Nortel BCM 3.7, Manual

Page: 770 / 1004

770 IPSec
N0008589 3.3
You can create these rules automatically when creating or modifying Branch Office and Remote
Tunnels by selecting
Yes for the Create Firewall Rules for this tunnel on the Parameters page
for a particular tunnel. The three firewall rules required by the Branch Office tunnels are then
created. You can view these rules on the Input Filters' Rule Setting screen for the interface used. If
the Branch Office tunnel is enabled and IPSec is enabled globally, then the three rules created are
added to the front of the Rule Order that appears on the Input Filters' Rule Order screen for the
interface used. If the Branch Office tunnel is later disabled, then the rules are removed from the
Rule Order, but still exist on the Input Filters' Rule Setting screen. If the user selects
No for the
Create Firewall Rules for this tunnel option, then the three firewall rules created for the Branch
Office tunnel are deleted.
You can also create firewall rules for Remote User tunnels. The rule creation process is the same
as for Branch Office tunnels except that the user must select which interface they want to create
firewall rules for. The six rules in
Table 226 to Table 231 are created for Remote User tunnels if
you select Yes for the Create Firewall Rules for Interface option.
Table 226 Firewall rules for IKE
Protocol UDP
Source IP Remote Endpoint address for Branch Office; Client PC IP address for Remote User
Source Mask 255.255.255.255
Source Port 500
Destination IP Local Endpoint address
Destination Mask 255.255.255.255
Destination Port 500
Table 227 Firewall rules for ESP
Protocol IPSEC_ESP
Source IP Remote Endpoint address for Branch Office; Client PC IP address for Remote User
Source Mask 255.255.255.255
Destination IP Local Endpoint address
Destination Mask 255.255.255.255
Table 228 Firewall rules for AH
Protocol IPSEC_AH
Source IP Remote Endpoint address for Branch Office; Client PC IP address for Remote User
Source Mask 255.255.255.255
Destination IP Local Endpoint address
Destination Mask 255.255.255.255