Set up an IPsec tunnel for your private network

IPsec builds a two-way, encrypted site-to-site tunnel between your private network's dedicated gateway and a VPN concentrator on your side, your corporate network or a cloud VPC. Once the tunnel is up, traffic between the two networks is encrypted and authenticated, so SIMs can reach resources on your network and your network can reach SIMs.

For the private network architecture and WireGuard setup, see Private networks and WireGuard setup.

Overview

Most IoT use cases use an application server with a public IP address so devices can push data over the public internet. A GPS tracker sending location to a server every five minutes is a typical example.

Some scenarios call for a private connection instead. IPsec tunnels connect your corporate or cloud network directly to the subnet used by your SIM cards.

In the setup below, SIM cards can reach anything on the internet as well as private resources inside your network.

It is also possible to route all SIM traffic through the tunnel, letting you run your own internet gateway and control all inbound and outbound traffic.

Set up an IPsec tunnel

Before configuring the tunnel, deploy your private network and have a VPN concentrator ready. The basic steps are:

Deploy a private network. See Private networks and WireGuard setup.
Deploy a VPN concentrator in your corporate or cloud network with a public IP address. Simbase recommends pfSense if you don't already run one.
Configure the IPsec tunnel in the Simbase dashboard.
Configure the IPsec tunnel on your VPN concentrator to match.

Test the tunnel in a lab environment before using it in production. The exact steps depend on your concentrator's make and software, consult its documentation, and consider involving a network engineer for larger or more complex setups.

Configure IPsec (Simbase dashboard)

General

Setting	Description
Key exchange version	Negotiates the tunnel. IKEv2 is faster and more secure than IKEv1, and is preferred when your concentrator supports it. Use auto when unsure.
Simbase IP address	The IP address of the Simbase VPN concentrator. Note this down — you'll need it when configuring your side.
Remote IP address	The public IPv4 address of your VPN concentrator.
Pre-shared key	Authenticates the two ends of the tunnel. Use a long, random key, or copy the proposed one. Avoid special characters. Never share it — anyone with this key can compromise the tunnel.

Setting

Key exchange version
Simbase IP address
Remote IP address
Pre-shared key

Phase 1 (Key exchnage)

Setting	Description
Encryption algorithm	Encrypts key-exchange traffic. AES128-GCM (128-bit) is recommended for the best balance of security and performance.
Hash algorithm	Verifies integrity of key-exchange traffic. SHA256 is recommended. SHA1 is generally considered unsafe and should be avoided.
DH group key	Diffie-Hellman group for the key exchange. DH Group 14 (2048-bit) is recommended.
Lifetime	How long the Phase 1 session lasts before re-negotiating, in seconds. 28800 is a sensible default. Set one endpoint to this value and the other at least 10% higher (e.g. 31680) to avoid overlap. Range: 20000–86400 seconds.
Dead peer detection	Checks the peer is still alive using IKEv2 INFORMATIONAL exchanges or IKEv1 R_U_THERE messages. Only runs if no IKE or ESP/AH packet has been received for the configured delay. Set to disabled when unsure.

Setting

Encryption algorithm
Hash algorithm
DH group key
Lifetime
Dead peer detection

Phase 2 (Data session)

Setting	Description
SIM network	The subnet used by your SIM cards. Fixed, cannot be changed.
Remote network	The subnet on your side of the tunnel, in CIDR notation. Set to 0.0.0.0/0 to route all SIM traffic to your network.
ESP	Encapsulating Security Payload: handles encryption and authentication of tunnel traffic. Cannot be changed.
Encryption algorithm	Encrypts tunnel traffic. AES128-GCM (128-bit) is recommended.
Hash algorithm	Verifies tunnel traffic integrity. SHA256 is recommended. SHA1 is generally considered unsafe and should be avoided.
DH group key	Diffie-Hellman group for the data session. DH Group 14 (2048-bit) is recommended.
Lifetime	How long the data session lasts before re-keying, in seconds. Must be larger than the Phase 1 lifetime. Set one endpoint to this value and the other at least 10% higher to avoid overlap. Range: 1800–7200 seconds.