0

Evaluating the capabilities of the UniFi Dream Machine Pro all-in-one enterprise security gateway & network appliance (UDM Pro), I was wondering whether this site-to-site setup is possible:

Site-to-site setup

Setup context

Setup goals

  • The three networks behind the Ubiquiti routers should be connected via site-to-site VPN, e.g. IPSec.
  • All UniFi devices, i.e. the Access Points (APs), the UDM Pro, and the USG, should be controlled by the UniFi controller on the UDM Pro.

Some observations

  • IPSec between several EdgeRouters only (without ISP routers, without UniFi routers) does work, but the UDM Pro interface did not allow to enter dynamic DNS names as IPSec peers.
  • When adding the ISP routers with port forwarding (UDP 500 and 4500), I think I would need to tell the EdgeRouters to use their dynamic public IPs when establishing IPSec for authentication, but I'm not sure if I can do this in the GUI.
  • From what I've seen, the USG and the UDM Pro would support dynamic DNS when using OpenVPN rather than IPSec, but the EdgeRouter does not support OpenVPN from the GUI.
  • The most uncertain thing to me is whether I can use the UDM's UniFi controller through the tunnel, especially because the UDM Pro is an appliance and I'm unsure whether it would support controlling multiple sites, or be controlled by an external UniFi controller.
Improve this question
4
  • 1
    Why is your business using ISP routers? Your business should have its own routers to connect to the Internet. You want the public addressing on your routers, not routers you do not own or control. Also, your business should have static IP addresses, not dynamic.
    – Ron Maupin ♦
    Nov 20, 2020 at 15:07
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Dec 31, 2020 at 3:57
  • @Ron Maupin: I think, Ron Trunk's answer is technically a workaround as it does not meet all context requirements posted in the question. I ended up using a different workaround myself, which I will post as an additional answer. But I haven't found a solution that meets all requirements, yet. Do you think I should then just accept one of the answers or should we keep the question open? As I didn't know whether the problem is solvable, I've phrased the question "is … possible?" rather than "how can I …?". Thanks for the follow-up!
    – fiedl
    Jan 4, 2021 at 21:03
  • Both (ISP router, dynamic IPs) are temporary requirements for a transitional period. For example, the ISP routers are used to support a legacy phone system in this setup.
    – fiedl
    Jan 4, 2021 at 21:06

3 Answers 3

Reset to default
1

It's possible, but first you need static IP addresses. You can ask your ISPs to give you static addresses (for a fee, of course).

The most uncertain thing to me is whether I can use the UDM's UniFi controller through the tunnel...

Once you establish the tunnels, they essentially become transparent to the devices. Baring latency problems, your controllers can't tell the difference if you're using VPN tunnels or not.

Improve this answer
3
  • Thank you. I've also thought about suggesting static IPs. Are they required at all sites or only at one of the sites for the IPSec auth to succeed? Or is this just due to the limitations of the GUIs of the USG and the UDM?
    – fiedl
    Nov 20, 2020 at 17:00
  • As it turns out, static IPs are only required due to the limitations of the UDM GUI. They are not a requirement of IPSec. When configuring IPSec manually or using different routers (e.g. EdgeRouters or routers with pfSense software), dynamic IPs may be used for all three sites.
    – fiedl
    Jan 4, 2021 at 21:11
  • Note: Using the UDM UniFi controller through the IPSec tunnel works fine. The only drawback is that the UDM software does not support multiple sites, which means that all unifi devices will be shown in one site in this setup.
    – fiedl
    Jan 4, 2021 at 21:13
0

As this question still receives views and comments, I just wanted to give a quick update. While I obviously agree with Ron that this is a non-desirable setup, we needed to implement something as a quick, but temporary measure to deal with a local ISP issue and some challenges of the home-office situation.

Solution 1: Manual Configuration

IPSec itself does, of course, support dynamic addresses. The issue is just that the UDM user interface does only allow static IPs as addresses. Configuring the IPSec connection manually on the UDM file system, does work however.

# UDM
# /run/strongswan/ipsec.d/tunnels/3c5d_095e_4516_2e4a.ipsec.s2s.config

conn 3c5d_095e_4516_2e4a

  auto=route
  authby=secret
  type=tunnel

  left=%any
  leftid=dynamic2.example.com
  right=dynamic1.example.com
  rightid=dynamic1.example.com

  leftsubnet=192.168.24.0/24
  rightsubnet=192.168.26.0/24

  ## phase 1 (IKE) ##
  keyexchange=ikev1
  aggressive=no
  ike=aes128-sha1-modp2048!
  reauth=yes
  ikelifetime=28800s

  ## phase 2 (ESP) ##
  esp=aes128-sha1!
  rekey=yes
  keylife=3600s
  keyingtries=%forever

However, this configuration file is deleted or overwritten and lost on UDM reboot and firmware updates, which is why we've dropped this solution.

Solution 2: Adding ER-X

Because the Ubiquiti Edge Routers all support dynamic addresses, we've just replaced the USG with an ER-X-SFP, and also added an ER-X-SFP between the ISP router and the UDM. This way, the ER-X routers could handle the IPSec connections, and the rest (including the unifi controller) could be done on the UDM.

modified network layout

This requires no modifications of the configuration files at all; the IPSec connection can just be configured as usual through the Edge Routers' user interfaces. https://help.ui.com/hc/en-us/articles/115012831287

Remarks

I would personally consider the artificial requirement of static addresses a shortcoming of the UDM, but as this is not a common use case, I guess the UDM is just not made for this. (Usually, when requiring non-streamline configurations, I'm going for a pfSense device.)

What really went well, however, was the exposure of the unifi controller on the UDM through the IPSec VPN, making adding more and more unifi access points on all sites easy.

Improve this answer
-1

Maybe this could help you achieve your goal. Doesn't explain the part with udm pro, but pretty sure this would be similar.

https://community.ui.com/questions/Unifi-site-to-site-vpn-with-dynamic-IPs-behind-a-double-nat/fafcc2ba-22fb-4166-a019-c73c99d804f3

Improve this answer
1
  • Since SE aims at compiling a comprehensive question-and-answer database, a simple link isn't useful here. Please leave the link for reference but you'll need to extract and include vital steps for a solution in your answer.
    – Zac67 ♦
    Mar 18, 2022 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.