How do I configure my firewall for compatibility with Site-to-Site VPN on the Datto DNA?
Question
How do I configure my firewall for compatibility with the Datto Networking Appliance's Site-to-Site VPN feature?
Environment
- Datto Networking Appliance (DNA)
- Site-to-Site VPN
Answer
Use the following settings to configure your firewall. The examples shown use a Sonicwall device; certain settings may be named differently or appear in different areas of the UI depending on the brand of device used in your environment.
Environment
- Policy Type: Select Site to Site
- Authentication Method: Select IKE using Preshared Secret
- Name: Use the internal IP address of the DNA
- IPsec Primary Gateway Name or Address: Enter the primary gateway name or address used in your environment
- Shared Secret: Enter the IKE Authentication Shared Secret key
- Local IKE ID & Peer IKE ID: Enter the address scheme and IDs for both values
Figure 1: General settings as shown on a Sonicwall router
Figure 2: Network settings as shown on a Sonicwall router
Proposals
- IKE (Phase 1)
- Exchange: Main Mode
- DH Group: Group 14
- Encryption: AES-128
- Authentication: SHA1
- Life Time (seconds): 28800
- IPsec (Phase 2)
- Protocol: ESP
- Encryption: AES-128
- Authentication: SHA1 - enable Perfect Forward Secrecy
- DH Group: Group 14
- Lifetime (seconds): 28800
Figure 3: Proposals settings as shown on a Sonicwall router
Advanced
- Keep Alive: Enabled
- VPN Policy bound to: Select Interface X2.
Figure 4: Advanced settings as shown on a Sonicwall router
