PfSense

Introduction

This guide will assist you in establishing a Site-to-Site VPN tunnel between your Harmony SASE network and the pfSense Firewall environment.

Breakdown of topics

1. Pre-requisites
2. Configuration Steps
3. Verifying the Setup
4. Troubleshooting
5. Support Contacts

Pre-requisites

To successfully follow this guide, ensure that:

1. You have an active Harmony SASE account with an existing network.
2. The Harmony SASE application is installed on your devices.
3. You possess an active pfSense Firewall setup with the necessary administrative permissions.

Configuration Steps

Creating a Harmony SASE Site-to-Site Tunnel

1. Go to the Gateway in your network from which you want to create the tunnel to the PfSense Firewall.
2. Select the three-dotted menu (...) and select Add Tunnel.
3. Select IPSec Site-2-Site Tunnel and select Continue.
4. Select Single Tunnel, and Click Continue.
   
5. Under General Settings, enter the following:
   • Name - Set the name for the Tunnel.
   • Shared Secret - Put a shared secret or select Generate.
   • Public IP and Remote ID- input your PfSense Firewall Public WAN IP address.
     Dynamic IP Tunnel

     if you don't have a static Public IP assigned by your ISP, we recommend configuring a Dynamic-IP Tunnel.
   • In Harmony SASE Gateway Proposal Subnets Choose your Perimeter81 Network Subnet (By default: 10.255.0.0/16, in this screenshot: 10.254.0.0/16).
   • In Remote Gateway Proposal Subnets, input your PfSense internal LAN subnet/s.
     
6. At the Advanced Settings section complete the following information:
   
   • IKE: IKE Version 2
   • IKE Lifetime: 8h
   • Tunnel Lifetime: 1h
   • Dead Peer Detection Delay: 10s
   • Dead Peer Detection Timeout: 30s
   • Encryption (Phase 1): aes256
   • Encryption (Phase 2): aes256
   • Integrity (Phase 1): sha256
   • Integrity (Phase 2): sha256
   • Diffie Hellman Groups (Phase 1): 14
   • Diffie Hellman Groups (Phase 2): 14

Creating a Site-to-Site tunnel on the PfSense device

1. Go to VPN -> IPsec
2. Select +Add P1
   • Key Exchange Version: IKEv2 if the Firewall version supports it, IKEv1 otherwise. 
   • Internet Protocol: IPv4
   • Interface: <Your pfSense WAN Interface>
   • Remote Gateway: P81 Gateway IP address
   • Authentication Method: Mutual PSK
   • Negotiation Mode: Main
   • My Identifier: My IP Address
     
     Dynamic IP Tunnel

     If you are configuring a Dynamic-IP Tunnel, select "Distinguished Name" and enter the predefined Remote ID string.
   • Peer Identifier: Peer IP Address
     
   • Pre-Shared key: This is the same key you put in the Harmony SASE Tunnel settings

3. Encryption Algorithm
   • Algorithm: AES
   • Key Length: 256 bits
   • HASH: SHA256
   • DH Group: 14
   • Lifetime (Seconds): 28800
4. Advanced Options
   • Disable rekey: Unchecked
   • Margintime (Seconds): Empty
   • Responder Only: Unchecked
   • NAT Traversal: Auto
   • Dead Peer Detection: Checked
   • Delay: 10
   • Max failures: 5
5. Select Save.
   
6. Add phase 2: Select +Add p2
   • Mode: Tunnel IPv4
   • Local Network: Network: Put your local LAN network subnet
   • Remote Network: Network: Put P81 remote network subnet
   • Phase 2: Proposal
   • Protocol: ESP
   • Encryption Algorithm-AES: 256bits
   • Hash Algorithms: SHA256
   • PFS Key Group: 14

6. Select Save.
   
   
7. Select Apply Changes.
   
   
   
   
   
   

Configuring Firewall rules on the PfSense (Optional)

1. In the Menu Bar go to Firewall -> Rules.
2. Under IPSEC add a new rule.
   • Action: Pass
   • Quick: Mark v
   • Interface: WAN and IPSEC
   • Source: P81 Gateway IP
   • Destination: Either put any or you can limit to your FW external IP
   • Select Save.
     
3. Under IPSEC add a new rule:
   • Action: Pass.
   • Source: P81 Gateway IP.
   • Destination: Either put any or you can limit to your FW external IP.
   • Select Save.
     
     
     
4. Select Apply Changes.

Bringing the tunnel up

1. In the Menu Bar go to Status:-> IPsec.
2. On the tunnel, you created select: Connect VPN.
   
   

   
   

   Verifying the Setup

   After following the above steps, your tunnel should be active.
   To verify, go to your Harmony SASE dashboard, locate the tunnel you just created, and check the tunnel status.
   It should indicate that the tunnel is "Up", signifying a successful connection.
   Next, connect to your network using the Harmony SASE agent and attempt to access one of the resources in your environment.

   Troubleshooting

   If you encounter issues during or after the setup, try reviewing your settings to ensure everything matches the instructions. In particular, check the IP addresses and other details you entered during setup. If issues persist, please consult our dedicated support.

   Support Contacts

   If you have any difficulties or questions, don't hesitate to contact Harmony SASE's support team. We offer 24/7 chat support on our website at Perimeter81.com, or you can email us at sase-support@checkpoint.com. We're here to assist you and ensure your VPN tunnel setup is a success.