background image

Page 48 - Configuration Examples 

 

Task Description 

Step 6 

For IP Office, perform the following on the 
IPSec Policies tab: 

• 

Protocol = ESP 

• 

Encryption = DES 

• 

Authentication = MD5 

• 

Life Type = Seconds 

• 

Life = 86400 

 
 
 
Protocol set to Encapsulating Security Payload. 
Encryption set to DES 
Authentication set to MD5 
This is the time period before a new key is 
generated (86400 represents one day in 
seconds). 

Step 7 
Check connection  

 
Activate the Security Policy on the Windows 
PC by right clicking the SoftRemote icon in the 
task bar. 
Using a protocol analyser check to see that the 
ISAKMP Main Mode messages appear. 

 
For VoIP configuration refer to Part 3 VoIP Configuration on page 53. 
 
 

Page 48 - Configuration Examples 

IP Office (R3.0) 

Part 2: VPN configuration 

40DHB0002UKER Issue 3 (4th February 2005) 

Summary of Contents for IP Office (R3.0)

Page 1: ...IP Office R3 0 Virtual Private Networking 40DHB0002UKER Issue 3 4th February 2005...

Page 2: ...ient VPN 18 Guidelines 18 VPN and VoIP 19 Bandwidth Calculation Variables 20 Bandwidth Requirement Calculation 21 Example 1 21 Example 2 22 Guidelines 22 Maximum Load 23 Configuration 24 IPSec Configu...

Page 3: ...ec Framework 6 Figure 3 LT2P Tunneling Modes 7 Figure 4 Inbound Unprotected Packet 9 Figure 5 Inbound Unprotected Packet Type Detection 10 Figure 6 L2TP Implementation 12 Figure 7 Logical LAN Implemen...

Page 4: ...s Telecommuter Telecommuter Home Home Offices Offices Internet Internet Remote Remote Offices Offices Branch Branch Offices Offices Business Business Partners Partners Mobile Mobile Access Access Main...

Page 5: ...nitor 3 0 Manager 3 0 Cisco IOS using pre shred mode only 12 2 NetScreen Remote VPN Client 10 0 General For secure VPNs the technologies that IP Office supports are IPSec L2TP Compulsory Voluntary opt...

Page 6: ...approach It is important to understand that each of these groups serve a specific purpose and work together to provide a modular solution to Internet security problems By breaking IPSec into these se...

Page 7: ...ol TCP IP L2TP tunneling encapsulates IP data packets in PPP for transmission through an IP network Upon receipt the IP and PPP headers are stripped away exposing the original IP data packet In this w...

Page 8: ...lish the control connection Each L2TP tunnel requires a control connection to be established before any other L2TP messages can be issued It includes an Assigned Tunnel ID that is used to identify the...

Page 9: ...f the inbound unprotected packet matches the condition on any configured IPSec form then a Security Association SA is formed with the specified Secure Gateway Once the SA is established the inbound pa...

Page 10: ...establish the tunnel and thereby form the SA 2 ESP used to carry the encrypted data If the received IPSec packet is an ESP addressed to the IP Office then IP Office will check for a valid SA If a vali...

Page 11: ...antages of IPSec L2TP and the symmetrical relationship between the two IPSec L2TP IPSec in L2TP L2TP Inside IPSec Advantages Encrypts data Disadvantages Packets must not be excessively re ordered in t...

Page 12: ...an L2TP destination Any packet Check Routing Table Forward outside L2TP tunnel Queue Packet or Use Remote Gateway address to establish tunnel Forward inside L2TP tunnel Is the L2TP tunnel established...

Page 13: ...on domain as the System LAN but uses a different MAC address and operates on a different subnet The Logical interface can be regarded as a secondary or a sub interface to the primary System LAN LAN1 i...

Page 14: ...e feature allows single LAN systems to operate external and internal IP subnets in support of VPN networking NAT functionality is applied to traffic from LAN1 using the IP address assigned to the Logi...

Page 15: ...re detailed in the diagram will be discussed with respect to the IP Office 3 0 VPN implementation The following elements will be discussed Public Access Public Interface IP Office VPN solutions Intern...

Page 16: ...sed in conjunction an xDSL or Internet Router Both the Logical or the Physical LAN2 interface dual LAN systems can be used to provide Public Interface functionality as described in the following secti...

