Administration of the Avaya G350 Media Gateway - Avaya Support

Typical installationsConfiguring the mesh VPN topologyThis section describes how to configure the mesh VPN topology, followed by a detailedconfiguration example.To configure the mesh VPN topology:1. Configure branch office 1 as follows:● The default gateway is the Internet interface.● VPN policy is configured on the Internet interface egress as follows:● Traffic from the local subnets to the Second Spoke subnets -> encrypt, using tunnelmode IPSec, with the remote peer being the Second Spoke.●●Traffic from the local subnets to anyone -> encrypt, using tunnel mode IPSec,with the remote peer being the Main Office (VPN hub).ACL is configured on the Internet interface to allow only the VPN / ICMP traffic, as followsIngress:1. IKE from Main Office IP to Branch IP -> Permit2. ESP from Main Office IP to Branch IP -> Permit3. IKE from Second Branch IP to Branch IP -> Permit4. ESP from Second Branch IP to Branch IP -> Permit5. ICMP from anyone to local tunnel endpoint -> PermitNote: This allows the PMTUD application to work.6. All allowed services from anyone to any local subnet -> PermitNote: Due to the definition of the VPN Policy, this will be allowed only if traffic comesover ESP.7. Default -> DenyEgress:1. IKE from Branch IP to Main Office IP -> Permit2. ESP from Branch IP to Main Office IP -> Permit3. IKE from Branch IP to Second Branch IP -> Permit4. ESP from Branch IP to Second Branch IP -> Permit5. ICMP from local tunnel endpoint to anyone -> PermitNote: This allows the PMTUD application to work.6. All allowed services from any local subnet to anyone -> PermitNote: This traffic is tunnelled using VPN.7. Default -> DenyIssue 3 January 2005 227