RadiSys SEG-100, Administration Manual

Page: 182 / 198

11
I-WLAN
182
To set up a stitched interface pair, the StitchedInterface= property for each interface is set to
the other interface in the pair. With I ‐ WLAN for example, a GTP tunnel may be set up as
follows:
Device:/> add Interface GTPInterface Gn

LocalEndpoint=gn_ip InterceptDHCPInform=Yes

StitchedInterface=MS
The IPsec tunnel in the pair is then defined as:
Device:/> add Interface IPsecTunnel MS

"

"

StitchedInterface=Gn
Using IP rules
It is important in an I ‐ WLAN setup to create the appropriate IP rules in the main SEG IP rule
set.
These rules consist of Deny rules that prevent traffic flowing between particular components
of the network, as well as Allow rules which explicitly permit traffic flow.
At minimum, IP rules should perform the following functions for I ‐ WLAN:
1. Prevents communication between external clients.
2. Allow DNS lookup to be performed by clients.
3. Allow HTTP traffic to flow from clients to the public Internet.
Adding client routing
As clients connect in a I ‐ WLAN solution, there has to be a route for the client in the relevant
SEG routing table (usually the main table). This routes the IP address handed out to the client
by the GGSN through the IPsec tunnel to the client. There are two ways this route can exist:
• A separate route can be added automatically every time a client connects by enabling the
IPsec tunnel option AddRouteToRemoteNetwork .
• A single static route is added manually. This routes the entire network range used for
client IP addresses on the IPsec tunnel object (which is treated like an interface in the
SEG).
The number of connected clients can usually become large with I ‐ WLAN, so the second option
of manually adding a static route is recommended. This avoids the processing overhead of
continually adding and removing client routes, as well as reducing the routing table lookup
overhead.