Patton electronic 2800 user manual VPN configuration task list, Transport and tunnel modes

Page 69

OnSite 2800 Series User Manual

6 • VPN configuration

 

 

Transport and tunnel modes

The mode determines the payload of the ESP packet and hence the application:

Transport mode: Encapsulates only the payload of the original IP packet, but not its header, so the IPsec peers must be at the endpoints of the communications link.

A secure connection between two hosts is the application of the transport mode.

Tunnel mode: Encapsulates the payload and the header of the original IP packet. The IPsec peers can be (edge) routers that are not at the endpoints of the communications link.

A secure connection of the two (private) LANs, a ‘tunnel’, is the application of the tunnel mode.

VPN configuration task list

To configure a VPN connection, perform the following tasks:

Creating an IPsec transformation profile

Creating an IPsec policy profile

Creating/modifying an outgoing ACL profile for IPsec

Configuration of an IP Interface and the IP router for IPsec

Displaying IPsec configuration information

Debugging IPsec

Creating an IPsec transformation profile

The IPsec transformation profile defines which authentication and/or encryption protocols, which authentica- tion and/or encryption algorithms shall be applied.

Procedure: To create an IPsec transformation profile

Mode: Configure

mac-sha1-96 }Enables authentication and defines the authentication protocol and the hash algorithm

Step

Command

Purpose

 

 

 

1

node(cfg)#profile ipsec-transform name

Creates the IPsec transformation profile name

2

node(pf-ipstr)[name]#esp-encryption {

Enables encryption and defines the encryp-

optional

aes-cbc des-cbc 3des-cbc } [key-length]

tion algorithm and the key length

 

 

 

3

node(pf-ipstr)[name]#{ ah-authentication

Enables authentication and defines the

optional

esp-authentication } {hmac-md5-96

authentication protocol and the hash algo-

 

hmac-sha1-96 }

rithm

 

 

 

Use no in front of the above commands to delete a profile or a configuration entry.

Example: Create an IPsec transformation profile

The following example defines a profile for AES-encryption at a key length of 128.

2800(cfg)#profile ipsec-transform AES_128 2800(pf-ipstr)[AES_128]#esp-encryption aes-cbc 128

