Tunnel IPSEC
U
SER
G
UIDE
243
set ipsec start-via-trigger
if set, the service does not start at the next reboot, but only when you give an explicit activation
command, for example:
set trigger gprs up set ipsec on
the IPSec connection will be activated only when the mobile connection will be available.
Some configuration might require that all the outbound traffic must be encrypted, for example
when you don‟t know before what is the remote subnet. In this case, see the example below:
set ipsec phase1 MAIN remote-end 189.125.35.101
set ipsec phase1 MAIN local-end ppp0
set ipsec phase1 MAIN encryption-algorithm 3des
set ipsec phase1 MAIN hash-algorithm sha1
set ipsec phase1 MAIN dh-group 2
set ipsec phase1 MAIN authentication-method pre-shared-key
set ipsec phase1 MAIN lifetime 86400 sec
set ipsec phase1 MAIN exchange-mode main
set ipsec phase1 MAIN nat-t on
set ipsec phase2 3DES match-phase1 MAIN
set ipsec phase2 3DES encryption-algorithm 3des
set ipsec phase2 3DES authentication-algorithm hmac-sha1
set ipsec phase2 3DES pfs-group 2
set ipsec phase2 3DES lifetime 28800 sec
set ipsec phase2 3DES mode tunnel
set ipsec phase2 3DES security esp
set ipsec phase2 3DES level require
set ipsec phase2 3DES local-subnet 10.185.10.0/24
set ipsec phase2 3DES remote-subnet 0.0.0.0/0
set ipsec pre-shared-key 189.125.35.101 oqcmlmcdgeem@
set ipsec on
In this way all the traffic from the
10.185.10.0/24
subnet and going toward any destination, will
be encrypted.
The encryption could bring some problems on the local traffic (i.e. the traffic on the subnet
10.185.10.0/24
, so to avoid any trouble, you have to insert a new
access-list
, with which you
establish a certain type of non-encrypted traffic.
set ipsec phase2 LOCAL_LAN match-phase1 MAIN
set ipsec phase2 LOCAL_LAN encryption-algorithm none
set ipsec phase2 LOCAL_LAN authentication-algorithm none
set ipsec phase2 LOCAL_LAN local-subnet 10.185.10.0/24
set ipsec phase2 LOCAL_LAN remote-subnet 10.185.10.0/24
If you want to use the router as a VPN client (a.k.a. Easy VPN), the configuration is done by using:
set ipsec phase1 WARRIOR remote-end 88.34.54.33
set ipsec phase1 WARRIER local-end ppp0
