topic Re: where to define a static public IP for IPsec in General Topics

where to define a static public IP for IPsec

clonesheep — Tue, 11 Sep 2018 07:43:28 GMT

Hi I have to build up a IPSec tunnel with a partner. So at Network -> Interfaces -> eth 1/1 I have my connection to internet with a /28 Net. I call it for example 12.34.56.144/28 net. There the router from my isp is IP 12.34.56.145. I will build up my tunnel on ip .146. Now on the eth 1/1 I define the IP 12.34.56.146/28 so the complete /28 net is set.

On Network -> IKE Gateway I can only chose the local IP Address /28 from interface and not one /32 IP. How can I do this?

When I set a second /32 address I get a routing error. So how must I configure this right way?

Re: where to define a static public IP for IPsec

santonic — Tue, 11 Sep 2018 08:03:21 GMT

Did you add /32 address on interface first? After that you should be abe to select it in IKE Gw settings.

Re: where to define a static public IP for IPsec

clonesheep — Tue, 11 Sep 2018 09:10:42 GMT

I have 12 public IPs and i must all use. So must i configure

...146/32

...147/32

..and so on?

Or how can i connect to the ips?

Re: where to define a static public IP for IPsec

santonic — Tue, 11 Sep 2018 09:16:57 GMT

If you want to select an address in IKE GW object you must define it on interface first.

If you're just using it for NAT (source or destination) it's not mandatory.

Both ways tell PA for which address it should answer to ARP request.

Re: where to define a static public IP for IPsec

clonesheep — Tue, 11 Sep 2018 11:21:05 GMT

I want to use it in IKE Gateway. But how must I define it?

I use it just as well as NAT. How must look my NAT entry?

And how can I test it?

Re: where to define a static public IP for IPsec

santonic — Wed, 12 Sep 2018 09:30:21 GMT

You simply add another IP to interface. First IP (primary) you define with correct mask (/28 or however it is). All the additional IPs from same subnet come with /32 mask.

To use it in NAT rules you don't have to define it on interface, but you can.