LogoLogo
GoodAccess WebsiteRequest Free TrialDownload App
  • Getting Started
    • 1. What is GoodAccess?
    • 2. Architecture Overview
    • 3. Sign up for Free Trial
    • 4. Download App & Connect
  • 🖥️Configuration guides
    • Features
      • Zero Trust Access Control
        • Access Cards
        • Device Posture Check
        • Device Approval
        • Geo Restrictions
      • API Integration
        • API Reference
          • Members
          • Groups
          • Systems
          • Access Cards
          • Relations
          • Gateways
          • Logs
        • Acronis Integration
      • SIEM Integration
      • SSO/SCIM
        • Auth0
        • Cisco Duo
        • Google Workspace
        • JumpCloud
        • Microsoft Entra ID
        • Okta
        • OneLogin
        • Ping Identity
        • Universal (SAML)
      • MFA
      • Passkeys
      • MSI deployment
      • Threat Blocker
      • Custom Domain Blocking
      • DNS Management
      • Split Tunneling
      • Port Forwarding
    • Branch Connector
      • Cisco
      • Cisco Meraki
      • FortiGate
      • MikroTik
      • SonicWall
      • UniFi USG
      • Zyxel Nebula Control Center
      • Other supported routers and firewalls
    • Cloud Connector
      • AWS
      • Google Cloud
      • Microsoft Azure
      • Other Public Cloud providers
    • IP whitelisting
      • APACHE Web Server
      • AWS VPC
      • Azure (Office 365)
      • Google Cloud
      • Google Workspace
      • Magento
      • Microsoft IIS
      • NGINX
        • Domain
        • Subdomain
        • URL
      • OpenCart
      • PHP
      • PHPMyAdmin
      • Pipedrive
      • SalesForce
      • SSH server
      • WordPress
      • Zoho CRM
    • Linux
      • DEB repository
      • RPM repository
      • Manual installation
      • Linux Troubleshooting
  • 🆘FAQ & Troubleshooting
    • FAQ
      • Business
      • Technical
    • Troubleshooting
  • 📓Product Changelog
    • Windows
    • macOS
Powered by GitBook
On this page
  • Step 1 - Creating a new branch connection
  • Step 2 - Creating a new site-to-site connection
  • Network Configuration
  • Advanced

Was this helpful?

  1. Configuration guides
  2. Branch Connector

UniFi USG

This guide will show you how to connect your UniFi device to the GoodAccess Gateway via a site-to-site connection using the IPsec protocol.

PreviousSonicWallNextZyxel Nebula Control Center

Last updated 3 months ago

Was this helpful?

Step 1 - Creating a new branch connection

Click + Add new, enter the Branch name and subnet, and select Gateway.

Choose IPSec Protocol, fill out the Settings configuration form, and click Save.

You may return to the configuration via the Edit button of your Branch at any time.

Example of configuration (Default preset):

  • Cloud/Branch subnet - Subnet of your local network

  • Shared Secret - Create a new strong password

  • Public IP - IP of your UniFi

  • IKE Lifetime (Phase 1) - 8 hours (28800 seconds)

  • Tunnel Lifetime (Phase 2) - 1 hour (3600 seconds)

  • Dead Peer Detection Delay - 30 seconds

  • Encryption (Phase 1) - aes256

  • Encryption (Phase 2) - aes256

  • Integrity (Phase 1) - sha256

  • Integrity (Phase 2) - sha256

  • Diffie-Hellman Groups (Phase 1) - 16 - modp4096

  • Diffie-Hellman Groups (Phase 2) - 16 - modp4096

Step 2 - Creating a new site-to-site connection

Give the VPN a name and set the configuration as follows:

  • VPN Type - IPsec

  • Remote IP / Host - IP of your GoodAccess Gateway

Network Configuration

  • VPN Type - Route Based

  • Remote Network(s) - Static + Subnet of your GoodAccess Gateway

Advanced

Switch to Manual, and set the configuration as follows:

  • Key Exchange Version - IKEv2

  • IKE (Phase 1)

    • Encryption - AES-256

    • Hash - SHA256

    • DH Group - 16

    • Lifetime - 28800

  • ESP (Phase 2)

    • Encryption - AES-256

    • Hash - SHA256

    • DH Group - 16

    • Lifetime - 3600

  • Perfect Forward Secrecy (PFS) - Enabled

Click Add.

You have now successfully connected your device to GoodAccess.

UniFi automatically creates the necessary firewall rules and static routes.

You may check the status of the connection in:

  • GoodAccess - Control Panel > Clouds & Branches > Edit button > Test connection

  • UniFi - Settings > VPN > Site-to-Site VPN

Log in to the , and go to Settings > VPN > Site-to-Site VPN.

Pre-Shared Key - Shared Secret

Must match configuration from GoodAccess .

🖥️
Log in to the GoodAccess Control Panel, and go to Network > Clouds & Branches.
UniFi management interface
(Step 1)
(Step 1)