Siemens RUGGEDCOM ROX II, User Manual

Page: 471 / 798

RUGGEDCOM ROX II
CLI User Guide
Chapter 12
Tunneling and VPNs
Example: Configuring an Encrypted VPN Tunnel 425
Parameter Value
Value 2.2.2.2
For more information about configuring connection ends, refer to Section 12.8.9, “Configuring the
Connection Ends” .
g. Add subnet 192.168.60.0/24 for the right connection end. For more information, refer to
Section 12.8.10.3, “Adding an Address for a Private Subnet” .
h. Configure the left connection end for the IPsec tunnel with the following public IP address parameters:
Parameter Value
Type address
Value 2.2.2.1
For more information about configuring connection ends, refer to Section 12.8.9, “Configuring the
Connection Ends” .
i. Add subnet 192.168.50.0/24 for the left connection end. For more information, refer to
Section 12.8.10.3, “Adding an Address for a Private Subnet” .
4. Enable the IPsec tunnel. For more information, refer to Section 12.8.2, “Configuring IPsec Tunnels” .
5. Verify the tunnel status and make sure the traffic between the two sites is encrypted:
a. View the IPsec tunnel status and look for a message that includes the connection name and the words
erouted; eroute owner: . For example:
000 "
ipsec-12
": 192.168.22.0/24===192.168.12.2<192.168.12.2>[C=CA, ST=Ontario, O=RuggedCom,
CN=router2, E=router2@example.com,+S=C]...192.168.12.1<192.168.12.1>[C=CA, ST=Ontari o,
O=RuggedCom, CN=router1, E=router1@example.com,+S=C]===192.168.11.0/24; erouted; eroute owner:
#2
This indicates the IPsec tunnel is active.
For more information, refer to
Section 12.8.4, “Viewing the IPsec Tunnel Status” .
b. Capture the packets using Tcpdump on one of the tunnel interfaces. Encrypted traffic will display an ESP
header. For more information about using the Tcpdump utility, refer to Section 2.4.9, “Capturing Packets
from a Network Interface” .
Final Configuration Example
The following configuration reflects the topology:
Device A
# show full-configuration
tunnel
ipsec
enabled
preshared-key 2.2.2.2 2.2.2.1
key SiEm3nsRu993dc@m
!
connection test
startup start
authenticate secret
connection-type tunnel