Tutorials · Security
How to Connect Two Offices With a Site-to-Site IPsec VPN
Link branch and head office securely over the Internet: plan subnets, match IKE and IPsec settings, and route traffic through the tunnel.
Before you start
- A VPN-capable gateway or firewall at each site
- Public IP addresses (or DDNS) at each site
- Non-overlapping LAN subnets
Step by step
Plan addressing
Each site needs a unique subnet, for example 10.1.0.0/16 for head office and 10.2.0.0/16 for the branch. Overlapping subnets break routing.
Choose crypto settings
Use IKEv2 with AES-256 (or AES-GCM), SHA-256 or better and Diffie-Hellman group 14 or higher. Both sides must match.
Configure phase 1 (IKE)
Enter the peer's public IP, the authentication method (pre-shared key or certificate) and the IKE proposal.
Configure phase 2 (IPsec)
Define local and remote subnets and the IPsec proposal, and enable perfect forward secrecy.
Add routes and firewall rules
Route the remote subnet through the tunnel and allow only the required traffic between sites.
Test and monitor
Ping across the tunnel, test applications and enable dead-peer detection so the tunnel recovers automatically.
Pro tips
- Use certificates or long random pre-shared keys.
- Combine with 4G LTE backup for branches that must stay connected.
FAQ
Frequently asked questions
IPsec or SSL VPN?
Use IPsec for site-to-site tunnels and SSL or IPsec client VPN for remote users.
Keep learning
Related guides
Dual-WAN with 4G backup
Read more →Firewall rules
Read more →How to Enable 802.1X Port Authentication on Switches
Stop unknown devices from using your network ports: configure 802.1X with RADIUS and MAC-authentication bypass for printers and cameras.
Read more →How to Secure the Management of Switches, Routers and Access Points
A hardening checklist for every network device: strong credentials, SSH only, a management VLAN, access lists and logging.
Read more →How to Segment IoT and CCTV Devices From Your Main Network
Put cameras, smart TVs, sensors and building systems in their own VLANs so one compromised device cannot reach your business systems.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.