Manuals / Allied Telesis / Computer Equipment / Network Router

Allied Telesis AR440S manual Create ipsec pol=internet int=ppp0 ac=permit

Models: AR440S

1 53
Download 53 pages 24.96 Kb
Page 20
Image 20

branch office 1

z(for site-to-site VPNs) 3DESOUTER as the encryption algorithm for ESP

z(for site-to-site VPNs) SHA as the hashing algorithm for ESP authentication

z(for roaming client VPNs) four possible variants of VPN encryption, for added flexibility. We propose the most secure option first.

Create an SA specification for the headquarters office site-to-site VPN. This SA specification uses tunnel mode by default.

create ipsec sas=1 key=isakmp prot=esp enc=3desouter hasha=sha

Create a group of SA specifications for the roaming VPN clients. These SA specifications use IPsec transport mode for Windows VPN interoperability. Multiple specifications allow IPsec to negotiate different levels of encryption to match what your version of the VPN client provides.

create ipsec sas=2 key=isakmp prot=esp enc=3desouter hasha=sha mod=transport

create ipsec sas=3 key=isakmp prot=esp enc=3desouter hasha=md5 mod=transport

create ipsec sas=4 key=isakmp prot=esp enc=des hasha=sha mod=transport

create ipsec sas=5 key=isakmp prot=esp enc=des hasha=md5 mod=transport

Create two IPsec bundles, one for the headquarters router VPN and one for the roaming VPN clients.

create ipsec bund=1 key=isakmp string="1"

create ipsec bund=2 key=isakmp string="2 or 3 or 4 or 5"

Create IPsec policies to bypass IPsec for ISAKMP messages and the “port floated” key exchange that NAT-T uses.

create ipsec pol=isakmp int=ppp0 ac=permit lp=500 rp=500

create ipsec pol=isakmp_float int=ppp0 ac=permit lp=4500

Create an IPsec policy for the VPN traffic between headquarters and branch office 1. Identify the traffic by its local and remote addresses—in this example the subnet used on the LAN at branch office 1 (local) is 192.168.141.0/24. Note that the remote address selector is wider than the headquarter’s LAN; in fact, we cover all site subnets with this supernet.

create ipsec pol=hq int=ppp0 ac=ipsec key=isakmp bund=1 peer=200.200.200.1 isa=hq lad=192.168.141.0 lma=255.255.255.0 rad=192.168.0.0 rma=255.255.0.0

Create another IPsec policy for roaming VPN clients to access headquarters. Identify the traffic by the L2TP port (UDP traffic to port 1701). This policy uses peeraddress=any. The any option allows simultaneous VPN clients to be set up under the policy.

create ipsec pol=roaming int=ppp0 ac=ipsec key=isakmp bund=2 peer=any isa=roaming lp=1701 tra=udp

Create another IPsec policy for direct Internet traffic from the headquarters LAN to the Internet, such as web browsing.

create ipsec pol=internet int=ppp0 ac=permit

Note: The order of the IPsec policies is important. The Internet permit policy must be last.

Page 20 AlliedWare™ OS How To Note: VPNs for Corporate Networks

Page 19 Page 21
Page 20
Image 20
Allied Telesis AR440S manual Create ipsec pol=internet int=ppp0 ac=permit
Page 19 Page 21

AR440S specifications

Allied Telesis offers a range of advanced routers designed to meet the connectivity and operational needs of modern enterprises. Among its extensive lineup, the AR450S, AR441S, AR415S, AR442S, and AR440S models stand out for their robust features and technologies, making them ideal solutions for various networking environments.

The Allied Telesis AR450S is a high-performance router tailored for service providers and large enterprises. It supports advanced routing protocols, including IPv4 and IPv6, ensuring compatibility with both legacy and modern networks. The AR450S boasts substantial throughput capabilities, making it suitable for bandwidth-intensive applications. Its versatile WAN options, including Ethernet and cellular connectivity, allow seamless integration into diverse network architectures.

Next in the lineup is the AR441S, which focuses on providing enhanced security and reliability. With built-in firewall capabilities and VPN support, this model ensures secure communication over the internet. The AR441S also features numerous Ethernet ports for flexible connectivity, enabling organizations to scale their networks as needed. Its user-friendly interface facilitates straightforward configuration and management.

The AR415S is designed for branch offices and small to medium-sized enterprises. This router offers a balance of performance and affordability, equipped with essential features like Quality of Service (QoS) and traffic shaping. The AR415S supports multiple WAN connections, which helps in maintaining reliable internet access by auto-failing to backup connections when necessary.

The AR442S incorporates advanced networking technologies, including dynamic routing protocols and deep packet inspection. This model enhances performance by optimizing traffic flow and improving bandwidth utilization. Its support for VoIP and other multimedia applications makes it an excellent choice for organizations seeking to maximize their communication capabilities.

Lastly, the AR440S is engineered for high availability and redundancy. It includes dual power supplies and hot-swappable components, ensuring that network services remain uninterrupted during maintenance. The AR440S is particularly valuable in mission-critical environments where downtime can lead to significant business disruption.

In summary, the Allied Telesis AR series routers—AR450S, AR441S, AR415S, AR442S, and AR440S—offer a rich set of features tailored to various operational needs. With their advanced routing capabilities, security features, and reliable performance, these routers represent the cutting edge of networking technology for businesses looking to enhance their connectivity and operational efficiency.