Enterasys Networks X-PeditionTM manual Configuration Examples, XSR with VPN Central Gateway

Configuration Examples

XSR(config-tms-tunnel)#set peer 200.10.20.30

+Specifies the IP address of the remote peer

XSR(config-tms-tunnel)#set protocol ipsec network-extension-mode + Selects IPSec to initiate a

NEM tunnel connection

Note: Pre-shared key proposals are used if a user name is supplied with a tunnel. If no user name is supplied, EZ-IPSec verifies the XSR has one or more valid certificates and it uses RSA signature authentication.

Most of the parameters shown below have been automatically entered by EZ-IPSec. Be aware that they do not appear in the running-configfile.

crypto isakmp peer 200.10.20.30/32

proposal ez-ike-3des-sha-psk ez-ike-3des-md5-psk config-mode client

exchange-mode aggressive nat-traversal automatic crypto map ez-ipsec 100 match address 100

set peer 200.10.20.30 mode tunnel

set transform-set ez-esp-3des-sha-pfs ez-esp-3des-md5-pfs set transform-set ez-esp-aes-sha-pfs ez-esp-aes-md5-pfs

set transform-set ez-esp-3des-sha-no-pfs ez-esp-3des-md5-no-pfs set transform-set ez-esp-aes-sha-no-pfs ez-esp-aes-md5-no-pfs crypto map ez-ipsec 101

match address 101 set peer 200.10.20.30

Configuration Examples

XSR with VPN - Central Gateway

In this scenario, as shown in Figure 14-12, a Central VPN gateway is set to perform the following:

•Terminate NEM and Client mode tunnels

•Terminate remote access L2TP/IPSec tunnels

•Terminate PPTP remote access tunnels

•OSPF routing with the next hop corporate router on the trusted VPN interface

•DF bit clear on the public VPN interface to handle large non-fragmentable IP frames

•OSPF routing over the multi-point VPN interface for other site-to-site tunnels

•Assign the first IP address of the pool to the multi-point VPN interface.

14-36 Configuring the Virtual Private Network