Contents x
    Setting up site-to-site on WatchGuard
    • 2 Minutes to read
      Contents

      Setting up site-to-site on WatchGuard

      • 2 Minutes to read
        Article Summary

        Note: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

        Configuring the tunnel on the WatchGuard Management Interface

        1. Open Fireware Web UI

        2. In the left panel, select VPN, then Branch Office VPN

        3. Under Gateways select ADD. The following window will open (make sure the General Settings tab is displayed)

        Screenshot 2021-05-26 at 17.43.01.png

        1. Under Gateway Name fill in a name of your own choice

        2. Select Use Pre-Shared Key and insert the Shared Secret you have generated (we will also need this value on our end)

        3. Under Gateway Endpoint select ADD

        4. Fill in the following information:

        • Local Gateway
          • External Interface: External
          • Interface IP Address: Primary Interface IP Address

        Screenshot 2021-05-26 at 17.43.07.png

        • Remote Gateway:
          • Select Static IP Address and enter the IP of your NordLayer dedicated server
          • Select By IP Address and enter your the IP of your NordLayer dedicated server
        • Advanced:
          • Select "Specify a different pre-shared key for each gateway endpoint" and enter the Shared Secret

        Leave the rest of the fields with the default values.

        Screenshot 2021-05-26 at 17.43.15.png

        1. Go to the Phase 1 Settings tab and fill in the following information:
        • Version: IKEv1 (IKEv2 recommended if your device supports it)
        • Mode: Main
        • NAT Traversal: Check
        • Keep-alive Interval: 20 seconds
        • IKE Keep-alive: Check
        • Message Interval: 30 seconds
        • Max failures: 5
        • Dead Peer Detection (RFC3706): Check
        • Traffic idle timeout: 120 seconds
        • Max retries: 5
        1. Go to the Transform Settings and select ADD. Fill in the following information:
        • Authentication: SHA2-256
        • Encryption: AES(256-bit)
        • SA Life: 24 hours
        • Key Group: Diffie-Hellman Group 14
        1. Go back to the Branch Office VPN page. Under Tunnel select ADD
        • Name: Fill in a name of your choice.
        • Gateway: Choose the gateway that you have just created.
        1. Go to the Addresses tab and select ADD
        • Local IP: Any (0.0.0.0/0)
        • Remote IP: Network IPv4; 10.6.0.0/20
        • Direction: bi-directional

        Leave the rest of the fields with default values (including the NAT tab).

        Screenshot 2021-05-26 at 17.43.27.png

        1. Go to the Phase 2 Settings

        2. Check Enable Perfect Forward Secrecy and select Diffie-Hellman Group 14

        3. Under IPSec Proposals choose ESP-AES256-SHA256 then select ADD

        4. Select Save (leave the settings in the Multicast Settings tab alone)

        Ending note:

        In order to finalize the site-to-site setup on our end, please provide these values via Site-to-site request from in the NordLayer Control Panel:

        • Pre-shared key - you can generate it or we can provide it
        • Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
        • Remote gateway/router public IP (must be reachable while connected to the dedicated server)
        • Remote subnet and mask (the subnet is used in your local network)

        Note: In case you are experiencing different results, make sure that you have you carefully gone through all the steps. Having said that, in case the issue persists please feel free to contact our 24/7 customer support team.

        Was this article helpful?
        What's Next