724-746-5500 | blackbox.com
Page 102
Chapter 8: Virtual Private Networks
8.4 Developing a Virtual Private Network
Table 8-1. Information Required to Configure the WRT4000 Series Cellular Wireless Router for VPNs (Sheet 1 of 2).
Item
Central Site
Remote Site
WAN IP Address
Usually a public IP address supplied by
your internet service provider, e.g.,
68.x.x.34
Supplied by the service provider, e.g., 65.x.x.72. (If
the WAN IP address is issued by the remote server,
select Dynamic.)
WAN Subnet Mask
Subnet mask for the address above,
e.g., 255.255.255.252
Subnet mask for the address above, e.g.,
255.255.255.240 (not applicable if WAN IP address
is dynamic)
WAN Default Router (a.k.a.
Default Gateway)
The next hop router for the WAN IP
address, e.g., 68.x.x.33
IP address of the remote modem, e.g., 65.x.x.65
(not applicable if WAN IP address is dynamic)
VPN Gateway IP Address or
DNS Name (required only
for end that initiates tunnel)
Required only if the central site is the
initiator. This will be the WAN IP address
of the remote site unit or the DNS name
of the remote site unit—e.g., 71.24.32.12
or www.Blackbox.com
Required only if the remote site is the initiator. This
will be the WAN IP address of the central site unit
or the DNS name of the central site unit—e.g.,
71.24.32.12 or www.Blackbox.com
LAN IP Address
Fixed address on the LAN segment to be
assigned to the router LAN port, e.g.,
10.10.10.1
Fixed address on the LAN segment to be assigned
to the router LAN port, e.g., 192.168.1.1
LAN Subnet Mask
Subnet mask for the address above, e.g.,
255.255.255.0
Subnet mask for the address above, e.g.,
255.255.255.0
DHCP IP Address Pool
(Range, from low to high)
If the router is to issue IP addresses via
DHCP on the LAN side, enter the address
range here, e.g., 10.10.10.2 to
10.10.10.24.
If the router is to issue IP addresses via DHCP on
the LAN side, enter the address range here, e.g.,
192.168.1.2 to 192.168.1.10.
Additional Security
Information Required . . .
. . .When Running IPsec Encryption
. . . If the WRT4000 Series Cellular Wireless Router
is to Provide DNS Information
User ID
Must be the same at both ends, e.g.,
user1@site2 or test123
Primary DNS address
Preshared Key
Maximum of 18 characters. Must be the
same at both ends, e.g., e2we36TJK@
s8h12Q
Secondary DNS address
8.4.1 VPN Configuration Plan
The following tables provide an example of planning a configuration for your virtual private network users.
The IP Policy Table
IP Policy Tables are used to establish processes and types of connections. Table 8-2 shows a sample IP Policy Table.
Each policy includes the VPN profile that the connection must use; the user must also be authorized to use the specified profile.
Your organization’s IP Policy Table may include additional fields.
The WRT4000 Series Cellular Wireless Router’s IP Policy Table is set up in Section 4.4.5, Firewall Configuration in Chapter 4,
Configuration.
NOTE: In Table 8-2, the column for Record 2 provides an example of tunnel termination: If a record’s Direction is “incoming,” then
the record’s Source IP Addresses (in the range from Low to High) indicate one or more remote devices. If the Action is
“tunnel termination,” a device with an IP address in the source range can initiate a tunnel that the local device will accept.)
