IPsec VPN Configuration
Except on the first page, right running head:
Heading1 or Heading1NewPage text (automatic)
753
Alcatel-Lucent
Beta
Beta
CLI Configuration Guide
IP
SEC
C
ONFIGURATION
C
OMMANDS
This section details the commands used in configuring IPsec VPN.
T
O
C
ONFIGURE
THE
M
ATCH
-
LISTS
To get a concise and terse outlook on the methods to configure the match-lists,
please refer
“Common Classifiers”
chapter in this guide.
To specify the subnets, which need to communicate with each other, match-list
(access-list) needs to be configured. This match-list is called by the crypto map
command.
In the OA-700, a wide variety of match-lists can be defined. However, a well-
defined subset of match-lists can be used for IPsec tunnel (a match-list should not
have ‘any any’ option). The match-list should not contain multiple rules or another
nested match-list/list. A rule should not have the ‘port range’ or ‘interfaces’
keywords.
However, these constraints can be overcome by applying multiple crypto maps to
the same interface.
For Example:
match-list
m1
ip prefix
10.0.0.0/8
prefix
9.0.0.0/8
IP
SEC
C
ONFIGURATION
WITH
P
RESHARED
K
EY
The Preshared key is used to authenticate peers. This key is same on both the
IPsec gateways. It is denoted in the form of a key-string. The “
force
“ keyword
edits or modifies the IKE keys, which are already configured.
Note:
The IKE key is given by means of a key-string. Currently, the preshared key length is
restricted to 128 characters, and the minimum length is 8 characters.
E
XAMPLE
ALU(config)#crypto ike key top_secret1612 peer 10.10.1.2
ALU(config)#crypto ike key "!netsecret!" peer 202.54.30.100
Command (in CM)
Description
crypto ike key
<key-string>
[
vrf <name>
]
peer
<
peer-
address>
[
force
]
This command is used to configure a
preshared key.
no crypto ike key
<key-
string>
[
vrf <name>
]
peer
<
peer-address>
This ‘no’ command removes the
configured preshared key.
Summary of Contents for OmniAccess 700
Page 38: ...Left running head Chapter name automatic 12 Beta Beta CLI Configuration Guide Alcatel Lucent ...
Page 176: ...Left running head Chapter name automatic 150 Beta Beta CLI Configuration Guide Alcatel Lucent ...
Page 260: ...Left running head Chapter name automatic 234 Beta Beta CLI Configuration Guide Alcatel Lucent ...
Page 434: ...Left running head Chapter name automatic 408 Beta Beta CLI Configuration Guide Alcatel Lucent ...
Page 464: ...Left running head Chapter name automatic 438 Beta Beta CLI Configuration Guide Alcatel Lucent ...
Page 638: ...Left running head Chapter name automatic 612 Beta Beta CLI Configuration Guide Alcatel Lucent ...
Page 940: ...Left running head Chapter name automatic 914 Beta Beta CLI Configuration Guide Alcatel Lucent ...
Page 1002: ...Left running head Chapter name automatic 976 Beta Beta CLI Configuration Guide Alcatel Lucent ...
Page 1120: ...Left running head Chapter name automatic 2 Beta Beta CLI Configuration Guide Alcatel Lucent ...