Pfsense configuring IPSec site to site tunneling using certificate authentication Guide

stay ​ ​pfSense Site to site IPsec VPN And routing Internet Configuration Guide ​​ in , This paper introduces how to configure by using shared key IPsec VPN And routing Internet The process of , In this paper , Using certificates to configure IPsec VPN Methods . Compared with the authentication method of pre shared key , Using certificate authentication will be relatively complex , But the security will be improved . Because the two methods are only different in Authentication , Therefore, this paper tries to simplify the narrative process , Unless otherwise indicated , Everything else goes with pfSense Site to site IPsec VPN And routing Internet The configuration guidelines are consistent .

If you need to further exchange your experience in firewall , You can join QQ Group 286850453 Discuss . Also welcome to pay attention to wechat public account ”pfSense A firewall ”, It is convenient to receive first-hand articles pushed in time .​

​ Create certificate ​

At the site A And sites B Create a certification authority on (CA) And certificates . For the sake of distinguishing , Site A Dark theme , Site B The light color theme .

​ Site A​

establish CA

• Navigate to System > Certificate management ,CAs tab
• Click on ” “ add to
• The setting options are shown in the figure below ：

​​​​

Create certificate

• Navigate to System > Certificate management , certificate tab
• Click on ” “ add to
• The setting options are shown in the figure below ：

​​​​

• Certificate Properties section , The certificate type is user certificate , Alternate name enter the host name and... Respectively IP Address (LAN Address ), This information will be in phase 1 Used for authentication in .

​​​​

​ Site B​

establish CA As shown in the figure below ：

​​​​

Create the certificate as shown in the figure below ：

​​​​

​​​​

​ Import CA​

For mutual authentication , The firewalls of the two sites need to import each other's CA.

1、 On two sites , Export the created... Separately CA. Click the icon shown in the figure below , export CA certificate .

​​​​

2、 Import each other's CA. Navigate to System > Certificate management ,CAs tab , Click the Add button below , In the certificate source option , Choose to import an existing certification authority . Open the other party's certificate file with a text program , Copy the contents to the certificate data column , And click save .

​​​​

After the save ,CAs Under tabs , There will be two sites CA Information . The following figure shows the site A And sites B Of CA list ：

​​​​

​​​​

​ The revision phase 1 Set up ​

Modify site A And sites B The stage of 1 Set up , Will propose ( authentication ) Change it to Mutual certificate( Mutual certificate ), And adjust the corresponding option settings . Adopt certification according to ID Different types , There are three ways of mutual authentication ：

1、 Use ANSI.1 Proprietary name . Use... In the certificate ANSI.1 Use proper names to authenticate each other .ANSI.1 The distinguished name can be viewed by clicking the certificate details icon in the certificate list , As shown in the figure below DN Later ：

​​​​

​​​​

​​​​

2、 Use FQDN. Use when creating a certificate , Enter in the alternate name section of the certificate properties FQDN To authenticate .

​​​​

​​​​

3、 Use IP Address . Use when creating a certificate , Enter in the alternate name section of the certificate properties IP Address to authenticate .

​​​​

​​​​

The above three kinds of certification ID Type tested , Can be authenticated and connected normally , Use any one of them .

Using certificate authentication is compared with shared key authentication IPsec VPN One more tunnel is created CA And certificate process , The proposal ( authentication ) Options are set differently , in addition to , The other settings of the two are exactly the same , I won't go into that here .

Related articles ：

• ​ ​ With certificate authentication IPsec Site to site VPN Example ​​
• ​ ​pfSense Site to site IPsec VPN And routing Internet Configuration Guide ​​