56
MDS Orbit MCR-4G Technical Manual
MDS 05-6628A01, Rev. B
2. Create an IPsec policy and configure the following ciphersuite to be included as proposal for IKE
phase-2 negotiation:
• Encryption Algorithm = AES 256 Bit in CBC mode
• Message Authentication Algorithm = HMAC using SHA256 digest
• Diffie-Hellman Group = DH-14 (group 14 modp2048)
admin@(none) 19:33:29% set services vpn ipsec policies policy IPSEC-POLICY-1 ciphersuites cipher-
suite AES256_CBC-SHA256-DH14 encryption-algo aes-256-cbc
admin@(none) 19:33:29% set services vpn ipsec policies policy IPSEC-POLICY-1 ciphersuites cipher-
suite AES256_CBC-SHA256-DH14 mac-algo sha256-hmac
admin@(none) 19:33:29% set services vpn ipsec policies policy IPSEC-POLICY-1 ciphersuites cipher-
suite AES256_CBC-SHA256-DH14 dh-group dh-14
NOTE:
More than one ciphersuite can be included in the proposal.
3. Create IPsec connection
admin@(none) 19:33:29% set services vpn ipsec connections connection VPN-GWY-CONN-1 ike-peer
VPN-GWY
admin@(none) 19:33:29% set services vpn ipsec connections connection VPN-GWY-CONN-1
ipsec-policy IPSEC-POLICY-1
admin@(none) 19:33:29% set services vpn ipsec connections connection VPN-GWY-CONN-1
local-ip-subnet 192.168.1.0/24
admin@(none) 19:33:29% set services vpn ipsec connections connection VPN-GWY-CONN-1
remote-ip-subnet 192.168.2.0/24
admin@(none) 19:33:29% set services vpn ipsec connections connection VPN-GWY-CONN-1
failure-retry-interval 1
The following table describes the VPN connection attempt retries and time interval between them. After
giving up as listed below, the unit waits for “failure-retry-interval” and repeats the connection attempt
sequence.
During initial configuration set failure-retry-interval to lowest value of 1 min, to have MCR attempt con-
nection more quickly. This allows debugging of any connection-related issue by watching logs on peer side
etc. Be sure to change this value to 5 mins or higher to prevent excessive attempts and traffic.
4. Commit configuration and exit configuration mode.
admin@(none) 20:38:44% commit
Attempt#
Relative Timeout between
attempts (in secs)
Absolute Timeout from
first attempt (in secs)
1
0
0
2 (1
st
retry)
4
4
3 (2
nd
retry)
7
11
4 (3
rd
retry)
13
24
5 (4
th
retry)
23
47
6 (5
th
retry)
42
89
give up
76
165
Wait for “failure-retry-interval”, then repeat above sequence
