RUT901 7.18.3 IPsec tunnel

Networking Solutions
1

Having problems trying to create a IPsec tunnel between two teltonikas.

The final product should look something like this.

image
image1087×602 154 KB

The problem is on the “HUB” end of the tunnel the status is up and on the “SPOKE” end the status stays disconnected and we cant find the solution to get these communicating.

image
image1247×180 21.1 KB

image
image1272×190 20 KB

image

Pictures from the “hub” config

hubi1
hubi1908×536 24.8 KB

hubi2
hubi2923×553 25.9 KB

hubi3
hubi3921×550 27.8 KB

hubi4
hubi4740×535 24.2 KB

hubi6
hubi61067×486 21.1 KB

hubi7
hubi71118×545 21.5 KB

Pictures from the “spoke” config

image
image900×542 25 KB

ipsec2
ipsec21067×555 19.3 KB

ipsec3
ipsec3930×542 27.9 KB

ipsec6
ipsec61075×493 21.3 KB

ipsec7
ipsec71100×518 20.9 KB

1 Like
2

Greetings, @Oskari,

Welcome to the Teltonika Community!

Thank you for the detailed screenshots of your configuration.

From what I can see in your IPsec setup the addresses that you put as public IP seems to be private in order for this setup to work you need at least one public IP address, to check your public IP address you can simply go to whatismyipaddress.com . Additionally, there are no remote endpoint and subnet defined in the “hub”, and in the “spoke” there are no local and remote identifiers configured. For an IPsec tunnel to be established and for traffic to route properly, both sides must correctly identify one another and have matching addressing and subnet settings. Without these key parameters, the tunnel cannot form correctly.

Specifically:

  • The hub must have the remote endpoint (public IP of the spoke) defined.
  • Both sides should have matching Local identifier and Remote identifier values that correspond to each other’s LAN IPs or identifiers.
  • Local subnet and Remote subnet fields should reflect the networks you intend to connect on each side.

For reference and guidance, you can review the official IPsec configuration example here:

https://wiki.teltonika-networks.com/view/IPsec_RUTOS_configuration_example

This example includes complete settings for both ends of a tunnel, including identifiers, subnets, and relevant fields required for a successful tunnel.

A few additional considerations that often help with troubleshooting IPsec tunnels:

  • Make sure the encryption and hashing proposals (Phase 1 and Phase 2) match exactly on both sides of the tunnel. Mismatched proposals are a common cause of IPsec negotiation failure.
  • Once configured, you can verify tunnel status using ipsec status or ipsec statusall via the CLI to confirm a successful IKE/IKEv2 negotiation.

Please update your configuration to include the missing identifiers and subnet definitions, and let me know how it goes.

Warm regards,
V.