VPN configuration task list

69

Image 69
Contents Managed VPN Router Mailsupport@patton.com Summary Table of Contents Table of Contents Getting started with the OnSite Managed VPN Router VPN configuration LEDs status and monitoring 112 Cabling 124 OnSite 2800 Series factory configuration 132 List of Figures List of Tables About this guide AudienceStructure Impaired functioning PrecautionsSafety when working with electricity General observations General conventions Typographical conventions used in this documentGeneral information Chapter contentsOnSite Managed VPN Router 2805 shown OnSite Model 2800 Series overviewOnSite 2800 Series model codes OnSite 2800 Series detailed descriptionDMZ Model code extensions OnSite 2800 Series power input connectorsOnSite 2800 Series rear-panel ports are described in table Ports descriptionsApplications overview Corporate multi-function virtual private network Corporate multi-function virtual private networkGeneral information Hardware installation Create a network diagram see section Network information on Planning the installationInstallation checklist Site log Power sourceNetwork information IP related informationConnecting cables Installing the VPN routerInstalling the Ethernet cable Location and mounting requirementsConnecting an OnSite 2800 Series device to a hub Installing the serial WAN cableDCD Hardware installation Rear panel of 2803K/EUI Rear panel of 2803K/UI Pins not listed are not usedPower connector location on rear panel Connecting to external power sourceUI and EUI power supplies automatically adjust to accept an Getting started with the OnSite Managed VPN Router Introduction Configure IP addressPower connection and default configuration Configure IP addressAll Ethernet interfaces are activated upon power-up Terminal emulation program settings 9600 bps No parity BitSelect the context IP mode to configure an IP interface LoginStop bit No flow control Changing the IP addressLoad configuration Connect the OnSite VPN Router to the networkRespectively from the host ping Load configuration Serial port configuration Disabling an interface Serial port configuration task listEnabling an interface Configuring the encapsulation for Frame Relay Example Configuring the serial encapsulation typePort Configuring the LMI type Enter Frame Relay modeEntering Frame Relay PVC configuration mode Configuring the keep-alive intervalBinding the Frame Relay PVC to IP interface Configuring the PVC encapsulation typeMode PVC Disabling a Frame Relay PVC Enabling a Frame Relay PVCCRC Displaying serial port informationDlci Displaying Frame Relay informationIntegrated service access Port Configure the serial interface settingsCheck that the Frame Relay settings are correct Configure the introduced PVCsT1/E1 port configuration Enable/Disable T1/E1 port T1/E1 port configuration task listConfiguring T1/E1 port-type Mode port e1t1 slot portConfiguring T1/E1 clock-mode Configuring T1/E1 line-codeConfiguring T1/E1 line-build-out T1 only Configuring T1/E1 framingConfiguring T1/E1 used-connector E1 only Name prt-e1t1 slot/port# framingConfiguring T1/E1 LOS threshold Configuring T1/E1 application modeConfiguring T1/E1 encapsulation Default short-haulConfiguring Channel-Group Timeslots Be used Mode port e1t1 slot portMode channel-group group-name Configuring Channel-Group EncapsulationConfiguring Hdlc Encapsulation Configuring Hdlc CRC-TypeT1/E1 Configuration Examples Default no encapsulationExample 1 Frame Relay without a channel-group Example 2 Framerelay with a channel-group Example 3 PPP without a channel-groupExample 4 PPP with a channel-group VPN configuration Encryption AuthenticationVPN configuration task list Transport and tunnel modesCreating an IPsec transformation profile Creating an IPsec policy profile Procedure To create an IPsec policy profileNodecfg#profile ipsec-policy-man Creating/modifying an outgoing ACL profile for IPsec Displaying IPsec configuration information Configuration of an IP interface and the IP router for IPsecExample Display IPsec policy profiles Example Display IPsec transformation profilesDebugging IPsec Example IPsec Debug OutputSample configurations OnSite configurationIPsec tunnel, DES encryption Cisco router configuration Cisco router configuration VPN configuration Access control list configuration About access control lists What access lists doWhy you should configure access lists Features of access control lists When to configure access listsMapping out the goals of the access control list Access control list configuration task listNodepf-acl name#permit ip src src-wildcard any Src-wildcard Where the syntax isType type type type code code cos group Nodepf-acl name#permit icmp src src-wildcard anyNodepf-acl name#deny icmp src src-wildcard Any host src dest dest-wildcard any host destMsg name Where the syntax is as followingCard any host src eq port gt port lt port range Nodepf-acl name#permit tcp udp sctp src src-wildPort lt port range from to cos group cos-rtp group Nodepf-acl name#deny tcp udp sctp src srcGroup-data Where the syntax is Unbind an access control list profile from an interface Displaying an access control list profileDebugging an access control list profile Control list profile shall be debugged Denying a specific subnet ExamplesLink scheduler configuration Configuring access control lists Configuring quality of service QoS Using traffic classesApplying scheduling at the bottleneck Weighted fair queuing WFQ Introduction to SchedulingPriority Shaping Burst tolerant shaping or wfqHierarchy Setting the modem rate Quick referencesSome explanations Command cross reference Link scheduler configuration task listPacket classification Defining the access control list profileScenario with Web server regarded as a single source host Creating an access control listNodecfg#profile acl name Creating a service policy profileNodepf-acl name#permit ip host ip-address any traffic-class Nodepf-acl name#permit ip any anyStructure of a Service-Policy Profile Specifying the handling of traffic-classes Defining fair queuing weightDefining the bit-rate Specifying the type-of-service TOS fieldDefining absolute priority Defining the maximum queue lengthSpecifying the precedence field Specifying differentiated services codepoint Dscp markingNodesrc name#set ip tos value Nodesrc name#set ip precedence valueSpecifying layer 2 marking Nodesrc name#set ip dscp valueNodesrc name#set layer2 cos value Defining random early detection Discarding Excess LoadNodesrc name#random-detect burst-tolerance Devoting the service policy profile to an interface Nodeif-ip if-name#use profile servicePolicy name in out Enable statistics gathering Displaying link arbitration statusDisplaying link scheduling profile information Values defining detail of the queuing statistics LEDs status and monitoring Status LEDs Contacting Patton for assistance Warranty coverage Contact informationPatton Support Headquarters in the USA Returns for credit Out-of-warranty serviceReturn for credit policy RMA numbersAppendix a Compliance information Compliance SafetyRadio and TV Interference FCC Part CE Declaration of ConformityAuthorized European Representative FCC Part 68 Acta Statement Model 2803 onlyIndustry Canada Notice Model 2803 only Appendix B Specifications Sync serial interface Ethernet interfacesT1/E1 interface Model 2803 only PPP supportDimensions IP servicesManagement Operating environmentPower supply Internal power supply 100-240 VAC, 50/60 Hz, 200 mAInternal AC version Appendix C Cabling Serial console Connecting a serial terminalEthernet cross-over Ethernet 10Base-T and 100Base-TEthernet straight-through Appendix D Port pin-outs EIA-561 RJ-45 8-pin port RS-232 Console Port Console port, RJ-45, EIA-561 RS-232Sync serial port Ethernet 10Base-T and 100Base-T portEthernet ports are auto-detect MDI-X Serial port21 Female DB-15 connector Appendix E OnSite 2800 Series factory configuration OnSite 2800 Series factory configuration Appendix F Installation checklist Installation checklist
Related manuals
Manual 8 pages 44.23 Kb