Administration of the Avaya G350 Media Gateway - Avaya Support

Configuring IPSec VPNFigure 21: Full solution: hub-and-spoke with VPN for data and VoIP control backupWAN link (PPP or FR)IPSec VPN linkPSTNVoIP VLAN(s)GatewayWANVoIP bearer +primary controlAvaya GWG350EthernetBranch OfficeData VLAN(s)DSL orCablemodemData + VoIPcontrol backupAccessRouter +VPNterminationCentral OfficeInternetConfiguring hub-and-spoke with VPN for data and VoIP control backupThis section describes how to configure Hub-and-spoke with VPN for data and VoIP controlbackup, followed by a detailed configuration example.To configure Hub-and-spoke with VPN for data and VoIP control backup:1. Configure the Branch Office as follows:●●●The default gateway is the Internet interface.VPN policy is configured on the Internet interface egress as follows:Traffic from the local GRE tunnel endpoint to the remote GRE tunnel endpoint -> encrypt,using IPSec tunnel mode, with the remote peer being the Main Office.ACL is configured on the Internet interface to allow only the VPN tunnel and ICMP traffic,as follows:Ingress:1. IKE (UDP/500) from remote tunnel endpoint to local tunnel endpoint -> Permit2. ESP/AH from remote tunnel endpoint to local tunnel endpoint -> Permit3. Remote GRE tunnel endpoint to local GRE tunnel endpoint -> Permit246 Administration of the Avaya G350 Media Gateway