Accelerated 6310-DX, User Manual

Page: 77 / 235

Site-to-Site VPN Access with two 63xx Series Site-to-Site VPN Access with two 63xx Series
Devices Devices
Skill level: Expert Expert (requires knowledge of IPSec tunnel setup)
Goal Goal
To build an IPSec tunnel through the 63xx device's cellular WAN Internet connection to another
63xx, and use that IPSec tunnel to access endpoints inside a VPN.
Setup Setup
For this setup, you will need two 63xx series devices. Both 63xx devices must be on firmware
version 17.5.108.6 or higher. The 63xx series devices will need an active WAN Internet
connection.
The main site's 63xx series device will need a publicly reachable IP address, so the remote 63xx
series device can reach the IP and build a tunnel.
You will also need to decide on the IPSec credentials and settings needed to build a tunnel
between the 63xx series devices.

If configuring a 6300-CX for Site-to-Site VPN Access, it must be in router mode router mode .
Sample Sample
The sample configuration below shows a 6300-CX building a tunnel to a 6350-SR through its
cellular modem. The client laptop connected to the LAN Ethernet port of the 6300-CX can then
use that IPSec tunnel to access any IP address in the 172.20.1.1/24 range behind the 6350-SR.
Any traffic not destined for 172.20.1.1/24 will instead go through the cellular modem straight to
the Internet.
This tunnel will also allow the client laptop connected to the LAN 4 port of the 6350-SR to access
any IP address in the 172.21.1.1/24 range behind the 6300-CX. Any traffic not destined for
172.20.1.1/24 will instead go through the Ethernet WAN of the 6350-SR straight to the Internet.
Both the 6350-SR and 6300-CX will need to be configured with a new IPSec tunnel, using
matching authentication settings, in order for the 6300-CX to build the tunnel to the 6350-SR.
Sample configuration settings for both devices are listed below.
User Manual
Page 77 Page 77 6310-DX