IPsec

Each Service Gateway router connects to the Netgraph platform over its own FlexVPN (IKEv2/IPsec) tunnel. The router sets up the tunnel itself, from the configuration you download on the router’s page.

The tunnel carries DHCP relay, DNS, traffic from guests who have not signed in yet on its way to the portal, BGP and statistics. Once a guest has signed in, their internet traffic breaks out locally at the router and does not pass through the tunnel.

Remote peers

The IPsec tab lists one remote peer per router. Sign In creates it when you add a router with Acts as IPsec Remote Peer ticked, and removes it together with the router. There is no separate step to add or delete a peer here.

Each row shows:

• ID: the router’s Router ID.
• PSK: the pre-shared key the router authenticates with. It is filled into the router configuration as ${ikev2PreSharedKey}.
• Networks: the networks Netgraph reaches through this router’s tunnel. The router’s tunnel interface IP is always there, as a /32.

When BGP is disabled for a router, Sign In also adds the networks of the router’s DHCP scopes to its remote peer. With BGP, the router advertises those networks itself, see BGP.

A router added without Acts as IPsec Remote Peer has no remote peer and no tunnel of its own to Netgraph. Such a router must have BGP enabled.

The IKEv2 and IPsec settings, such as encryption, integrity, DH groups and dead peer detection, are part of the framework template and not set per peer.

Setting up a tunnel

1. Add the router

   Add the router under Gateways with Acts as IPsec Remote Peer ticked.

2. Download the configuration

   Fill in the router’s variables, save, and download the configuration from Resolved Template Preview. It contains the tunnel with the key and addresses filled in.

3. Apply it on the router

   The router connects the tunnel to Netgraph by itself. It needs outbound UDP 500 and 4500 to the internet.

4. Verify the tunnel is up

   On the router, show crypto ikev2 sa and show crypto ipsec sa show the tunnel and its traffic.

Changing the pre-shared key

Use Modify on the peer’s row to open Update Remote Peer, enter the new PSK and click Update Remote Peer. Then download the router’s configuration again and apply it on the router. Until the router has the new key, it cannot set up the tunnel again.

The key is shown in the Remote Peers list and in the downloaded configuration. Treat both as credentials and don’t paste them into chat or tickets.

When tunnels flap

Tunnels dropping and re-establishing usually point to:

• MTU on the path: the path between the router and Netgraph has a lower MTU than the tunnel expects. Lower the tunnel’s MTU or TCP MSS.
• Blocked NAT traversal: with NAT in the path, IKEv2 moves to UDP 4500. Both UDP 500 and 4500 must be open outbound.
• An old key on the router: the PSK was changed in Sign In but the new configuration was not applied.

Check the router’s own logs first. They show the negotiation step that failed.

Related

Gateways

Add routers and download their configuration.

BGP

BGP runs inside the tunnel.