Connect AP150W to thrid-Party IPSec-Gateway

[Marco_Lorenz]

Hi Heroes,

has anyone already managed to connect an AP150W to a third-Party Firewall with IPSec? I always get the error “Aggressive Mode ID not matching” on conecntrator side. I tried with Watchguard and Sophos Firewalls - same error for both manufactorers.

KR

Marco

[AlexN · Accepted solution]

Folks,

trouble with IQEngine-based gear (cloud APs and XRs) is that they use IPSEC implementation that is just old. It only supports IKEv1 and is somewhat rigid with attributes etc.
There is work underway to upgrade IPSEC to modern standards, at which point you will be able to terminate tunnels on any decent GW, for instance XCC or VOSS FIGW, if that matters

[CWurm]

Hi Volker,

I have managed to get IPSec tunneling to work between two XIQ APs but thats not really useful in my opinion 🙂 I can’t tell our customers to keep one AP in the central DC to have this AP as a tunnel endpoint.

But I totally agree. Documentation on this topic is very bad.

Kind regards

Christian

[Volker_Kull]

I had to go through the same process. I could not find a way to tunnel traffic from a user profile to external. Neither XIQ-AP nor IPsec-GW. Documentation here is below 0.

There are a lot of configuraton paramters but not all are part of a documentation...

br

Volker

[CWurm]

Sorry to bump that thread but has anyone managed to get this working? Either IPSec or GRE? Some of our customers want to have setups which are not bridging the traffic at the access point thus a IPSec/GRE tunnel to the customers firewall would be way better.

I have played around trying to establish a GRE tunnel between my AP410C and a FortiGate but I wasn’t succeeding.

Kind Regards

Christian