Skip to main content

Reference for configuring VPN

When you set up a VPN (Virtual Private Network) connection between your corporate network and the Numspot Cloud, you must configure the VPN tunnel according to the following specifications.

The exact procedure depends on the VPN solution that you use.

info
  • Support for the IKEv1 protocol is End of Life. We strongly recommend IKEv2.
  • An IKEv1 VPN fails if there is more than one VPN connection on the same virtual gateway.

For phase 1 proposals, the following options are supported:

  • 256-bit AES-CBC encryption, with SHA2_256_128 HMAC authentication, and DH group 2, 14, 16, 19 or 21.
  • 128-bit AES-CBC encryption, with SHA1 HMAC or SHA2_256_128 HMAC authentication, and DH group 2 or 14.

For phase 2 proposals, the same options are supported:

  • 256-bit AES-CBC encryption, with SHA2_256_128 HMAC authentication, and PFS 2, 14, 16, 19 or 21.
  • 128-bit AES-CBC encryption, with SHA1 HMAC or SHA2_256_128 HMAC authentication, and PFS 2 or 14.
warning

We recommend the following options for both phases: 256-bit AES-CBC encryption, with SHA2_256_128 HMAC authentication, and DH group 16, 19 or 21.

Dead peer detection (DPD) must be enabled, with the following settings:

  • Delay or interval of 30 seconds.
  • Timeout of 90 seconds / 3 retries.

As policy-based VPN is not supported, you must use a VTI (Virtual Tunnel Interface), with the following settings:

  • Traffic selectors: 0.0.0.0/0 at both ends.
  • IP: as defined in the "tunnel inside address" fields in the XML file provided by the API or the Numspot Console.

The local ID must be the IP of the client gateway and the remote ID must be the public IP (External IP or EIP in AWS-compliant API) of the virtual gateway.