Administration of the Avaya G350 Media Gateway - Avaya Support

Typical installationsFigure 20: Hub-and-spoke with hub redundancy/load sharingIPSec VPN linkBranchOfficeAvaya GWG350EthernetDSL orCablemodemInternetAccessRouter +VPNterminationAccessRouter +VPNterminationPrimary MainOfficeBackup MainOfficeConfiguring the VPN hub redundancy/load sharing topologiesThis section describes how to configure the VPN Hub Redundancy/Load sharing topologies,followed by a detailed configuration example.To configure the VPN Hub Redundancy/Load sharing topologies:1. Configure the Branch Office as follows:● VPN policy is configured on the Internet interface egress as follows:GRE Traffic from the local tunnel endpoint to remote tunnel endpoint 1 -> encrypt, usingIPSec tunnel mode, with the remote peer being tunnel endpoint 1.●GRE Traffic from the local tunnel endpoint to remote tunnel endpoint 2 -> encrypt, usingIPSec tunnel mode, with the remote peer being tunnel endpoint 2.ACL is configured on the Internet interface to allow only the VPN / ICMP traffic, asfollows:Ingress:1. IKE (UDP/500) from remote tunnel endpoints to local tunnel endpoint -> Permit2. ESP/AH from remote tunnel endpoint to local tunnel endpoint -> PermitIssue 3 January 2005 239