Avaya Media Gateway G250, Administration Manual

Page: 558 / 840

Configuring IPSec VPN
558 Administration for the Avaya G250 and Avaya G350 Media Gateways
●
The peer addresses. For each peer, the local address entered in the crypto list (see
Configuring crypto lists on page 567) should match the ISAKMP peer address in the other
peer (see Configuring ISAKMP peer information on page 561).
●
NAT Traversal, if your installation includes one or more NAT devices between the local and
remote VPN peers. See
Configuring global parameters on page 570.
See IPSec VPN logging on page 575 for information on how to view IPSec VPN configuration in
both peers so as to pinpoint the problem in case of a mismatch between the two peers.
Configuring ISAKMP policies
An ISAKMP policy defines the IKE phase 1 parameters.
!
Important:
Important:
You must define at least one ISAKMP policy.
Note:
Note:
You can configure up to 40 ISAKMP policies.
1. Enter
crypto isakmp policy
, followed by an index number from
1
to
20
, to enter the
context of an ISAKMP policy list (and to create the list if it does not exist). For example:
2. You can use the following commands to set the parameters of the ISAKMP policy:
●
Use the
description
command to assign a description to the ISAKMP policy.
●
Use the
authentication pre-share
command to set the authentication of
ISAKMP policy to pre-shared secret.
●
Use the
encryption
command to set the encryption algorithm for the ISAKMP policy.
Possible values are
des
(default),
3des
,
aes
,
aes-192
and
aes-256
.
●
Use the
hash
command to set the hash (authentication) algorithm for the ISAKMP
policy. Possible values are
md5
and
sha
(default).
●
Use the
group
command to set the Diffie-Hellman group for the ISAKMP policy.
Possible values are
1
(default),
2
,
5
and
14
.
G350-001# crypto isakmp policy 1
G350-001(config-isakmp:1)#