Filter
Top Products
Page 28 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
branch office 2
Create another IPsec policy for direct Internet traffic from the headquarters LAN to the
Internet, such as web browsing.
create ipsec pol=internet int=ppp0 ac=permit
Note: The order of the IPsec policies is important. The Internet permit policy must be last.
Create your ISAKMP pre-shared key. This key is used when initiating your VPN during phase
one ISAKMP exchanges with your VPN peers. Share the value of this pre-shared key with all
VPN peers that use it—in this example, the headquarters router. The router only uses this
key during phase one ISAKMP exchanges.
create enco key=1 type=general value=<alphanumeric-preshared-key>
Enable ISAKMP.
enable isakmp
Create an ISAKMP policy for the VPN to headquarters. Use ISAKMP heartbeats, which allow
ISAKMP to clear SAs if either end of the link resets.
create isakmp pol=hq pe=200.200.200.1 sendd=true key=1 heart=both
localid=branch2 encalg=3des2key
Enable the firewall and create a firewall policy.
enable firewall
create firewall policy=branch2
enable firewall policy=branch2 icmp_f=all
Specify the LAN-facing interface of the router as a private (trusted) interface on the firewall.
add firewall policy=branch2 int=vlan1 type=private
Specify the Internet-facing interface of the router as a public (not trusted) interface on the
firewall.
add firewall policy=branch2 int=ppp0 type=public
Define a NAT definition to use when traffic from the local LAN accesses the Internet.
add firewall policy=branch2 nat=enhanced int=vlan1 gblin=ppp0
Create a rule to allow incoming ISAKMP negotiation messages to pass through the firewall.
This rule specifies 0.0.0.0 as the global IP address because the PPP address of branch office 2
is dynamically assigned. The rule uses the LAN address to identify matching traffic.
add firewall policy=branch2 ru=1 ac=allo int=ppp0 prot=udp po=500
ip=192.168.142.254 gblip=0.0.0.0 gblp=500
9. Configure the firewall’s basic settings
10. Configure the firewall’s access rules