Enterasys Networks X-PeditionTM manual Configuring a Simple VPN Site-to-Site Application

Configuring a Simple VPN Site-to-Site Application

VPN Interface Sub-Commands

The following sub-commands are available at VPN Interface mode:

ip firewall + Set of commands to configure the firewall

ip address-negotiated+ Sets the VPN interface’s IP address to be negotiated ip address + Specifies an IP address on the VPN interface

ip multicast-redirect+ Redirects multicast to a unicast address ip nat + Specifies NAT rules on the VPN interface

ip rip + Configures RIP routing on the VPN port

ip unnumbered + Enables IP processing on a serial port without assigning it an explicit IP address ip split-horizon+ Enables split horizon mechanism

ip ospf + Set of commands to configure OSPF routing

tunnel + Command and sub-commands configure a site-to-site VPN tunnel on a point-to-point interface set heartbeat + Enables and configures tunnel connectivity monitoring

set protocol (ipsec or gre) + Selects a tunnel protocol set active + Brings the tunnel up

set user + Designates the user name when initiating a tunnel and obtains credentials from the AAA subsystem set peer + Sets the IP address of the peer

Configuring a Simple VPN Site-to-Site Application

The following main steps describe how to configure a simple Site-to-Site VPN between two XSRs, as illustrated in Figure 14-11:

•Encrypt Branch-site traffic on the 63.81.66.0/24 network to Central site networks (63.81.64.0/ 24, 63.81.68.0/24, 141.154.196.64/28)

•Set up IPSec/IKE policy with pre-shared keys

•Configure cryptographic algorithms (transform-sets) and IPSec mode

•Configure the VPN interface and crypto maps

Figure 14-11 Site-to-Site Example

Branch Office					Central Site
					FastEthernet 2	XSR
			FastEthernet 2	Internet	1.1.1.2
FastEthernet 1		1.1.1.1
		XSR			FastEthernet 1
63.81.66.1
					141.154.196.78
63.81.66.0/24
					63.81.64.0/24	63.81.68.0/24

1.Generate a master encryption key as described in “Master Encryption Key Generation” on page 14-20.This need only be done once on the router.

2.Begin Central Site configuration of all necessary physical and system requirements, including physical IP addresses, routing (default route and RIP or OSPF), and standard ACLs. This example offers numerous options.

3.Configure Access Lists 120, 130, and 140 to define the particular traffic to be protected by the tunnel. The ACLs allow a range of IP addresses on the VPN. In the context of VPN

14-32 Configuring the Virtual Private Network