4RF Aprisa LTE, Руководство пользователя

Страница: 167 / 248

Managing the LTE | 167
Aprisa LTE User Manual 2.1
Setup secure GRE-over-IPsec connections (GRE tunnel inside IPsec VPN)
If the user requires a secure VPN, the IPsec VPN can be used without using inside a GRE tunnel, but IPsec
alone does not support multicast only GRE can provide that. Thus, it is more common to use GRE tunnel
inside an IPsec for a secure VPN that can carry any protocol. The Aprisa LTE can act as a GRE-over-IPsec
VPN endpoint.
Figure 20 describes the secure GRE-over-IPsec VPN connection to the corporate data center.
Figure 20 Setup secure GRE-over-IPsec connections
To setup the GRE-over-IPsec VPN connection per the above figure, perform the following steps:
1. Create a GRE tunnel. Navigate to SuperVisor ‘ Security > VPN ’ and on the GRE tab, click the Add
button. Set the GRE tunnel as described in the section above ‘Setup unsec ure GRE PTP VPN
connections’.
2. Create the IPsec Tunnel VPN. Navigate to the ‘IPsec Tunnel’ tab and click the Add button.
a. Set ‘Tunnel Name = IPsec_Tunnel_0’. This sets the IPsec tunnel ID. This ID is recommended to
be used on both end of the tunnel configuration.
b. Set ‘Mode’ as required, either ‘Tunnel’ or ‘Transport’. See description under ‘Security > VPN >
IPsec Tunnel’. In this example Mode = Transport.
c. Set ‘Local Subnet = 121.90.26.133’ when Mode = Tunnel. This is the source transport IP address
and subnet, i.e. the local endpoint interface of the IPsec tunnel. This is the same IP address of
‘Source Public Address’ in GRE tunnel settings. This field is greyed out when Mode = Transport.
d. Set ‘Remote Subnet = 100.65.3.118’ when Mode = Tunnel. This is the destination transport IP
address and subnet, i.e. the remote endpoint interface of the IPsec tunnel. This is the same IP
address of ‘Destination Public Address’ in GRE tunnel settings. This field is greyed out when Mode
= Transport.
e. Set the ‘Local subnet’ and ‘Remote subnet’ at the data center, respectively (IP address are
swapped at the data center for appropriate local/remote IP address interfacing).
f. Set the appropriate encryption, Authentication and DHGroup as required. Make sure this settings
match with the peer IPsec connection.
3. Create the IPsec VPN connection. Navigate to the ‘IPsec Connection’ tab and click the Add button.
a. Set ‘IKE Connection Name = IKE_Tunnel_0’. This sets the security association of Internet Key
Exchange protocol ID used by IPsec security suite. This ID is recommended to be used on both
ends of the IKE IPsec configuration.
b. Set ‘Remote Gateway = 100.65.3.118’. This is the destination transport IP address, i.e. the
remote endpoint interface of the IPsec tunnel. This is the same IP addre ss of ‘Destination Public
Address’ in GRE tunnel settings and ‘Remote Subnet’ in IPsec tunnel settings Note that in DMVPN
the remote gateway shall set to 0.0.0.0, since DMVPN automatically determine the address.
c. Set the ‘Authentication Method’ and the associated pre-shared key or certification.
d. Set the appropriate encryption, Authentication and DHGroup as required. Make sure this settings
match with the peer IPsec connection.
e. Set the ‘Associated Transport List’ by select the IPsec Tunnel name ‘IPsec_Tunnel_0’ from the
list.