Efficient Networks
®
Router family
Command Line Interface Guide
Chapter 12: IKE/IPsec Commands
Efficient Networks
®
Page 12-21
ike ipsec policies set translate
Defines a translate filtering parameter value for the policy. The translate option
determines whether the router applies NAT (network address translation) before the
packets are encrypted by IPSec.
NOTE:
The remote must have IP address translation enabled (see “
Network Address
Translation (NAT)” on page 4-17.
Or, the
remote setiptranslate
command).
NOTE:
The address that NAT translates to should be the source or destination address for
the policy (use the
ike ipsec policies set source
or
ike ipsec policies set dest
command).
Use this option when several remote sites have the same IP subnet, making it
impossible to tunnel those sites unchanged to the corporate network.
When the router’s public IP address is not the desired choice for the network address
translation, you can define a virtual Ethernet interface. A virtual Ethernet interface can
be created to translate to an arbitrary IP address (see “
IP Subnets” on page 6-1.
).
Again, be sure that the virtual Ethernet interface has IP address translation enabled
(
eth ip translate
), and use the virtual Ethernet interface as the gateway to the other
end of the protected network. (See the example below.) You can use the
eth ip
addhostmapping
command to map a range of NAT addresses to private addresses so
the IKE tunnel can be initiated from either end.
Mgmt Class
Security (R/W)
Input Format
ike ipsec policies set translate on | off <policyname>
Parameters
on | off
Sets the translate option on or off. If translate is set to on, trans-
lation is applied before encryption, and the packets are sent us-
ing the host router’s public IP address.
<policyname>
a
a
ASCII string
Name of the IPsec policy to which the source port parameter val-
ue is added.
b
b
To see the policy names, use the
ike ipsec policies list
command.
