From 3eee7601f947fd5aff94d45276f520c5e4a4639e Mon Sep 17 00:00:00 2001
From: Nicole Rappe <cyberstrawberry101@gmail.com>
Date: Fri, 26 Jan 2024 18:16:14 -0700
Subject: [PATCH] Update Networking/Sophos/IPSec Site-to-Site VPN Tunnel.md

---
 .../Sophos/IPSec Site-to-Site VPN Tunnel.md     | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/Networking/Sophos/IPSec Site-to-Site VPN Tunnel.md b/Networking/Sophos/IPSec Site-to-Site VPN Tunnel.md
index b1b3582..bfa5b4a 100644
--- a/Networking/Sophos/IPSec Site-to-Site VPN Tunnel.md	
+++ b/Networking/Sophos/IPSec Site-to-Site VPN Tunnel.md	
@@ -39,17 +39,22 @@ Navigate to "**Configure > Site-to-Site VPN > Add**"
 !!! tip "Best Practices - Initiators / Responders"
     If you have a hub-and-spoke network, where one location acts as a central authority (e.g. domain controllers, auth servers, identity providers, headquarters, etc), you will set up the central "hub" as a VPN responder on its side of the VPN tunnel, and all the remote "spoke" locations would behave as VPN initiators.
 
+!!! note "Tunnel IDs / Subnets"
+    If one side of the tunnel indicates a Local ID, you need to input that as the Remote ID on the other end of the tunnel.  While Tunnel IDs are generally optional, if one side uses them, both need to.
+
+    - "Route-Based" VPNs do not need subnets indicated / configured
+    - "Policy-based" VPNs require subnets indicated / configured
+
 ## Configure IPSec Encryption Profile
 Navigate to "**System > Profiles > IPSec Profiles > Custom_IKEv2_`<Initiator>/<Responder>`**"
 
 | **Field** | **Value** |
 | :--- | :--- |
-| Listening Interface | `<WAN Interface / Generally "Port2">` (*Internal IP Address*) |
-| Gateway Address | `<Public IP of Remote Firewall>` |
-| Local ID Type | `IP Address` | 
-| Remote ID Type | `<If the Remote Firewall has one, enter it, otherwise leave blank>` |
-| Local Subnet | `<Leave Blank>` |
-| Remote Subnet | `<Leave Blank>` |
+| Phase 1 Lifetime | `<Longer Lifetime Compared to Phase 2>` (*If Initiator*) |
+| Phase 2 Lifetime | `<Shorter Lifetime Compared to Phase 1>` (*If Initiator*) |
+
+!!! warning "Remote / Local Phase Lifetimes"
+    Within the context of the remote and local VPN tunnels, the lifetime of the Phase 1 and Phase 2 encryption keys needs to be shorter on the intiator than the responder sides of the VPN tunnel.
 
 ## Connect the IPSec tunnels
 Now you need to start the tunnel on the Initiator side first, then start the tunnel on the responder side.  If both sides show green status indicators, the tunnel should be active.