IPsec VPN

Configure the local firewall to connect to Complement over IPsec. Start with the VPN Overview if the setup questions haven’t been answered yet.

Config Sheet

The Complement side is an AWS Site-to-Site VPN with two tunnels. The config sheet lists both tunnel endpoint IPs, a preshared key and inside tunnel addresses for each, and the Complement network range. With BGP, it also lists the Complement ASN. Two tunnels let one go down for AWS maintenance without dropping the connection. The preshared keys are sent through a one-time secure link.

Configure the Firewall

Configure both tunnels if the firewall supports it. Use a route-based VPN, sometimes called a tunnel interface or VTI, and route the Complement network range over the tunnels. Complement traffic can arrive on either tunnel, so allow it on both.

A policy-based VPN supports only one local subnet. If Complement needs to reach more than one, use a route-based VPN or contact Complement first.

Setting	Value
IKE version	IKEv2
Authentication	Preshared key, one per tunnel
Phase 1 encryption	AES-256 (CBC)
Phase 1 integrity and PRF	SHA-256
Phase 1 DH group	14
Phase 1 lifetime	28800 seconds
Phase 2 encryption	AES-256 (CBC)
Phase 2 integrity	SHA-256
PFS group	14
Phase 2 lifetime	3600 seconds
Local ID	Public IP of the local firewall
Remote ID	Complement tunnel IP
Dead peer detection	On
TCP MSS clamping	1379

Allow UDP 500, UDP 4500, and ESP from both tunnel IPs. Enter each setting by hand. Firewall presets labeled AWS often default to older algorithms that the Complement tunnels reject. A mismatch on any value keeps the tunnel down. If the firewall can’t use these settings, contact Complement to adjust them.

Troubleshooting

Issue	Possible Cause	Solution
Phase 1 fails	IKE version, encryption, integrity, or DH group doesn’t match, or the preshared key or remote ID is wrong	Enter each value from the settings table by hand rather than using a preset
Phase 2 fails	PFS group or traffic selectors don’t match	Set PFS to group 14. On a policy-based VPN, use one local subnet and the Complement range
Small requests work but file transfers hang	Packets are too large for the tunnel	Set TCP MSS clamping to 1379 on the tunnel
Tunnel drops every few hours	The public IP changed, or dead peer detection is off	Use a static public IP and turn on dead peer detection
Tunnel is up but a host doesn’t answer	A firewall rule is missing, the host’s own firewall blocks the port, or the host is outside the subnet provided to Complement	Allow the Complement network range on that port, on the firewall and on the host, such as Windows Defender Firewall
Office internet slows down or breaks	The tunnel is routing all traffic	Route only the Complement network range through the tunnel