Manuals
/
Nortel Networks
/
Computer Equipment
/
Network Card
Nortel Networks
608(WL) manual SpeedTouch 608WL/620
Models:
620
608(WL)
1
3
222
222
Download
222 pages
37.22 Kb
1
2
3
4
5
6
7
8
<
>
Configuration via Local Pages
Auxiliary Commands
Default Peer Concept
Peer Phase
Authorization
Password
Inactivity Timeout
Advanced Features
Switch to the Aggressive Mode
Encapsulation mode Keyword
Page 3
Image 3
SpeedTouch™
608(WL)/620
IPSec Configuration Guide
Page 2
Page 4
Page 3
Image 3
Page 2
Page 4
Contents
SpeedTouch608WL/620
Page
SpeedTouch 608WL/620
Copyright
Trademarks
Document Information
Contents
Configuration via the Command Line Interface
Troubleshooting SpeedTouch IPSec 161
Advanced Features
Advanced Connection 213
Contents
Terminology Documentation and software updates
About this IPSec Configuration Guide
About this IPSec Configuration Guide
Topic
IPSec Concept for secure IP connections
IPSec Concepts
Authentication Header Encapsulated Security Payload
Security Associations Tunnel Mode
Chapter
SpeedTouch IPSec terminology
Policy
Security Descriptor
Authentication Attribute
Peer Phase
Connection Phase
Network descriptor
Chapter
Configuration via Local Pages
Topic
Network 10.0.0.0/24 Network 20.0.0.0/24
LAN to LAN Application
Remote Gateway Address Unknown
Remote Gateway Address Known
Remote Gateway Address Known
Click
Primary Untrusted Physical Interface
Inactivity Timeout Default value
IKE Exchange Mode
Inactivity Timeout
IKE Security Descriptors
Parameter Value for AESMD5
Layout with additional Descriptors
Authentication
Layout for pre
Shared key
Identity type Keyword Examples
IKE Authentication with Preshared Key
Example of a completed
Click
Remote Gateway Address Unknown
Gateway Address Unknown
Switch to the Aggressive Mode
Inactivity Timeout Default value
IKE Security Descriptors
Layout for pre
IKE Authentication with Preshared Key
Confirm the IKE Authentication , IKE
Security Descriptors and Miscellaneous
Advanced Peers Security Descriptors
Inactivity Timeout Default value
Chapter
John.doe@corporate.net
Identification Interface
Example of a completed
Click
Connections
Type Valid network types are Keyword Examples
Protocol
Network IP field
Value for AESMD5TUN
Parameter
Starting and stopping a connection
VPN Client
Click
Server IP Address or
Backup Server IP Address or Fqdn IKE Security Descriptor
Advanced Connections Security Descriptors
Select When
Chapter
Preshared Secret
Manual Dialup Automatic Start
Set of Server Vendor specific parameters
Local LAN IP range Examples
Starting the VPN Client Connection
Method 1 Automatic Start
Method 2 Manual Start
Client Identification parameter is Server Vendor specific
Dialling VPN Client Connect
Chapter
Closing a Connection
VPN Server
VPN Server
Click
Parameter Value for AESMD5
Example DESMD5TUN
Layout with additional Descriptors IPSec Security
Inactivity Timeout Default value
Domain name
Virtual IP Range
Netmask
Push IP
Identity type Keyword Examples
@corporate.net
Remote ID Filter Type and Remote ID Filter
Click Add User
Certificates
Chapter
Advanced VPN Menu
Advanced Peers sub-pages See
Connection Profiles
Peer Profiles
Remote ID type Keyword Examples
Local ID type Keyword Examples
Chapter
Chapter
Parameter Possible values Description
Authentication
Peer Descriptors
Descriptors page layout Parameter table
Parameter Description
Diffie-Hellman group Number of bits Keyword
Algorithm
Valid key lengths bits
Hashing algorithm
Peer Profile
Peer Options
Options
Layout
VPN-Client
Authentication XAuth on page 176 and following
Chapter
VPN-Server
Chapter
Password
VPN-Server-XAuth
Chap
Connection Profiles
Keyword allocatedvirtualip
Keyword retrievefromserver
Chapter
What is a Network Descriptor? How is it used?
Networks
Type of network and IP address
Chapter
Descriptors page layout
Connection Descriptors
PFS
Algorithm Valid key lengths bits
Kilobytes 30 = 1 073 741
Connection Profile
Connection Options
Client
Configuration via the Command Line Interface
What do we want to do? How do we configure it SpeedTouch?
