Tunnel IPSEC
U
SER
G
UIDE
246
to download the certificates via TFTP
ipsec-cert upload <certificate> to <IP>
to upload the certificates via TFTP
ipsec-cert list
to show the list of the installed and downloaded certifcates
ipsec-cert install
to install all the certificate previously downloaded
ipsec-cert uninstall <certificate>
to unistall a previously installed certificate
ipsec-cert uninstall-all
to uninstall all the previously installed certificate
ipsec-cert delete <certificate>
to delete a specific certificate that has been downloaded.
These commands assume that the certificates has been generated by a Certification Authority (CA)
on an external system.
Questi comandi assumono che i certificati siano stati generati da una Certification Authority (CA) su
un sistema esterno.
Alternatively, you can make the router itself to generate locally its certificates and then apply for the
registration to an external CA. To do that, use:
make-and-enroll-cert <CA IPAddress>
that creates a group of certificates locally, then it connect to the CA set with the paramenters <
CA
IPAddress>
and applies for the regitration. Note that the router must be previously registered and
identified by the CA, using its MAC address.
T
UNNEL
GRE
OVER
IPS
EC
An interesting case of use of IPSec VPN is related to implementations of scenarios with protocol GRE
and NHRP, particularly useful when the traffic to be transferred to the channel is encrypted traffic
using Multicast. The following example shows a simple configuration of a VPN that seeks to achieve
this type of network topology:
set loopback 0 ipaddr 1.1.1.1
set loopback on
set gre tun0 name tun0
set gre tun0 tunnel-source 1.1.1.1
set gre tun0 tunnel-destination 88.34.166.18
set gre tun0 tunnel-address 192.168.3.2/24
set gre tun0 tunnel-peer 1.1.1.1/30
set gre tun0 multicast
set gre tun0 ttl 64
set gre tun0 mtu 1400
