Barracuda

Introduction

This guide will guide you through the steps needed to establish a Site-to-Site VPN tunnel between your Harmony SASE network and your Barracuda environment.

Breakdown of topics

1. Pre-requisites
2. Configuration Steps
3. Verifying the Setup
4. Troubleshooting
5. Support Contacts

Pre-requisites

To successfully follow this guide, ensure that:

1. You have an active Harmony SASE account and network.
2. The Harmony SASE app is installed on your devices.
3. An active Barracuda account with administrative permissions is accessible.

Configuration Steps

1. Go to the Gateway in your network from which you want to create the tunnel to the Barracuda Firewall.
2. Select the three-dotted menu (...) and select Add Tunnel.
3. Select IPSec Site-2-Site Tunnel and select Continue.
4. Select Single Tunnel, and Click Continue.
   
5. Under General Settings, enter the following:
   • Name - Set the name for the Tunnel.
   • Shared Secret - Put a shared secret or select Generate.
   • Public IP and Remote ID - input your Barracuda Firewall Public WAN IP address.
   • In Harmony SASE Gateway Proposal Subnets Choose your Harmony SASE Network Subnet (By default: 10.255.0.0/16, in this screenshot: 10.254.0.0/16).
   • In Remote Gateway Proposal Subnets, input your internal LAN subnet.
     
6. At the Advanced Settings section complete the following information:
   
   • IKE: IKE Version 2
   • IKE Lifetime: 8h
   • Tunnel Lifetime: 1h
   • Dead Peer Detection Delay: 10s
   • Dead Peer Detection Timeout: 30s
   • Encryption (Phase 1): aes256
   • Encryption (Phase 2): aes256
   • Integrity (Phase 1): SHA1
   • Integrity (Phase 2): SHA1
   • Diffie Hellman Groups (Phase 1): 2
   • Diffie Hellman Groups (Phase 2): 2

Configuring the tunnel in the Barracuda Management Interface

1. Open the Barracuda Management Interface.
2. In the top menu, select Configuration > Virtual Servers > Your virtual server > Assigned Services > VPN (VPN-Service) > Site to Site.
3. Select IPsec IKEv2 Tunnels and create a new tunnel, then fill in the following information:
   
   • Phase 1:
     • Encryption: AES256
     • Hash: SHA
     • Diffie-Hellman Group: 2
     • Proposal Handling: Strict
     • Lifetime: 28800
   • Phase 2:
     • Encryption: AES256
     • Hash: SHA
     • DH-Group: 2
     • Proposal Handling: Strict
     • Lifetime: 3600
     • Traffic Volume (KB): Unlimited
       
4. Next, you will need to configure the Network Settings, go to the Configuration > Site to Site VPN (vpn) and edit or add a new one:
   
   • Endpoint Type: IPv4
   • One VPN Tunnel per Subnet Pair: Unchecked
   • Universal Traffic Selectors: Unchecked
   • Force UDP Encapsulation: Unchecked
   • IKE Reauthentication: Checked
   • Next Hop Routing: 0.0.0.0
   • Interface Index: 0
   • Network Local:
     • Local Gateway: <Barracuda FW Public IP>
     • Local ID: <Barracuda FW Public IP>
     • Network address: <Internal-Network Subnets>
   • Network Remote:
     • Remote Gateway: <P81 Public IP>
     • Remote ID: <P81 Public IP>
     • Network address: <P81 Subnet>
   • Dead Peer Detection:
     • Action: Restart
     • Delay (seconds): 30
5. Click OK. 
   • Don't forget to click on Send Changes, Activation Pending, and Activate:

Configuring firewall and static routing

1. Be sure to whitelist Harmony SASE's GW public IP on your firewall rules to allow for incoming traffic, under Firewall > Forwarding Rules:
2. It should appear under the firewalls rules as seen below
   • It is also necessary to add static routes from the Harmony SASE subnet (10.XXX.0.0/16) to the local network and from the local network to the Harmony SASE subnet (10.XXX.0.0/16) through the VPN tunnel gateway.
3.  Go to Configuration-> Client Networks.
4.  Add a new network and set the following:
   
   • Network Address: 172.XXX.0.0/16 (or relevant subnet)
     
   • Gateway: local Barracuda IP.
     
   • Name: Harmony SASE (or any other name you chose for the tunnel).

3. Select OK.
   
4. Make sure the tunnel is up: At the Barracuda Management Interface, go to VPN -> Site-to-Site. If the tunnel is up the line will appear in the table:
   

Verifying the Setup

After following the above steps, your tunnel should be active.
To verify, go to your Harmony SASE dashboard, locate the tunnel you just created, and check the tunnel status.
It should indicate that the tunnel is "Up", signifying a successful connection.
Next, connect to your network using the Harmony SASE agent and attempt to access one of the resources in your environment.

Troubleshooting

If you encounter issues during or after the setup, try reviewing your settings to ensure everything matches the instructions. In particular, check the IP addresses and other details you entered during setup. If issues persist, please consult our dedicated support.

Support Contacts

If you have any difficulties or questions, don't hesitate to contact Harmony SASE's support team. We offer 24/7 chat support on our website at Perimeter81.com, or you can email us at sase-support@checkpoint.com. We're here to assist you and ensure your VPN tunnel setup is a success.