Page 18 - Overview of Secure VPN Implementation
Internal LAN
An Internal LAN or private Internet is a secure networking area that has Internet access
but is protected from the Internet by an external or “demilitarized zone”. Typically an
internal LAN will use a private IP addressing scheme. The Internet Assigned Numbers
Authority (IANA) has reserved the following three blocks of the IP address space for
private internets:
10.0.0.0
- 10.255.255.255
(10/8 prefix)
172.16.0.0 - 172.31.255.255
(172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)
The pertinent IP Office features and function for VPN networking that relate to the
Internal LAN are summarized in this section.
Feature Description
DHCP Server
IP Office can perform the functions of a DHCP server for the
Local LAN attached devices.
Wireless Networking
IP Office Small Office Edition supports 802.11b for wireless
networking.
Telephony
Extensive and proven telephony features including Small
Community Networking allow VPN wide virtual PABX .
Client VPN
A VPN client application is used to initiate secure VPN tunnels from a personal
computer (PC) or notebook to a secure gateway. A VPN client application can be used,
for example, to secure remote dial up connection over the Internet to the corporate
office. Once the VPN client connection is established the PC and user application can
be used transparently. Using MS-Windows, once the IPSec connection has been
established an L2TP connection can then be established over the IPSec VPN. The IP
Office Phone Manger Pro application can be used in conjunction with the supported
VPN clients for secure VoIP transmission over the Internet.
IP Office running 3.0 software supports dynamic VPN endpoints. The dynamic VPN
Tunnel support allows a VPN connection to be established in the instance where the
VPN client IP address is unknown. This is the case for example when the Client VPN is
initiated from a PC on a dialup ISP connection. Typically, in a dialup ISP connection, IP
addresses are allocated only for the duration of the connection.
When configuring a dynamic tunnel endpoint on IP Office the same IPsec configuration
form and hence the same password is used to facilitate all such remote users
Guidelines
1. Certificate Authority (CA) authentication is not supported for IPSec.
2. When using the generic Windows environment for IPSec, client operation uses the
Microsoft Management Console (MMC) to add the IP Security Policy management
snap-in. A windows register key change is required in order to support IPSec in pre-
shared mode. To avoid this requirement, Avaya recommends the use of the
NetScreen VPN client.
3. When configuring multiple Dynamic tunnels all such tunnels are supported by a
single IPSec configuration instance (all remote users share the same pre-shared
secret).
Page 18 - Overview of Secure VPN Implementation
IP Office (R3.0)
Typical VPN Deployment
40DHB0002UKER Issue 3 (4th February 2005)
