Avaya BSGX4e User's Guide download pdf (Page 167)

BSGX4e Business Gateway User Guide 167

Release 01.01 NN47928-102

VPN Configuration

*> config interface ip vpn0 ip 192.168.100.1

6. Enable NAT on the tunnel interface by using the following command:

*> config security nat interface vpn0 status on

7. Define a default route for the tunnel interface by using the following command.

This route sends all traffic on the tunnel unless the traffic has another explicit

route. This also applies to VoIP traffic.

*> config route table 0.0.0.0 if vpn0

8. Configure the firewall to allow tunnel traffic.

9. Allow traffic from the LAN to the tunnel by using the following command:

*> config security policy new from eth1 to vpn0

10.Allow IKE negotiation (UDP traffic to port 500 from the remote gateway) by using

the following command:

*> config security policy new from eth0 to self sip

10.254.254.254 dport 500 proto udp

11.Allow IPsec traffic (ESP traffic from the remote gateway) by using the following

command:

*> config security policy new from eth0 to self sip

10.254.254.254 proto esp

12.Allow ICMP packets to come in from the tunnel by using the following command:

*> config security policy new from vpn0 to self proto icmp

13.Save the configuration by using the following command:

*> save

Configuring the ISP Gateway

For the tunnel to the ISP to be usable, you must configure the ISP gateway in a

compatible manner to accept the traffic from the BSGX4e and to forward it on.

If the ISP gateway (the remote gateway) is an BSG unit, you can use the following

commands as a starting point for its VPN configuration. The following example

assumes that the gateway address is 10.0.0.1.

1. Configure the VPN.

2. Specify the same preshared key used by the gateway at the other end of the

tunnel.

> config ike preshared 10.0.0.1 key x232skd234scefk3o

3. Configure the IPsec policy for the tunnel. Specify an IPsec proposal compatible

with VPN-A (ESP protocol, 3DES encryption, and SHA authentication).

*> config ipsec policy Tunnel gateway 10.0.0.1 prop VPN-A

local 192.168.100.2 remote 192.168.100.1

4. Determine the IP interface assigned to the tunnel by using the following

command:

1 2 ... 162 163 164 165 166 167 168 169 170 171 172 ... 455 456

No comments

Avaya BSGX4e User's Guide Page 167