Administration of the Avaya G350 Media Gateway - Avaya Support

Configuring a site-to-site IPSec VPNImportant:! Important:You must define at least one transform-set.G350-001# crypto ipsec transform-set ts1 esp-3des esp-md5-hmacG350-001(config-transform:ts1)#2. Configure the following transform-set parameters:●●●set pfs: specifies whether each IKE phase 2 negotiation will employ PFS (PerfectForward Secrecy), and if yes – which Diffie-Hellman group to employ. PFS ensures thateven if someone were to discover the long-term secret(s), the attacker would not be ableto recover the session keys, both past and present. In addition, the discovery of asession key compromises neither the long-term secrets nor the other session keys. Thedefault setting is no set pfs.set security-association lifetime seconds: the security association lifetimein seconds using the CLI commandset security-association lifetime kilobytes: the security associationlifetime in kilobytesG350-001001(config-transform:ts1ts1)# set pfs group2Done!G350-001(config-transform:ts1)# set security-association lifetime seconds7200Done!G350-001(config-transform:ts1)# set security-association lifetimekilobytes 2684354563. Exit the crypto transform-set context using the exit CLI command.G350-001(config-transform:ts1)# exitG350-001#Configuring ISAKMP peer informationISAKMP peer information defines the remote peer identification, the pre-shared key used forpeer authentication, and the ISAKMP policy to be used for IKE phase 1 negotiations betweenthe peers.Important:Note:! Important:It is mandatory to define at least one ISAKMP peer.Note:You can define up to 50 ISAKMP peers.Issue 3 January 2005 211