Nortel BCM 3.7, Manual

Page: 769 / 1004

IPSec 769
Programming Operations Guide
Networks would have two networks configured as 10.10.10.0 with a mask 255.255.255.0 and
10.10.11.0 with a mask 255.255.255.0 and the Remote Accessible Networks would be 12.12.12.0
with a mask of 255.255.255.0. All packets that do not match these rules will be NATed and sent
out the interface and not through the tunnel. This is a useful configuration if access to both the
Internet and the other side of an IPSec tunnel is desired.
Dialup ISDN connections
When you are creating an IPSec tunnel over a Dialup ISDN connection, the endpoint must have a
fixed IP address.
Compatibility with Contivity Extranet Switch and Shasta 5000
When connecting to a Contivity Extranet Switch, you must disable Vendor ID and Compression
under Base Class on the Contivity Extranet Switch.
Business Communications Manager does not support the IPSec RIP implementation used by the
Contivity Extranet Switch. Use Static Routes when connecting to the Contivity Extranet Switch.
When connecting to a Shasta 5000, you must set the PFS to No on the Tunnel configuration of
Business Communications Manager.
IPSec and PPTP
The Remote Accessible Networks of an IPSec tunnel cannot be the same as a Destination Network
on a PPTP tunnel. The Remote Endpoint of an IPSec tunnel’s Remote Endpoint cannot be the
same as a Destination Endpoint on a PPTP tunnel.
Multiple IP Address restrictions
Although the Business Communications Manager supports the configuration of additional IP
addresses on its network interfaces, IPSec does not currently support the use of these additional IP
addresses for Branch Office Local Endpoint Addresses, Remote Endpoint Addresses or the
Destination IP Address for IPSec VPN Clients.
For more information about Multiple IP addresses, refer to “Configuring multiple IP addresses for
the LAN interface” on page 671 .
Firewall rules for IPSec Branch Office and Remote User Tunnels
In order to allow IPSec packets through the firewall interface which blocks all incoming packets, a
number of rules must be configured. In addition to allowing the IPSec packets through, you must
also remember to create rules to allow the packets that come through the tunnel.
In the Branch office case, up to three rules must be created. One is for the key exchange protocol
(IKE), the other two are for the type of protocol used (ESP and/or AH).
Table 226 , Table 227 and
Table 228 show the rules required (these are all inbound rules).