Alcatel-Lucent OmniAccess 700, Cli Configuration Manual

Page: 820 / 1193

IP Security - Virtual Private Network
Left running head:
Chapter name (automatic)
794
Beta Beta
CLI Configuration Guide
Alcatel-Lucent
C
OMPARATIVE
S
TUDY
B
ETWEEN
OA-700
AND
O
THER
S
YSTEMS
This same thing in other systems would involve:
1. Defining a Preshared key.
2. Defining an ike policy - 3 sub-commands minimum (OA-700 has a default IKE
policy).
3. Defining a transform-set (in our case, we have a default transform-set).
4. Defining a crypto map - 4 sub-commands (in our case, only 2 sub-commands).
Further, when a show crypto is done, the defaults assumed are shown with a
“!” at the beginning of the line. This would help in knowing whether the value was
set or assumed.
Another point to note is that the OA-700 does not support AH in IPsec. AH is a
very weak mechanism and hence is not used in most modern systems.
E
DITING A
M
ATCH
-
LIST
A
TTACHED
T
O
T
HE
C
RYPTO
M
AP
ALU(config)# match-list tunnel
ALU(config-match-list-tunnel)# 1 ip prefix 10.91.0.0/24 prefix
10.0.0.0/24
ALU(config)# crypto map cryp-tunnel ipsec-ike default
ALU(config-crypto-map-cryp-tunnel)# match tunnel
Now, if we want to tunnel traffic from 192.168.0.0/24 to 10.0.0.0/24
ALU(config)# match-list tunnel
ALU(config-match-list-tunnel)# 1 ip prefix 10.91.0.0/24
prefix 10.0.0.0/24
ALU(config-match-list-tunnel)# 2 ip prefix 192.168.0.0/24
prefix 10.0.0.0/24
This will not work as the crypto map accepts only the first configured rule in the
match-list. Hence, you should configure another match-list with the new rule and
configure this into a new crypto map.
Alternatively, you can modify the same rule.
ALU(config)# match-list tunnel
ALU(config-match-list-tunnel)# 1 ip prefix 10.91.0.0/24
prefix 10.0.0.0/24
ALU(config-match-list-tunnel)# 1 ip prefix 192.168.0.0/24
prefix 10.0.0.0/24
Note: The crypto map supports only one rule in a match-list.