Overview

You can create a secure tunnel between two LANs secured by a firewall. This article describes creating an IPsec VPN tunnel between Kerio Control and another device, such as Fortinet, Cisco, Mikrotik, Sophos. Both endpoints should be able to communicate automatically. If a problem occurs and you have to set the values manually, consult the following tables for default and supported values in Kerio Control. Remote endpoints of the tunnel can also use the recommended values.

Important: NAT over a Site-to-Site IPsec VPN connection is not supported.

Solution

1. Modify the /etc/ipsec.conf to set the custom Phase 1 and Phase 2 values. For more information about modification, please review Modifying Internal configuration files.

Phase 1 (IKE):

Phase 2 (ESP):

Supported ciphers

Each cipher consists of three parts:

• Encryption Algorithm — for example, aes128
• Integrity Algorithm — for example, sha1
• Diffie Hellman Groups — for example, modp2048

1. Set ciphers to custom values in the Kerio Control Administration -> Configuration -> Interfaces -> IPsec VPN tunnel properties (Change button).

Kerio Control supports the following ciphers:

Phase 1 (IKE) - supported ciphers

Phase 2 (ESP) - supported ciphers

Testing

The custom configuration is reflected in /etc/ipsec.conf file.

The custom IPSec VPN tunnel ciphers are in place in /opt/kerio/winroute/winroute.cfg file.