branch office 1

Create your ISAKMP pre-shared key. This key is used when initiating your VPN during phase one ISAKMP exchanges with your VPN peers. Share the value of this pre-shared key with all VPN peers that use it—in this example, the roaming VPN clients and the headquarters router. The router only uses this key during phase one ISAKMP exchanges.

create enco key=1 type=general value=<alphanumeric-preshared-key>

Enable ISAKMP.

ena isa

Like the headquarters policy (see comments on page 12) this example uses separate ISAKMP policies for each peer.

Create an ISAKMP policy for the VPN to headquarters, with a fixed address. Use ISAKMP heartbeats, which allow ISAKMP to clear SAs if either end of the link resets.

create isakmp pol=hq pe=200.200.200.1 sendd=true key=1 heart=both localid=branch1 encalg=3des2key

Create an ISAKMP policy for roaming VPN clients, with peer=any because the peers have dynamic addresses. Note that you cannot use heartbeats with Windows peers. We recommend that you enable NAT-T, because the roaming VPN clients will sometimes need to connect through a NAT-T gateway.

create isakmp pol=roaming pe=any key=1 sendd=true sendi=on natt=true localid=branch1

The roaming policy uses the same key as the policy for the headquarters VPN. If you want to, you can instead generate a unique pre-shared key to use with the roaming clients, and attach it to the roaming policy.

10. Configure the firewall’s basic settings

Enable the firewall and create a firewall policy.

enable firewall

create firewall policy=branch1

enable firewall policy=branch1 icmp_f=all

Specify the LAN-facing interface of the router as a private (trusted) interface on the firewall.

add firewall policy=branch1 int=vlan1 type=private

Specify the Internet-facing interface of the router as a public (not trusted) interface on the firewall.

add firewall policy=branch1 int=ppp0 type=public

Define a firewall dynamic definition to enable dynamically created interfaces to participate in the firewall. In this case, the definition provides for the dynamic PPP over L2TP interfaces that incoming Windows VPN connections use. In other words, when the router dynamically creates PPP interfaces over the L2TP connections from the roaming PC clients, the router automatically adds these dynamic interfaces as private interfaces on the firewall. The router

Page 21 AlliedWare™ OS How To Note: VPNs for Corporate Networks

Page 20 Page 22
Page 21
Image 21
Allied Telesis AR440S manual Add firewall policy=branch1 int=vlan1 type=private
Page 20 Page 22

AR440S specifications

Allied Telesis offers a range of advanced routers designed to meet the connectivity and operational needs of modern enterprises. Among its extensive lineup, the AR450S, AR441S, AR415S, AR442S, and AR440S models stand out for their robust features and technologies, making them ideal solutions for various networking environments.

The Allied Telesis AR450S is a high-performance router tailored for service providers and large enterprises. It supports advanced routing protocols, including IPv4 and IPv6, ensuring compatibility with both legacy and modern networks. The AR450S boasts substantial throughput capabilities, making it suitable for bandwidth-intensive applications. Its versatile WAN options, including Ethernet and cellular connectivity, allow seamless integration into diverse network architectures.

Next in the lineup is the AR441S, which focuses on providing enhanced security and reliability. With built-in firewall capabilities and VPN support, this model ensures secure communication over the internet. The AR441S also features numerous Ethernet ports for flexible connectivity, enabling organizations to scale their networks as needed. Its user-friendly interface facilitates straightforward configuration and management.

The AR415S is designed for branch offices and small to medium-sized enterprises. This router offers a balance of performance and affordability, equipped with essential features like Quality of Service (QoS) and traffic shaping. The AR415S supports multiple WAN connections, which helps in maintaining reliable internet access by auto-failing to backup connections when necessary.

The AR442S incorporates advanced networking technologies, including dynamic routing protocols and deep packet inspection. This model enhances performance by optimizing traffic flow and improving bandwidth utilization. Its support for VoIP and other multimedia applications makes it an excellent choice for organizations seeking to maximize their communication capabilities.

Lastly, the AR440S is engineered for high availability and redundancy. It includes dual power supplies and hot-swappable components, ensuring that network services remain uninterrupted during maintenance. The AR440S is particularly valuable in mission-critical environments where downtime can lead to significant business disruption.

In summary, the Allied Telesis AR series routers—AR450S, AR441S, AR415S, AR442S, and AR440S—offer a rich set of features tailored to various operational needs. With their advanced routing capabilities, security features, and reliable performance, these routers represent the cutting edge of networking technology for businesses looking to enhance their connectivity and operational efficiency.
Top Page Image Contents