Site-to-Site VPN: IPsec Best Practices

Site-to-site IPsec VPNs link branches, partners and cloud networks across the internet. They are mature technology, but small configuration choices make a big difference to security and stability.

Use IKEv2

IKEv2 is more robust and efficient than IKEv1, recovers faster from interruptions and is supported by all major firewalls and cloud gateways.

Choose strong cryptography

• AES-GCM (128 or 256-bit) for encryption
• SHA-256 or stronger for integrity where GCM is not used
• Diffie-Hellman groups 19, 20 or 21 (elliptic curve) or 14 at minimum, with Perfect Forward Secrecy enabled
• Retire DES, 3DES, MD5 and DH groups 1, 2 and 5

Prefer certificates

Certificate-based authentication is stronger than pre-shared keys and easier to manage at scale. If you must use pre-shared keys, make them long, random and unique per tunnel.

Build in resilience

• Run two tunnels to different gateways or over different ISPs
• Use route-based VPNs with BGP or dead-peer detection so failover is automatic
• Set the MTU and TCP MSS correctly to avoid fragmentation problems

Monitor

Alert on tunnel state, re-key failures and latency, and review logs for unexpected peers.

Our engineers design and manage VPNs for offices and clouds. See our VPN service or get your tunnels reviewed.