Avaya BSGX4e User's Guide download pdf (Page 161)

BSGX4e Business Gateway User Guide 161

Release 01.01 NN47928-102

VPN Configuration

The configuration of an IPsec policy also configures an IP interface for the policy.

The IP interface is assigned a name vpnn, such as vpn0, and requires configuration

like any other IP interface.

IPsec Policy Requirements

 The IP address of the remote secure gateway in an IPsec policy must also appear

as the peer in an IKE preshared key record.

 The VPN interface must be assigned an IP address.

 A route must send traffic to the VPN interface.

 A firewall policy must allow traffic on the VPN interface.

 A firewall policy must allow ESP traffic from the remote secure gateway. (IP

packets sent from the remote secure network to the local secure network are

encrypted as ESP packets.)

 A firewall policy must allow IP packets sent from the local secure network to the

remote secure network. Otherwise, ESP packets cannot be routed to the remote

secure gateway.

For examples of commands that carry out these policy requirements, see “VPN

Configuration Examples” (page 163).

NOTE: By default, the Intrusion Detection Service (IDS) trusts a VPN interface

that has been assigned an IP address and does not attempt to detect

spoof attacks in its traffic. For more information, see “Spoof

Protection” (page 147).

Configure IPsec Policy Command

The IPsec policy defines the IP addresses for the VPN, including the address of the

remote gateway and the local and remote subnets secured by the VPN. An incoming

packet whose source address matches a secure local IP address, and whose

destination address matches a secure remote IP address, is encrypted and forwarded

to the gateway address.

To configure an IPsec policy, enter the following command:

> config ipsec policy

Table 60 describes the parameters for config ipsec policy.

Table 60. IPsec Policy Parameters

Parameter Description

[name] Name for this VPN.

gateway IP address of the remote gateway.

local Local IP addresses secured by the VPN (any or addresses

specified as a range or as a subnet).

1 2 ... 156 157 158 159 160 161 162 163 164 165 166 ... 455 456

No comments

Avaya BSGX4e User's Guide Page 161