Efficient Networks 107-0001-000 manual Ike ipsec policies set translate

Efficient Networks® Router family	Chapter 12: IKE/IPsec Commands
Command Line Interface Guide

ike ipsec policies set translate

Defines a translate filtering parameter value for the policy. The translate option determines whether the router applies NAT (network address translation) before the packets are encrypted by IPSec.

NOTE:

The remote must have IP address translation enabled (see “Network Address Translation (NAT)” on page 4-17.Or, the remote setiptranslate command).

NOTE:

The address that NAT translates to should be the source or destination address for the policy (use the ike ipsec policies set source or ike ipsec policies set dest command).

Use this option when several remote sites have the same IP subnet, making it impossible to tunnel those sites unchanged to the corporate network.

When the router’s public IP address is not the desired choice for the network address translation, you can define a virtual Ethernet interface. A virtual Ethernet interface can be created to translate to an arbitrary IP address (see “IP Subnets” on page 6-1.).

Again, be sure that the virtual Ethernet interface has IP address translation enabled (eth ip translate), and use the virtual Ethernet interface as the gateway to the other end of the protected network. (See the example below.) You can use the eth ip addhostmapping command to map a range of NAT addresses to private addresses so the IKE tunnel can be initiated from either end.

Mgmt Class

Security (R/W)

Input Format

ike ipsec policies set translate on off <policyname>

Parameters

on off Sets the translate option on or off. If translate is set to on, trans- lation is applied before encryption, and the packets are sent us- ing the host router’s public IP address.

<policyname>a Name of the IPsec policy to which the source port parameter val- ue is added.b

aASCII string

bTo see the policy names, use the ike ipsec policies list command.

Efficient Networks® Page 12-21