Page 17: ...e physical LAN1 interface LAN2 X X The LAN2 is a second physical Ethernet interface NAT NAT allows multiple devices to communicate using a single IP address NAT Reverse Translation x x The function th...

Page 18: ...transparently Using MS Windows once the IPSec connection has been established an L2TP connection can then be established over the IPSec VPN The IP Office Phone Manger Pro application can be used in co...

Page 19: ...mechanism allow for QoS support on slow speed xDSL links for example For voice traffic IP Office performs concurrent call load restrictions on a per call basis and does not assume the bandwidth requir...

Page 20: ...HC 46 Payload Payload The number of bytes per sample Type Value VOIP G711 G723 G729 Net 8K 160 24 20 20 Fax 14400 12000 9600 7200 72 60 48 36 Sample Rate Payload_per_sec The number of samples per seco...

Page 21: ...t to the VoIP compression type that is to be used for G729 this value is 52 For L2TP the value is fixed for all compression types For the case where IPSec and L2TP are used in conjunction e g L2TP pro...

Page 22: ...s 1 IP Office running 3 0 has been limited to 1Mbps of throughput for all traffic types 2 IP Office running 3 0 does not support IPHC for VPN networking 3 IPSec performs IP fragmentation in order to a...

Page 23: ...ftware is because the IPsec encryption and decryption processing is now performed in hardware The encryption and decryption hardware for IPSec removes this processing overhead from the CPU In this way...

Page 24: ...tions to trigger a Security Association SA The IP Security Menu Access to this menu is 1 With the Manager application open click on Tunnel 2 Click the IPSec radio button and then click OK 3 The follow...

Page 25: ...dresses else the packet is discarded Local IP Address Mask defines the source IP address Remote IP Address defines destination IP address For any IP packet that is to be forwarded IP Office determines...

Page 26: ...s 192 168 42 1 Mask 255 255 255 255 b IP Address 192 168 42 0 Mask 255 255 255 0 4 A single condition in terms of addressing can be specified for a given SA The SA condition can be applied between two...

Page 27: ...rtant to understand the requirements in the detail of these tabs but it is however important that they are matched between two IPSec peers seeking to establish an SA During Phase 1 of negotiations IKE...

Page 28: ...hide the IDs of the communicating device ID is slower but does hide the IDs of the communicating device Encryption DES or 3DES Set the encryption method Authentication MD5 128 bit default SHA 160 bit...

Page 29: ...header Also authenticates the packet payload on a packet by packet basis AH No encryption encapsulation or confidentiality Only authentication and integrity Also authenticates portions of the IP head...

Page 30: ...Remote Configuration Account Name and Password Used to set the PPP authentication parameters The Local name is the username that is used in outgoing authentication The Remote name is the username that...

Page 31: ...Retransmission Interval Default 0 The time delay before retransmission Receive Window Size Default 4 The number of unacknowledged packest allowed Sequence numbers on Data Channel Default On When on ad...

Page 32: ...o wait for response to a PPP keep alive message The connection is terminated if the peer fails to respond to 3 LCP Echo Requests Increasing this value will increases the time IP Office takes to determ...

Page 33: ...Address of the next hop router see Guidelines below Gateway MAC Address The Ethernet MAC address of the next hop router see Guidelines below Firewall A Firewall Profile that is associated to this int...

Page 34: ...ows and Unix systems Ethereal provides real time analysis of network traffic and capture to disk The application is available for download at http www ethereal com Some of the examples include packet...

Page 35: ...N interface address Step 3 Within Manager right click the IP Route entity and create a new IP Route Add a default route for Internet access pointing to the Logical LAN interface IP Address un configur...

Page 36: ...16 IP Mask 255 255 255 248 DHCP Disabled Enable NAT selected Firewall Profile un configured Firewall is optional in this configuration This configuration uses the NAT functionality on LAN2 Without thi...

Page 37: ...ng for shared resources Internet access for corporate users Secure IP telephony between corporate sites Figure 19 IP Office to IP Office via Logical LAN The following step by step instructions describ...

Page 38: ...required for each IP Office system in an SA Make sure the IPSec licences are valid on both systems Licence name IPSec Tunneling Step 4 For IP Office A create an IPSec tunnel Main tab Name IPSec_Tunne...

