McAfee SG310, Руководство администратора

Страница: 300 / 412

300 McAfee UTM Firewall 4.0.4 Administration Guide
VPN menu features
IPSec failover
3
Once this primary IPSec tunnel is running and working, disable the primary tunnel at both the Branch
Office and Headquarters UTM Firewalls by deselecting the associated checkbox on the IPSec screen.
4
Set up the "secondary" IPSec tunnel with two subnets on both the Headquarters and the Branch office
UTM Firewalls and make sure that it is working. For each field, use the default values unless an alternative
setting is given in
Table 24 or Table 25 .
Dead Peer Detection enabled
Remote Required Endpoint ID primary@branch
Preshared Secret <primary secret>
Local Network 1 192.168.1.0/24
Remote Network 1 192.168.2.0/24
Local Network 2 192.168.11.1/32
Remote Network 2 192.168.12.1/32
Table 23 Primary IPSec tunnel – Branch Office UTM Firewall configuration
Field Value
Tunnel name primary
Local interface default gateway interface
Keying Aggressive mode (IKE)
Local address dynamic IP address
Remote address: static IP address
Local Required Endpoint ID primary@branch
Dead Peer Detection enabled
Remote Required Endpoint ID primary@HQ
Preshared Secret <primary secret>
Local Network 1 192.168.2.0/24
Remote Network 1 192.168.1.0/24
Local Network 2 192.168.12.1/32
Remote Network 2 192.168.11.1/32
Table 24 Secondary IPSec tunnel – Headquarters UTM Firewall configuration
Field Value
Tunnel name secondary
Local interface <select interface for secondary
link>
Local interface gateway Use Interfaces Default Gateway
Keying Aggressive mode (IKE)
Local address static IP address
Remote address: dynamic IP address
Local Optional Endpoint ID secondary@HQ
Dead Peer Detection enabled
Remote Required Endpoint ID secondary@branch
Preshared Secret <secondary secret>
Local Network 1 192.168.1.0/24
Remote Network 1 192.168.2.0/24
Local Network 2 192.168.11.1/32
Remote Network 2 192.168.12.1/32
Table 22 Primary IPSec tunnel – Headquarters UTM Firewall configuration <Comment>(continued)
Field Value