Basic IPSec configuration procedure
103
Peer Authentication Attribute
Authentication Attribute Parameters
List all Authentication Attributes
Create a New Authentication Attribute
Secret1
Set or Modify the Authentication Attribute Parameters
Delete an Authentication attribute
Peer Security Descriptor
Parameter Keyword Description
Peer Security Descriptor Parameters
Cryptographic function crypto
Algorithm Valid key sizes Popular sizes Default size Bits
113
List all Peer Security Descriptors
Create a New Peer Security Descriptor
Name = peerdes1
Set or Modify the Peer Descriptor Parameters
Delete a Peer Descriptor
Result of this operation is verified with the list command
Peer
Peer parameters Parameter Keyword Description
Peer parameters
Exchange mode Keyword Valid values
Corporate.net
Remote Identifier remoteid
122
Dialuppppoe
List all peer entities
Create a new peer entity
Set or modify the peer parameters
Use the list command to verify the results of the operation
Delete a Peer entity
Connection Security Descriptor
Connection Security Descriptor parameters
129
Encapsulation mode Keyword
Ipsec=connection
List all Connection Security Descriptors
Create a new Connection Security Descriptor
Name = cnctdes1
Set the Connection Security Descriptor Parameters
Delete a Connection Security Descriptor
135
Type Valid network types Keyword Examples Are
Network Descriptor Parameters
137
Create a New Network Descriptor
Net1
Set the Network Descriptor Parameters
Delete a Network Descriptor
Connection
Connection parameters Parameter Keyword Description
Connection Parameters
Local network localnetwork Remote network remotenetwork
144
List all Connections
Create a New Connection
Name = connect1
Set or Modify the Connection Parameters
Delete a Connection
Start a Connection
Stop a connection
Auxiliary Commands
Config Command
What is it used for Display the VPN configuration settings
Control of general VPN settings
AutoProxyARP When do I need ProxyARP
An example of Auto ProxyARP
Flush Command
Clear Command Group
Organisation of the IPSec Command Group
Ipsec command group See
Ipsec clear command group
Ipsec debug command group
Ipsec connection command group
Ipsec peer command group
Ipsec show command group
Troubleshooting SpeedTouch IPSec
Security Association should be active
Via the Debug Web pages
How to monitor the IPSec negotiations
Browse to Expert mode VPN Debug Logging
Browse again to Expert mode VPN Debug Logging
164
Show command group
Via the CLI Show command group
166
Via the CLI Debug command group
168
Severity Contents
Debugging via Snmp
Via Snmp
Pinging from the SpeedTouch to the remote private network
Ping command Adapting the routing table
172
Advanced Features
IPSec and the Stateful Inspection Firewall
Web Browsing Interception and surfing through a tunnel
Surfing through the VPN tunnel
How does it work
Extended Authentication XAuth
177
VPN Client parameters Parameter Keyword Description
VPN Client parameters
Ipsec= Ipsec=peer
Create a new vpnclient
Set or modify the vpnclient parameters
Modify the peer parameters Example
Attach the vpnclient entity to the peer entity
182
VPN Server parameters Parameter Keyword Description
VPN Server parameters
Puship Possible values Description Default value
Create a new VPN server
Set or modify the vpnserver parameters
Attach the vpnserver entity to the peer entity
XAuth Users Pool
XAuth Pool parameters Parameter Keyword Description
XAuth Pool parameters
Create a new XAuth pool
Modify the xauthpool type
Modify the vpnserver parameters Example
Attach the xauthpool entity to the vpnserver entity
Delete an xauthpool entity
XAuth User parameters
Create a new XAuth user
Set or modify the password of an XAuth user
Delete an xauthuser entity
PPP
Default Peer Concept
Advanced Features SpeedTouch 1 IPSec peer configuration
Example IPSec connection, applying the default peer concept
Peer
One Peer Multiple Connections
Option Keyword Description
Possible values Default value
Inactivity Unit Default value
Dpdidleperiod Unit Default value
Dpdxmits Default value
Dpdtimeout Unit Default value
List all Peer Options lists
Create a Peer Options list
Set or modify the Peer Option list parameters
Delete a Peer Options list
IPSec routing mode
Routed
Virtualif Possible values
Don’t Fragment bit forcedf
Forcedf Possible values Default value
Minmtu Unit Default value
Addroute Possible values Default value
List all Connection Options lists
Create a Connection Options list
Set or modify the Connection Option list parameters
Delete an Options list
Advanced Connection
214
Keyword Followed by a Network name
Local match localmatch
Remote match remotematch
216
217
218
Page
Need more help?
