Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 407 / 861

406 Providing remote access using VPN tunnels
Multicast traffic through gateway-to-gateway IPsec tunnels
To create a gateway-to-gateway tunnel for the subnets
1 Create a subnet network entity for 10.10.10.1.
2 Create a subnet network entity for 10.10.20.1.
3 Create a gateway-to-gateway VPN tunnel, and for the local endpoint, use the 10.10.20.1 subnet
entity, and then do the following:
■
Use the 10.10.10.1 subnet entity as the remote endpoint.
■
Use the security gateway network entity for eth1 as the local gateway.
■
Use the security gateway network entity for the remote security gateway as the remote
gateway.
You may configure an appropriate VPN policy for use with this VPN tunnel.
Related information
None.
Configuring multicast support for a gateway-to-gateway IPsec tunnel
Use the following procedures on both security gateways to configure gateway-to-gateway IPsec tunnel
support.
Configure multicast support for a gateway-to-gateway IPsec tunnel
First, edit the security gateway initialization file (raptor.init) to add two additional commands
immediately following the multicast callout and allmulti commands:
■
/usr/raptor/bin/vpn set Global/Tunnel_MULTICAST_Routing_Enable True
■
/usr/raptor/bin/vpn set Global/Verify_Packet_Exiting_Tunnel False
Second, use the SGMI to configure the following advanced option:
vpnd.verify_packet_exiting_tunnel = false
Note: The example multicast interface in the raptor.init file below uses eth0. Replace the interface ID
numbers with the proper IDs specific to your solution.
Prerequisites
None.
To configure multicasting support for gateway-to-gateway IPsec tunnels
1
From an SSH or Microsoft HyperTerminal (serial port) connection to the security gateway, edit:
/etc/init.d/raptor.init
2 Insert the commands (see bold text), just under the multicast interface option as it appears below:
# multicast callout
/usr/raptor/bin/vpn set Callout/Multicast_Forwarding True
# multicast interface
ifconfig eth0 allmulti
# multicast through tunnel
/usr/raptor/bin/vpn set Global/Tunnel_MULTICAST_Routing_Enabled True
/usr/raptor/bin/vpn set Global/Verify_Packet_Exiting_Tunnel False
;;