CloudConnexa: Configure a Network Connector in UniFi OS Router using IPsec

You can configure a UniFi OS router as a CloudConnexa Network Connector using IPsec to provide site-to-site connectivity.

Although UniFi routers support OpenVPN, the IPsec client provides better support for site-to-site connectivity and firewall rule management, making the configuration easier to maintain.

Prerequisites

• Admin access to the CloudConnexa portal.

• Admin access to your UniFi admin dashboard.

• A reachable Public IPv4 address configured on the UniFi device.

Step 1: Create a Network in CloudConnexa

1. Navigate to Networks → Networks.

2. Select Add Network.

3. Select Skip Wizard.

4. Under Network Details, enter a name for the Network.

5. For Connector Tunneling Protocol, select IPsec.

6. Under Connectors, select the CloudConnexa Region closest to the UniFi device.

7. Under IP Services (optional), add the subnets that you want the IPsec Connector to access.

Note: You can also use an existing Network. Make sure IPSec is selected under the Connectors section.

Step 2: Configure the IPsec Connector in CloudConnexa

1. Open the Connectors section of the Network and select Configure.

2. In the Platform to Connect dropdown, select IPsec Compatible Router: Other.

3. Under Setup CloudConnexa Tunnel, configure the following:

   • Remote Site Public IPv4 Address: Enter the WAN IP of the UniFi device. You can find it under Settings → Internet in UniFi.

   • Authentication Method: Select Shared Secret.

   • Pre-shared Key (PSK): Enter a value of your choice. You'll use this same key when configuring UniFi.

   • Connector Hostname: Enter a hostname of your choice (for example, unifi-connector).

   • Connector Domain: Enter a domain of your choice (for example, domain.com).

The Connector Hostname and Connector Domain form the fully qualified domain name (FQDN) used as the Local Authentication ID in UniFi (for example, unifi-connector.domain.com). Neither needs to be a real hostname or domain.

Note: Keep the CloudConnexa configuration page open. You will need values from the Remote Tunnel Configuration section when configuring UniFi.

Step 3: Create the Site-to-Site VPN in UniFi

1. In UniFi, navigate to Settings → VPN → Site-to-Site VPN.

2. Select Create New.

3. Set VPN Type to IPsec.

4. For Name, enter a name to identify the VPN connection.

5. For Pre-Shared Key, enter the same PSK you set in CloudConnexa.

6. For Local IP, select the WAN interface IP address. This should match the Remote Site Public IPv4 Address you entered in CloudConnexa.

7. For Remote IP / Hostname, enter the CloudConnexa Gateway Address shown in the CloudConnexa configuration. This value is also displayed as the CloudConnexa Public IP Address.

8. Under Network Configuration, set VPN Method to Route Based.

9. Set Remote Networks to Static.

10. Add each subnet listed under Routes in the CloudConnexa Remote Tunnel Configuration as a separate entry. For example:

    Routes : 192.168.200.0/24, 100.96.0.0/11, 100.80.0.0/12, 10.1.0.0/16

    In this example, add each address as a separate Remote Network.

11. Change Advanced from Auto to Manual.

12. Set Key Exchange Version to IKEv2.

13. Configure the IKE settings:

    • Encryption: AES-256

    • Hash: SHA256

    • DH Group: 15

    • Lifetime: 28800

14. Configure the ESP settings:

    • Encryption: AES-256

    • Hash: SHA256

    • DH Group: 15

    • Lifetime: 3600

15. For Local Authentication ID, disable Auto and enter the FQDN created from the Connector Hostname and Connector Domain configured in CloudConnexa. For example, unifi-connector.domain.com.

16. Leave the remaining settings at their defaults and select Create.

Step 4: Verify the Connection

1. Before testing the connection, verify that the UniFi IPsec parameters match the values shown in the Remote Tunnel Configuration section of CloudConnexa.
2. Return to the CloudConnexa Administration Portal and select Test Connection.
3. Confirm that the IPsec tunnel connects successfully.