7
IPsec VPN
136
IPsec LAN to LAN with pre-shared keys
1. Create
a
new
IPsecPSK
object.
This
will
contain
the
key
as
well
as
a
unique
combination
of
LocalID
and
RemoteID
.
It
is
this
combination
of
local
and
remote
ID
that
is
used
to
associate
the
key
with
the
tunnel.
Both
local
and
remote
ID
can
take
on
any
string
value
such
as
an
IP
address
or
e
‐
address.
They
can
also
incorporate
the
wildcard
asterisk
(“*”)
character.
Note:
If
the
wildcard
character
is
used
in
an
e
‐
address,
it
must
not
be
combined
with
other
characters.
For
example,
cannot
be
used
but
*.somename.com
can.
2. Optionally
create
an
IKEProposalList
and/or
IPsecProposalList
object
if
the
default
proposal
lists
do
not
provide
a
set
of
algorithms
that
are
acceptable
to
the
tunnel
remote
end
point.
The
ike_high
and
ipsec_high
lists
are
the
defaults.
An
IKEProposalList
object
must
contain
at
least
one
IKEProposal
object.
Similarly,
an
IPsecProposalList
object
must
contain
at
least
one
IPsecProposal
object.
If
PFS
is
required
the
IPsec
proposal
must
have
DH
groups
specified
otherwise
PFS
is
disabled
(the
default).
3. In
the
Address
Book
create
IP
objects
for:
•
The
remote
VPN
gateway
that
is
the
IP
address
of
the
network
device
at
the
other
end
of
the
tunnel
(
remote_gw
).
•
The
remote
network
which
lies
behind
the
remote
VPN
gateway
(
remote_net
).
•
The
local
network
behind
the
SEG
that
will
communicate
across
the
tunnel.
Assume
that
this
is
the
predefined
address
sfp1net
and
this
network
is
attached
to
the
SEG
sfp1
interface
that
has
the
IP
address
sfp1_ip
.
4. Create
an
IPsecTunnel
object
(
ipsec_tunnel
).
Specify
the
following
tunnel
properties:
•
Set
the
IPaddress
property
of
the
tunnel.
In
most
cases
this
can
be
set
to
something
arbitrary
such
as
127.0.0.1
.
If
NAT
is
being
used
on
outgoing
traffic,
this
should
be
set
to
an
address
in
the
local
network.
•
Set
LocalEndpoint
to
sfp1_ip
.
•
Set
LocalNetwork
to
sfp1net
.
•
Set
RemoteNetwork
to
remote_net
.
•
Set
RemoteEndpoint
to
remote_gw
.
•
If
not
using
the
default
ike_high
list,
set
IKEProposalList
to
the
proposal
list
to
be
used
for
the
tunnel.
