topic Connect AP150W to thrid-Party IPSec-Gateway in Hero Discussions

Connect AP150W to thrid-Party IPSec-Gateway

Marco_Lorenz — Mon, 12 Oct 2020 16:10:44 GMT

Hi Heroes,

has anyone already managed to connect an AP150W to a third-Party Firewall with IPSec? I always get the error “Aggressive Mode ID not matching” on conecntrator side. I tried with Watchguard and Sophos Firewalls - same error for both manufactorers.

Marco

Re: Connect AP150W to thrid-Party IPSec-Gateway

Miguel-Angel_RO — Thu, 29 Oct 2020 15:56:17 GMT

Marco,

I never tried this but the error messages seems to indicate an issue in the IPSec phase1.

Try to disable the “aggressive mode”.

Mig

Re: Connect AP150W to thrid-Party IPSec-Gateway

CWurm — Mon, 25 Jan 2021 02:01:10 GMT

Sorry to bump that thread but has anyone managed to get this working? Either IPSec or GRE? Some of our customers want to have setups which are not bridging the traffic at the access point thus a IPSec/GRE tunnel to the customers firewall would be way better.

I have played around trying to establish a GRE tunnel between my AP410C and a FortiGate but I wasn’t succeeding.

Kind Regards

Christian

Re: Connect AP150W to thrid-Party IPSec-Gateway

Volker_Kull — Fri, 26 Feb 2021 20:24:14 GMT

I had to go through the same process. I could not find a way to tunnel traffic from a user profile to external. Neither XIQ-AP nor IPsec-GW. Documentation here is below 0.

There are a lot of configuraton paramters but not all are part of a documentation...

Volker

Re: Connect AP150W to thrid-Party IPSec-Gateway

CWurm — Fri, 26 Feb 2021 20:29:38 GMT

Hi Volker,

I have managed to get IPSec tunneling to work between two XIQ APs but thats not really useful in my opinion 🙂 I can’t tell our customers to keep one AP in the central DC to have this AP as a tunnel endpoint.

But I totally agree. Documentation on this topic is very bad.

Kind regards

Christian

Re: Connect AP150W to thrid-Party IPSec-Gateway

AlexN — Fri, 09 Apr 2021 23:14:58 GMT

Folks,

trouble with IQEngine-based gear (cloud APs and XRs) is that they use IPSEC implementation that is just old. It only supports IKEv1 and is somewhat rigid with attributes etc.
There is work underway to upgrade IPSEC to modern standards, at which point you will be able to terminate tunnels on any decent GW, for instance XCC or VOSS FIGW, if that matters