Ipsec tunnel with Ubiquiti Edgerouter

[mrmarkuz (Markus Neuberger)]

I don’t use ubiquiti edgerouter but maybe I found some errors:

I don’t think the description on ubiquiti matches the ID on Nethserver. It’s just a long description of the IPSEC network whereas the ID identifies server and client. Others used IP address or hostname as ID:

Ipsec tunnel between NethServer and Vodafone Station

This seems to be a problem related to local and remote IDs of the Ipsec configuration. Because the Vodafone Station doesn’t allow you to specify the IDs I assume that it’s using Public IPs as identifiers. So, if your Nethserver has a public ip on the red interface yuo can set local and remote id that way: local ID: public ip adress of nethserver remote ID: public ip adress of the vodafone station

@adv

key-exchange ikev1

On Ubiquiti you may change ikev1 to ikev2.

@adv

dpdaction=hold

Disabled DPD on Nethserver sets it to hold.

To set DPD to hold on ubiquiti:

set vpn ipsec ike-group FOO0 dead-peer-detection action hold

This is not necessary but just to check if it works:

NOTE: There is no need for DPD when IKEv2 is used, as it has a built-in keep-alive mechanism.

Did you enable P2 offload on ubiquiti:

set system offload ipsec enable

Did you set all necessary firewall rules on ubiquiti?

Docs to configure ubiquiti IPSEC VPN:

EdgeRouter - Modifying the Default IPsec Site-to-Site VPN