# Enable IPsec Site-to-Site VPN

Verkada gateways can act as site-to-site IPSec IKEv2 VPN clients. This allows the gateway to connect to an IPsec VPN server and route encrypted traffic. The gateway can only route traffic from devices connected to it through the VPN. Appropriate egress and NAT rules must be set up on the VPN server to allow connected device traffic to be routed through the internet and within the VPN tunnel.

{% hint style="danger" %}
You need to [set up Dynamic DNS](https://help.verkada.com/connectivity/configuration-and-setup/set-up-dynamic-dns-for-cellular-gateways) before you can enable IPsec Site-to-Site VPN.
{% endhint %}

***

## Configure IPsec VPN on a gateway

{% stepper %}
{% step %}

#### In Verkada Command, go to **All Products > Gateways** .

{% endstep %}

{% step %}

#### Select the gateway you want to configure.

{% endstep %}

{% step %}

#### In the top right, click Settings .

{% endstep %}

{% step %}

#### Under **Network** > **IPsec VPN** toggle on **Enable** **IPSec VPN.**

<div align="left" data-with-frame="true"><img src="https://1814166542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiAGnzScvko5PkG7YBy3i%2Fuploads%2Fgit-blob-7cc6c8485e3f801a909748aea731f8adfab2b674%2F56663e03fc1e83382655a50c1b4706601944eebb.png?alt=media" alt="" width="742"></div>
{% endstep %}

{% step %}

#### In the **Server** field, enter the VPN server IP or domain name.

{% endstep %}

{% step %}

#### The gateway supports two authentication types:

a. (See step 7) **Certificate**: Requires *Certificate Authority* cert, *client* *cert,* and *key.*\
b. (See step 8) **Pre-Shared Key**: Requires a shared key.
{% endstep %}

{% step %}

#### On the **Authentication** drop-down, select **Certificate.**

a. On **Remote ID,** enter the remote certificate *subjectAltName* or *subject DN*.\
b. On **Local ID,** enter local certificate *subjectAltName* or *subject DN*.

<div align="left" data-with-frame="true"><img src="https://1814166542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiAGnzScvko5PkG7YBy3i%2Fuploads%2Fgit-blob-efa796db1a5a3a87f97bc95e934f6061a86d749d%2F3880a1d563efb82e43c81a90bb2ccaf071e98583.png?alt=media" alt="" width="743"></div>

c. Upload the **Client Key,** **Client Certificate**, and **Certificate Authority** certificate in the *.pem* format.\*\*Note: \*\*Instructions to generate a client key and certificate and to set up a certificate authority are found [here](https://docs.strongswan.org/docs/5.9/pki/pkiQuickstart.html).\
d. Skip to step 9.
{% endstep %}

{% step %}

#### On the **Authentication** drop-down, select **Pre-Shared Key.**

a. On **Remote ID,** enter the remote ID of the pre-shared key.\
b. On **Local ID,** enter the local ID of the pre-shared key.\
c. On **Password,** enter the password of the pre-shared key.

<div align="left" data-with-frame="true"><img src="https://1814166542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiAGnzScvko5PkG7YBy3i%2Fuploads%2Fgit-blob-58c323dccfa517f11730d30ef57ba76509b3d25d%2F52714477ac348030622012c1a75f81f6c0a2daa1.png?alt=media" alt="" width="743"></div>
{% endstep %}

{% step %}

#### Hit **Apply,** then **Confirm** to save. Your gateway should now have a VPN badge next to the name, indicating that the connection was successful.

<div align="left" data-with-frame="true"><img src="https://1814166542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiAGnzScvko5PkG7YBy3i%2Fuploads%2Fgit-blob-9c3ff0b9444c8349cb53872c677efbcaadd949d4%2F6456bfcdfaad26da3ab856d426a9de6238b94223.png?alt=media" alt="" width="518"></div>
{% endstep %}
{% endstepper %}

***

## Configure your VPN server

When configuring your VPN server, you must set specific details to establish the VPN tunnel and enable data transfer between the server and the client.

#### Supported VPN routing type

* Policy Based routing

#### Supported Key Exchange Version

* IKEv2

{% hint style="warning" %}
Perfect Forward Secrecy (PFS) is not supported on gateways as a VPN client.
{% endhint %}

#### Supported cipher suites for IKE Phase 1 and Phase 2

* Encryption
  * AES 128
  * AES 256
* Hash
  * SHA 256
  * SHA 384
  * SHA 512
* DH Group
  * Group 14

{% hint style="info" %}
[Set up DDNS](https://help.verkada.com/connectivity/configuration-and-setup/set-up-dynamic-dns-for-cellular-gateways) using a supported free DDNS provider to ensure your VPN is always connected to the client using its Dynamic Public IP address. This way, the provided ‘hostname’ always resolves to the active public IP address on the VPN client.
{% endhint %}

***

**Need more help?** Contact [Verkada Support](https://app.gitbook.com/s/NRq5qDDjsYNxwNzF1bcB/need-help/contact-verkada-support).
