branch office 1

# ISAKMP Configuration

create isakmp pol=hq pe=200.200.200.1 key=1 sendd=true heart=both

set isa pol=hq localid=branch1 encalg=3des2key

create isakmp pol=roaming pe=any key=1

set isa pol=roaming sendd=true sendi=true natt=true localid=branch1

enable isakmp

# FIREWALL configuration

enable firewall

create firewall policy=branch1

enable firewall policy=branch1 icmp_f=all

#Define a firewall dynamic definition to work with dynamic

#interfaces. This provides for the dynamic PPP/L2TP interfaces that

#incoming Windows VPN connections use.

create firewall policy=branch1 dy=roaming

add firewall policy=branch1 dy=roaming user=any

#Specify the private and public interfaces. The roaming interface is

#private - you can trust it because it comes from an authenticated

#Windows VPN connection.

add firewall policy=branch1 int=vlan1 type=private

add firewall policy=branch1 int=dyn-roaming type=private

add firewall policy=branch1 int=ppp0 type=public

#Create a NAT definition for traffic from the branch office 1 LAN to

#use when accessing the Internet.

add firewall poli=branch1poli=branch1 nat=enhanced int=vlan1 gblin=ppp0

#Create another NAT definition for roaming VPN clients to use when

#accessing the Internet via the branch office 1 router.

add firewall poli=branch1 nat=enhanced int=dyn-roaming gblin=ppp0

#Create a rule to allow incoming ISAKMP negotiation to pass through

#the firewall.

add firewall poli=branch1 ru=1 ac=allo int=ppp0 prot=udp po=500 ip=222.222.222.1 gblip=222.222.222.1 gblp=500

#Create a rule to support NAT-T. If there is a NAT gateway in the

#VPN path, NAT-T "port floats" IKE to port 4500, and also

#encapsulates IPsec inside the same port.

add firewall poli=branch1 ru=2 ac=allo int=ppp0 prot=udp po=4500 ip=222.222.222.1 gblip=222.222.222.1 gblp=4500

#Create a rule for the roaming VPN clients. Windows uses L2TP (port

#1701) inside IPsec. This rule allows traffic that comes from IPsec

#and uses port 1701.

add firewall poli=branch1 ru=3 ac=allo int=ppp0 prot=udp po=1701 ip=222.222.222.1 gblip=222.222.222.1 gblp=1701 enc=ips

Page 46 AlliedWare™ OS How To Note: VPNs for Corporate Networks

Page 45 Page 47
Page 46
Image 46
Allied Telesis AR440S manual AlliedWare OS How To Note VPNs for Corporate Networks
Page 45 Page 47

AR440S specifications

Allied Telesis offers a range of advanced routers designed to meet the connectivity and operational needs of modern enterprises. Among its extensive lineup, the AR450S, AR441S, AR415S, AR442S, and AR440S models stand out for their robust features and technologies, making them ideal solutions for various networking environments.

The Allied Telesis AR450S is a high-performance router tailored for service providers and large enterprises. It supports advanced routing protocols, including IPv4 and IPv6, ensuring compatibility with both legacy and modern networks. The AR450S boasts substantial throughput capabilities, making it suitable for bandwidth-intensive applications. Its versatile WAN options, including Ethernet and cellular connectivity, allow seamless integration into diverse network architectures.

Next in the lineup is the AR441S, which focuses on providing enhanced security and reliability. With built-in firewall capabilities and VPN support, this model ensures secure communication over the internet. The AR441S also features numerous Ethernet ports for flexible connectivity, enabling organizations to scale their networks as needed. Its user-friendly interface facilitates straightforward configuration and management.

The AR415S is designed for branch offices and small to medium-sized enterprises. This router offers a balance of performance and affordability, equipped with essential features like Quality of Service (QoS) and traffic shaping. The AR415S supports multiple WAN connections, which helps in maintaining reliable internet access by auto-failing to backup connections when necessary.

The AR442S incorporates advanced networking technologies, including dynamic routing protocols and deep packet inspection. This model enhances performance by optimizing traffic flow and improving bandwidth utilization. Its support for VoIP and other multimedia applications makes it an excellent choice for organizations seeking to maximize their communication capabilities.

Lastly, the AR440S is engineered for high availability and redundancy. It includes dual power supplies and hot-swappable components, ensuring that network services remain uninterrupted during maintenance. The AR440S is particularly valuable in mission-critical environments where downtime can lead to significant business disruption.

In summary, the Allied Telesis AR series routers—AR450S, AR441S, AR415S, AR442S, and AR440S—offer a rich set of features tailored to various operational needs. With their advanced routing capabilities, security features, and reliable performance, these routers represent the cutting edge of networking technology for businesses looking to enhance their connectivity and operational efficiency.
Top Page Image Contents