Filter
Top Products
224 Chapter 13 VPN
N0115790
Table 54 describes the fields in Figure 71.
Table 54 VPN Branch Office — IP Policy
Label Description
Protocol Enter a number to specify what type of traffic is allowed to go
through the VPN tunnel that is built using this IP policy. For
example, use 1 for ICMP, 6 for TCP, 17 for UDP. 0 is the default
and signifies any protocol. For example, if you select 1 (ICMP),
only ICMP packets can go through the tunnel.
If you specify a protocol other than 1 (ICMP) or 0 (any protocol),
you cannot use the control ping feature.
If you set this field to 6 (TCP) or 17 (UDP), you can use the Port
field to specify the port number of the allowed traffic.
Enable Control Ping Select the check box and configure an IP address in the Control
Ping IP Address field to have the BCM50a Integrated Router
periodically test the VPN tunnel to the branch office.
The BCM50a Integrated Router pings the IP address every
minute. The BCM50a Integrated Router starts the IPSec
connection idle timeout timer when it sends the ping packet. If
there is no traffic from the remote IPSec router by the time the
timeout period expires, the BCM50a Integrated Router
disconnects the VPN tunnel.
Control Ping IP
Address
If you select Enable Control Ping, enter the IP address of a
computer at the branch office. The computer's IP address must be
in this IP policy's remote range (see the Remote fields).
Branch Tunnel NAT Address Mapping Rule
Port Forwarding
Server
Click Port Forwarding Server to configure a list of inside (behind
NAT on the LAN) servers, for example, web or FTP. The BCM50a
Integrated Router makes these servers visible to the devices using
the VPN branch NAT tunnel (from behind the remote IPSec router)
even though NAT makes your inside network appear as a single
machine. This option applies when the Type field is configured to
Many-to-One.
Active Enable this feature to have the BCM50a Integrated Router use a
different (virtual) IP address for the VPN connection. When you
enable branch tunnel NAT address mapping, you do not configure
the local section.