Enterasys Networks XSR-3150 VPN Site-to-Site Sample Configuration, Generate Master Encryption Key

VPN Site-to-Site Sample Configuration

VPN Site-to-Site Sample Configuration

The following VPN topology, shown in Figure 3-5, configures a central site XSR to connect over IPSec tunnels with a remote ANG-1105 and two XSRs.

Figure 3-5 VPN Site-to-Site Topology

	Central Site		112.16.72.2
		112.16.244.9
112.16.1.221		ANG-1105	Branch Sites
		XSR
			112.16.76.2
XSR	Firewall	112.16.244.7
	112.16.244.10	XSR
	Gateway IP address
	for all remote sites		112.16.80.2
		112.16.244.5

The following script configures the VPN topology shown in Figure 3-5.

Generate Master Encryption Key

If you have not already generated a master encryption key, you must do so now to configure th6e VPN. A master key need only be generated once.

Caution: The master encryption key is stored in hardware, not Flash, and you cannot read the key - only overwrite the old key by writing a new one. To ensure router security, it is critical not to compromise the key. There are situations where you may want to keep the key, for example, to save the user database off-line in order to later download it to the XSR. In order to encrypt the user database, you need the same master key, indicating the key designation with the master key specify command. Be aware that if the XSR is inoperable you may have to return to factory defaults, which erases the master key forcing you to generate a new one.

Generate the master key:

XSR(config)#crypto key master generate

New key is 2173 4521 3764 2ff5 163b 4bdf fe92 dbc1 1232 ffe0 f8d9 3649

Configure Access Control Lists

ACL 101 configured below is strongly restrictive in denying all but IKE traffic (well-knownUDP port# 500) through the router. ACLs 190, 191, and 192 are crypto map filters configured to accept any IPSec-encrypted traffic over site-to-site tunnels and pass that traffic to the three specified networks only.

XSR(config)#access-list 101 permit udp any any eq 500

XSR(config)#access-list 101 permit udp esp any any

XSR Getting Started Guide 3-27