IPsec
IPsec tunnels carry control-plane traffic between your Service Gateway routers and Netgraph.
The Service Gateway connects to the Netgraph platform over a FlexVPN (IKEv2/IPSec) tunnel that carries session state, events, policy updates, and control-plane telemetry. Guest traffic itself doesn’t traverse the tunnel — it flows through the router’s data plane — but anything Sign In needs to coordinate with the platform passes through it.
The IPsec tab under Service Gateway is where you configure the remote peers that the routers pair with.
Remote peers
Section titled “Remote peers”A remote peer is the Netgraph-side endpoint a Service Gateway router connects to. For each peer, Sign In stores:
- Peer address — the IP or hostname of the Netgraph endpoint.
- Shared secret — the pre-shared key used for authentication. Coordinate this with your router team; both sides must agree.
- Networks — the networks reachable through this peer.
The IKEv2/IPSec crypto parameters — encryption, integrity, DH groups, and dead-peer-detection timers — are defined by the platform’s FlexVPN template rather than set per peer on this tab. Your router team mirrors those values in the matching configuration on the Cisco side.
Multiple peers can be defined so that different Service Gateways (or different routers within an HA pair) can use different Netgraph-side endpoints.
Setting up a tunnel
Section titled “Setting up a tunnel”-
Coordinate parameters with the router team
Agree on the peer address and a strong shared secret, and confirm the IKEv2/IPSec crypto settings the platform’s FlexVPN template uses so the router’s configuration matches. Document these so both sides install matching configuration.
-
Add the remote peer in Sign In
From the IPsec tab, click Add Remote Peer and enter the values.
-
Configure the router
On the Cisco side, configure the IPsec tunnel to the Netgraph peer address with the same parameters.
-
Verify the tunnel is up
The Dashboard’s IPsec Service Status card flips to active once the tunnel establishes. Check on the router with
show crypto isakmp sa/show crypto ipsec sa(or your platform’s equivalent).
Shared secret handling
Section titled “Shared secret handling”- Treat the shared secret as a credential — don’t paste it into chat or ticketing systems.
- Rotate when you rotate other network credentials. Coordinate a maintenance window because both sides need to change simultaneously.
- The audit log records when the secret was last updated, and by whom, but not the value itself.
When tunnels flap
Section titled “When tunnels flap”Tunnels dropping and re-establishing usually point to:
- MTU mismatch — the path MTU between the router and Netgraph is lower than the tunnel’s clear-text MTU. Tune the tunnel MTU down.
- NAT in the path — if NAT is present, NAT-traversal (NAT-T) must be enabled on both sides.
- DPD timer mismatch — one side declares the peer dead before the other side renews.
Check the Service Gateway’s own logs first — they surface the specific negotiation step that failed.