Page 39: ...nnel The Gateway is the IPSec tunnel endpoint address Step 8 For IP Office B use the parameters shown in Steps 5 and 6 to complete the IKE and IPSec form configurations In order for an IPSec SA to be...

Page 40: ...rporate office IP412 IPO_CO is the central VPN terminator and the PABX data router for several remote branch offices equipped with IP Office Small Office Editions Figure 20 L2TP IPSec IP Office to IP...

Page 41: ...ion Step 2 For Branch No 1 create an L2TP tunnel and apply the same parameter values as in the previous step except for the parameter shown below Remote IP Address 217 37 65 126 The Remote IP Address...

Page 42: ...3 0 IP Mask 255 255 255 0 Gateway un configured Destination L2TP 2 IP Address un configured IP Mask un configured Gateway 217 37 69 118 Destination LAN2 These routing entries will allow the tunnel to...

Page 43: ...th tunnel endpoints must have the same shared secret Encryption set to DES Authentication set to MD5 Diffie Hellman Group Group 2 This is the time period before a new key is generated 86400 represents...

Page 44: ...ssages appear This Signifies that the IPSec Tunnel is up When passing data through the tunnel you should see ESP packets on the protocol analyser Use SysMonitor to view PPP packet exchanges PPP echo R...

Page 45: ...hed IPsec tunnel and is not be secured One of the key aspect to this application is that IP Office support Dynamic tunnels IP Office is able to create a Dynamic tunnel in the case were the IP address...

Page 46: ...l ID Type IP address 217 37 69 116 My Identity Pre shared Key password Select Certificate None ID Type IP Address Port All Virtual Adapter Disable Internet Interface Local _NIC_Card_Name IP Address 21...

Page 47: ...ocal IP Mask 255 255 255 0 Tunnel Endpoint IP Address LocalInterface Remote IP Address unconfigured Remote IP Mask unconfigured Tunnel Endpoint IP Address unconfigured A discrete name for the IPSec tu...

Page 48: ...o MD5 This is the time period before a new key is generated 86400 represents one day in seconds Step 7 Check connection Activate the Security Policy on the Windows PC by right clicking the SoftRemote...

Page 49: ...er Compression Mode unselected Multilink QoS unselected In support of numbered PPP interface mode add the following to IP tab of the WAN Service form Location A IP Address 10 10 20 1 IP Mask 255 255 2...

Page 50: ...0 10 20 2 Remote Configuration IP Address 192 168 42 0 IP Mask 255 255 255 0 Tunnel Endpoint IP Address 10 10 20 1 See notes in step 3 above The Local Tunnel Endpoint IP Address is the near end tunnel...

Page 51: ...ation A create an IPSec tunnel see The IP Security Menu on page 24 Main tab Local Configuration Name IPSec_Tunnel IP Address 192 168 42 0 IP Mask 255 255 255 0 Tunnel Endpoint IP Address 192 168 42 1...

Page 52: ...e LAN1 IP address of Location A Step 5 For both IP Office Location A and Location B perform the following IKE Polices tab Shared Secret password Exchange Type ID port Encryption DES Authentication MD5...

Page 53: ...Step 2 Within Manager for Office A create an IP Line and apply the following parameters Using the Line tab of the IP Line form Line Number 2 OutGoing Group ID 2 The IP Line is used to configure the V...

Page 54: ...or IP Office B set the destination VoIP Gateway to the IP address of the Internal interface address of IP Office B Use VoIP tab of the IP Line to set the following parameters Gateway IP Address 192 16...

Page 55: ...s Ensue the following parameters are configured Gatekeeper tab on the system form Auto Create Extension selected Gatekeeper Enable selected LAN1 tab on the System form DHCP Mode Server Ensure that the...

Page 56: ...hange Carrier and local telephone companies to their local subscribers ESP Encapsulating Security Payload Within the IPSec architecture the packet format for algorithms and general issues associated w...

Page 57: ...ame of the company which controls the US patent on the algorithm SA Security Association A relationship established between two or more entities to enable them to protect data they exchange The relati...

Page 58: ...es has been transferred or licensed to Avaya All trademarks identified by or TM are registered marks or trademarks respectively of Avaya Inc All other trademarks are the property of their respective o...

Reviews: