Administration of the Avaya G350 Media Gateway - Avaya Support

Configuring IPSec VPN2. Configure branch office 2 as follows:●●The default gateway is the Internet interface.VPN policy is configured on the Internet interface egress as follows:●●Traffic from the local subnets to the First Spoke subnets -> encrypt, using tunnel modeIPSec, with the remote peer being the First Spoke.Traffic from the local subnets to anyone -> encrypt, using tunnel mode IPSec,with the remote peer being the Main Office (VPN hub)● ACL is configured on the Internet interface to allow only the VPN / ICMP traffic, asfollows:Ingress:1. IKE from Main Office IP to Branch IP -> Permit2. ESP from Main Office IP to Branch IP -> Permit3. IKE from First Branch IP to Branch IP -> Permit4. ESP from First Branch IP to Branch IP -> Permit5. ICMP from anyone to local tunnel endpoint -> PermitNote: This allows PMTUD application to work.6. All allowed services from anyone to any local subnet -> PermitNote: Due to the definition of the VPN Policy, this will be allowed only if traffic comesover ESP.7. Default -> DenyEgress:1. IKE from Branch IP to Main Office IP -> Permit2. ESP from Branch IP to Main Office IP -> Permit3. IKE from Branch IP to First Branch IP -> Permit4. ESP from Branch IP to First Branch IP -> Permit5. ICMP from local tunnel endpoint to anyone -> PermitNote: This allows the PMTUD application to work.6. All allowed services from any local subnet to anyone -> PermitNote: This traffic is tunnelled using VPN.7. Default -> Deny3. Configure the VPN Hub (Main Office) as follows:● Static routing: Branch subnets -> Internet interface.●The VPN policy portion for the branch is configured as a mirror image of the branch, asfollows:Traffic from anyone to branch local subnets -> encrypt, using tunnel mode IPSec, withthe remote peer being the VPN Spoke (Branch Internet address).228 Administration of the Avaya G350 Media Gateway