Avaya Media Gateway G250, Administration Manual

Page: 557 / 840

Configuring a site-to-site IPSec VPN
Issue 5 June 2008 557
Configuring IPSec VPN
Prerequisites
As a prerequisite to configuring IPSec VPN, a valid VPN license must be installed on the
G250/G350. For details, see
Installing the VPN license file on page 556.
IPSec VPN configuration overview
To configure a site-to-site IPSec VPN, two devices (the G250/G350 and a peer Gateway) must
be configured symmetrically.
In some cases, you may wish to configure global VPN parameters (see Configuring global
parameters on page 570).
Note:
Note:
In the following sections, all IPSec VPN parameters that you must configure are
indicated as mandatory parameters. Non-mandatory VPN parameters have default
values that are used unless otherwise set. Thus for example, although it is mandatory
to define at least one ISAKMP policy, it is not mandatory to set the values for that
ISAKMP policy since the G250/G350 contains default ISAKMP policy settings.
Coordinating with the VPN peer
Before commencing IPSec VPN configuration, you must resolve jointly with your VPN peer the
basic parameters so that IPSec VPN can be set up symmetrically in the two peers. If the IPSec
VPN configuration in the two peers does not match, no VPN is created.
Note:
Note:
If you will be defining a peer-group which maintains a list of redundant peers,
each of the peers in the group must be configured to match the G250/G350.
The basic parameters include:
●
The IKE phase 1 parameters (as defined in the ISAKMP policy, see Configuring ISAKMP
policies on page 558)
●
The IKE phase 2 parameters (as defined in the transform-set, see Configuring
transform-sets on page 559)
●
The ISAKMP peer parameters (see Configuring ISAKMP peer information on page 561)
●
Which packets should be secured (as defined in the crypto list, see Configuring crypto
lists on page 567)