Enterasys Networks X-PeditionTM manual Configure the following IPSec SAs

Configuration Examples

XSR(config-isakmp-peer)#proposal xp soho p2p

XSR(config-isakmp-peer)#config-mode gateway

XSR(config-isakmp-peer)#nat-traversal automatic

Configure the following IPSec SAs:

XSR(config)#crypto ipsec transform-set esp-3des-md5 esp-3des esp-md5-hmac XSR(cfg-crypto-tran)no set security-association lifetime kilobytes

XSR(config)#crypto ipsec transform-set esp-3des-sha esp-3des esp-sha-hmac XSR(cfg-crypto-tran)set security-association lifetime kilobytes 10000

Configure the following four crypto maps to match ACLs 150, 140, 120, and 110:

XSR(config)#crypto map test 50

XSR(config-crypto-m)#set transform-set esp-3des-sha

XSR(config-crypto-m)#match address 150

XSR(config)#crypto map test 40

XSR(config-crypto-m)#set transform-set esp-3des-sha

XSR(config-crypto-m)#match address 140

XSR(config)#crypto map test 20

XSR(config-crypto-m)#set transform-set esp-3des-md5

XSR(config-crypto-m)#match address 120

XSR(config-crypto-m)#mode transport

XSR(config-crypto-m)#set security-association level per-host

XSR(config)#crypto map test 10

XSR(config-crypto-m)#set transform-set esp-3des-sha

XSR(config-crypto-m)#match address 110

Configure FastEthernet interface 1 to permit multicast packets in and out:

XSR(config)#interface FastEthernet1

XSR(config-ifF1>)#ip address 96.96.96.7 255.255.255.0

XSR(config-ifF1>)#ip firewall ip-multicast in

XSR(config-ifF1>)#ip firewall ip-multicast out

XSR(config-ifF1>)#no shutdown

Configure FastEthernet interface 2 with the attached crypto map test:

XSR(config)#interface FastEthernet2

XSR(config-ifF2>)#crypto map test

XSR(config-ifF2>)#ip address 141.154.196.106 255.255.255.192

XSR(config-ifF2>)#no shutdown

Configure the VPN virtual interface as a terminating tunnel server with IP multicast redirection back to the gateway, add an OSPF network with cost and disable the firewall:

XSR(config)#interface Vpn1 multi-point

XSR(config-int-vpn)#ip multicast-redirect tunnel-endpoint

XSR(config-int-vpn)#ip address 10.120.70.1 255.255.255.0

XSR(config-int-vpn)#ip firewall disable

XSR(config-int-vpn)#ip ospf priority 10

XSR(config-int-vpn)#ip ospf network nbma

Add a default route to the next hop Internet gateway:

XSR User’s Guide 16-29