules to allow for incoming traffic, under Firewall > Forwarding Rules: ![Barracuda firewall rule editor showing NordLayer VPN traffic pass rule with bidirectional network settings](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/09%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) It should appear under the firewalls rules as seen below: ![Barracuda firewall rules page showing NordLayer VPN rule highlighted in forwarding configuration table](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/10%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) It is also necessary to add static routes from the NordLayer subnet (10.6.0.0/20) to the local network and from the local network to the NordLayer subnet (10.6.0.0/20) to the local network through the VPN tunnel gateway. 1. Go to Configuration-> Client Networks 2. Add a new network and set the following: - **Network Address**: 172.XXX.0.0/16 (or relevant subnet) - **Gateway:** local Barracuda IP - **Name**: NordLayer (or any other name you chose for the tunnel). 1. Select OK ![Barracuda client network dialog showing NordLayer static route with IPv4 network and gateway configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/11%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) Make sure the tunnel is up At the Barracuda Management Interface, go to VPN -> Site-to-Site. If the tunnel is up the line will appear in the table: ![Barracuda VPN site-to-site dashboard showing NordLayer IPsec IKEv2 tunnel with connection status and encryption details](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/12%20Setting%20up%20site-to-site%20on%20Barracuda(1).png) ## Ending note: In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site). - Pre-shared key - you can generate it or we can provide it - Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2) - Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP) - Remote subnet and mask (the subnet is used in your local network) --- **Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.