CloudConnexa: Configure a Network Connector in UniFi OS Router using IPsec

This article shows you how to configure a Network Connector for UniFi routers using IPsec.

While UniFi routers support OpenVPN, their IPsec Client has better support for site-to-site access and firewall rule management, making it easier to maintain in the long term.

Prerequisites

• Admin access to the CloudConnexa portal.

• Access to your UniFi admin dashboard.

• Have a reachable Public IPv4 address set into the Unifi device.

Create a Network in CloudConnexa

1. Go to Networks → Networks and click Add Network.

2. Select Skip Wizard.

3. Enter a name for the Network under Network Details.

4. For Connector Tunneling Protocol, select IPsec.

5. Under Connectors, select the CloudConnexa Region closest to the UniFi device.

6. Under IP Services (optional), add the subnets that the IPsec Connector will have access to.

Note: You can also use an existing Network. Make sure IPsec is selected under the Connectors section.

Configure the IPsec Connector in CloudConnexa

1. Go to the Connectors section of the Network and click Configure.

2. In the Platform to Connect dropdown, select IPsec Compatible Router: Other.

3. Under Setup CloudConnexa Tunnel:

1. Remote Site Public IPv4 Address — enter the WAN IP of the UniFi device. You can find it under Settings → Internet in UniFi.

2. Authentication Method — select Shared Secret.

3. Pre-shared Key (PSK) — enter a value of your choice. You will use this same key in UniFi.

4. Connector Hostname — enter a hostname of your choice (for example, unifi-connector).

5. Connector Domain — enter a domain of your choice (for example, domain.com). Together, these form the FQDN used as the Local Authentication ID in UniFi (for example, unifi-connector.domain.com). Neither needs to be a real hostname or domain.

Note: Keep this tab open. You will need values from the Remote Tunnel Configuration section when configuring UniFi.

Create the Site-to-Site VPN in UniFi

1. Go to Settings → VPN → Site-to-Site VPN and click Create New.

2. Set VPN Type to IPsec.

3. Name — enter a name to identify this VPN connection.

4. Pre-Shared Key — enter the same PSK you set in CloudConnexa.

5. Local IP — select the WAN interface IP. This is the same IP you entered in CloudConnexa as the Remote Site Public IPv4 Address.

6. Remote IP / Hostname — enter the CloudConnexa Gateway Address shown in the CloudConnexa configuration (also displayed at the top of the page as CloudConnexa Public IP Address).

7. Under Network Configuration, set VPN Method to Route Based.

8. Remote Networks — set to Static. Add each subnet listed in the Routes line of the Remote Tunnel Configuration section in CloudConnexa. The line looks like this:

Routes : 192.168.200.0/24, 100.96.0.0/11, 100.80.0.0/12, 10.1.0.0/16

Add each of those subnets as a separate entry.

9. Set the Advanced option from Auto to Manual.

10. Key Exchange Version — select IKEv2.

11. IKE:

1. Encryption — select AES-256.

2. Hash — select SHA256.

3. DH Group — select 15.

4. Lifetime — enter 28800.

12. ESP:

1. Encryption — select AES-256.

2. Hash — select SHA256.

3. DH Group — select 15.

4. Lifetime — enter 3600.

13. Local Authentication ID — uncheck Auto, then enter the Connector Hostname + Connector Domain value you set in CloudConnexa (for example, unifi-connector.domain.com).

14. Leave all other settings at their defaults and click Create.

Important: Before testing, verify that the UniFi parameters match those shown in the Remote Tunnel Configuration section of CloudConnexa. Once both sides are configured, go back to CloudConnexa and click Test Connection to confirm the tunnel is up.