VPN Sample Configuration with Network Extension Mode

XSR(config)#interface vpn 57 multi-point

XSR(config-int-vpn)#ip address 192.168.2.1 255.255.255.0

XSR(config)#router rip

XSR(config-router)#network 112.16.10.0

XSR(config-router)#passive-interface gigabitethernet 2

XSR(config-router)#no receive-interface gigabitethernet 2

XSR(config-router)#distribute-list 1 out vpn 1

XSR(config)#ip route 0.0.0.0 0.0.0.0 112.16.244.9

XSR(config)#ip route 112.16.72.0 255.255.255.0 112.16.244.9

XSR(config)#ip route 112.16.76.0 255.255.255.0 112.16.244.7

XSR(config)#ip route 112.16.80.0 255.255.255.0 112.16.244.5

Configuring Authentication (AAA)

Configure an AAA user and DEFAULT AAA group for remote users. When an ANG tunnels into the XSR, it will be assigned dynamically to the IP pool AUTH. Be aware that groups must be created before users can be added to them. Remember to create the same users and passwords on the ANG. The IP address assigned to the AAA user is the remote gateway IP address.

XSR(config)#ip local pool AUTH 192.168.2.0 255.255.255.0

XSR(config)#aaa user 112.16.244.9

XSR(aaa-user)#password dribble

XSR(aaa-user)#group DEFAULT

XSR(aaa-group)#pptp encrypt mppe auto

XSR(aaa-group)#ip pool AUTH

XSR(aaa-group)#policy vpn

VPN Sample Configuration with Network Extension Mode

The following sample topology is ideal for testing a VPN NEM tunnel connection on a LAN before actually configuring a production network. If the configuration works properly, simply change the GigabitEthernet settings to the Serial or T1 interface values of your choice.

The XSR below is configured as a VPN concentrator with Internet access allowed and Network Extension Mode (NEM) tunnels set up. NEM is designed to open up network resources situated behind the XSR. You configure NEM to provide routing for nodes connected to the trusted port of the router so that locally and remotely connected devices can discover and communicate with each other across an IKE/IPSec tunnel.

The XSR’s EZ-IPSec functionality is employed to automatically access default ESP transforms and IPSec proposals. The following script configures the VPN topology shown in Figure 3-6.

XSR Getting Started Guide 3-29

Page 73
Image 73
Enterasys Networks XSR-3020 manual VPN Sample Configuration with Network Extension Mode, Configuring Authentication AAA

XSR-3020 specifications

Enterasys Networks XSR-3020 is a sophisticated Layer 2 and Layer 3 switch designed to meet the demands of modern networking environments. Known for its robust performance and versatility, the XSR-3020 is an ideal solution for enterprises that require high efficiency, comprehensive security, and network reliability.

This switch supports a variety of advanced technologies, making it suitable for both data center and edge deployments. One of its standout features is its scalability. The XSR-3020 can accommodate growing network demands by allowing for easy integration of additional modules. This capacity for expansion ensures that organizations can adapt their networks without the need for complete hardware replacements.

The XSR-3020 offers high-speed connectivity through its multiple gigabit Ethernet ports, providing up to 48 10/100/1000BASE-T ports in a single chassis. This high-density design optimizes the physical space and ensures that organizations can connect numerous devices simultaneously without sacrificing performance. Additionally, it supports Power over Ethernet (PoE), allowing users to power network devices, such as IP cameras and access points, directly through the switch. This feature streamlines installations and reduces the clutter of electrical wiring.

Security is a critical consideration in today’s network landscape, and the XSR-3020 addresses this need with robust security features. It incorporates advanced access control capabilities, enabling administrators to segment traffic and enforce policies effectively. The switch also supports 802.1X authentication, ensuring that only authorized devices can connect to the network.

In terms of management, the XSR-3020 is designed to simplify operations through its user-friendly interface and extensive support for management protocols. It offers native support for Simple Network Management Protocol (SNMP) and can be easily integrated with various network management systems, allowing for efficient monitoring and troubleshooting.

Another key characteristic of the XSR-3020 is its reliability. With features such as redundant power supplies and fans, the switch ensures high availability, minimizing downtime for critical applications. It is also built to withstand harsh conditions, making it suitable for diverse environments.

Overall, the Enterasys Networks XSR-3020 combines high performance, scalability, and security, making it an excellent choice for organizations looking to enhance their network infrastructure. Its comprehensive set of features positions it as a reliable backbone for any modern enterprise network, ensuring that businesses can operate efficiently and securely.