Enterasys Networks X-PeditionTM manual Interoperability Profile for the XSR

Interoperability Profile for the XSR

XSR(config-isakmp-peer)#config-mode gateway

XSR(config-isakmp-peer)#exchange-mode main

7.Configure IKE Phase 2 settings by creating the transform-set Secure:

XSR(config)#crypto ipsec transform-set Secure esp-3des esp-sha1-hmac XSR(cfg-crypto-tran)#set pfs group2

XSR(cfg-crypto-tran)#set security-association lifetime seconds 3600

8.Configure the crypto map Highflow which correlates with transform-set Secure and access list 101, and attach the map to the remote peer.

XSR(config)#crypto map Highflow 1 XSR(config-crypto-m)#set transform-set Secure XSR(config-crypto-m)#match address 101 XSR(config-crypto-m)#set peer 22.23.24.25

9.Attach the crypto map Highflow to the Gateway A external interface (AW):

XSR(config)#interface FastEthernet2 XSR(config-if<F2>)#crypto map Highflow XSR(config-if<F2>)#no shutdown

10.Configure the pre-shared key. The username is the IP address of the peer and the password is the pre-shared key.

XSR(config)#aaa user 22.23.24.25 XSR(aaa-user)#password hr5xb84l6aa9r6

11.Test the connection by pinging a PC on the 172.23.9.0 network from the 10.5.6.0 network. Alternately, pinging the PC from Gateway A, if successful, will produce the output shown below. Be aware that for a ping to traverse the tunnel, you must configure an ACL with the host source and host destination IP addresses.

XSR#ping 172.23.9.5 10.5.6.1 Type escape sequence to abort Reply from 172.23.9.5: 20ms Reply from 172.23.9.5: 10ms Reply from 172.23.9.5: 10ms Reply from 172.23.9.5: 10ms Reply from 172.23.9.5: 10ms

Packets: Sent = 5, Received = 5, Lost = 0

You can also issue the following show commands to examine Phase 1 and Phase 2 settings, respectively. When the tunnel is up, the commands will display the following output:

XSR#show crypto isakmp sa			Destination	Lifetime
Connection-ID	State	Source
------------	----------------		-----------	-------
4561	QM_IDLE 14.15.16.17		22.23.24.25	28000

XSR#show crypto ipsec sa

10.5.6.0/24, ANY, 0 ==> 172.23.9.0/24, ANY, 0 : 92 packets

ESP: SPI=190d1f5f, Transform=3DES/HMAC-SHA, Life=3600S/0KB

172.23.9.0/24, ANY, 0 ==> 10.5.6.0/24, ANY, 0 : 98 packets

ESP: SPI=340d455a, Transform=3DES/HMAC-SHA, Life=3600S/0KB

14-48 Configuring the Virtual Private Network