Administration of the Avaya G350 Media Gateway - Avaya Support

Configuring IPSec VPNConfiguring the simple VPN topologyThis section describes how to configure the simple VPN topology, followed by a detailedconfiguration example.To configure the simple VPN topology1. Configure each branch as follows:● The default gateway is the Internet interface.● VPN policy is configured on the Internet interface egress as follows:Traffic from the local subnets to anyone is encrypted, using tunnel mode IPSec,with the remote peer being the Main Office (the VPN Hub)● ACL is configured on the Internet interface to allow only the VPN / ICMP traffic, asfollows:Ingress:1. IKE from remote tunnel endpoint to local tunnel endpoint -> Permit2. ESP from remote tunnel endpoint to local tunnel endpoint -> Permit3. ICMP from anyone to local tunnel endpoint -> PermitNote:Note:Note:This allows PMTUD application to work.4. All allowed services from anyone to any local subnet -> PermitNote:Due to the definition of the VPN Policy, this will be allowed only if traffic comesover ESP.5. Default -> DenyEgress:1. IKE from local tunnel endpoint to remote tunnel endpoint -> Permit2. ESP from local tunnel endpoint to remote tunnel endpoint -> Permit3. ICMP from local tunnel endpoint to anyone -> PermitNote: This allows the PMTUD application to work.4. All allowed services from any local subnet to anyone -> PermitNote: This traffic is tunnelled using VPN.5. Default -> Deny2. Configure the VPN Hub (Main Office) as follows:● Static routing: Branch subnets -> Internet interface.● The VPN policy portion for the branch is configured as a mirror image of the branch, asfollows:Traffic from any to branch local subnets -> encrypt, using tunnel mode IPSec, with theremote peer being the VPN Spoke (Branch Internet address).222 Administration of the Avaya G350 Media Gateway