Avaya BCM 4.0 Networking Konfigurationsanleitung PDF herunterladen (Seite 654)

100

101

654 Chapter 68 Virtual Private Networks (VPN)

N0060606N0060606

IPSec capacity restrictions

The BCM performs all IPSec processing using software. To prevent overloading the BCM

processor with IPSec traffic processing, the network traffic that requires IPSec processing should

not exceed 6Mbps. This is based on using 3DES encryption with SHA authentication.

Consider the following factors when determining maximum IPSec capacity:

• Tunnel negotiation

Since tunnel negotiation requires a significant amount of processing time, the number of

tunnels that are negotiated at one time should be limited. The tunnels are re-negotiated based

on either the Rekey Timeout or the Rekey Data Count. If a number of tunnels will be running

concurrently, you should stagger these values.

Settings required for IPSec tunnels

The data packets that pass through IPSec tunnels interact with other routing features in BCM. As a

result, there are several settings you must make in other features for IPSec tunnels to operate.

NAT (Network Address Translation)

BCM does not support NAT on the Local Endpoint of an IPSec Tunnel.

Packets can be sent through an IPSec tunnel with or without NAT applied. To send packets

through the tunnel with NAT applied, configure the LAN to include only a network for the

endpoint itself. For example, if the Local Endpoint is 10.10.13.2, then the LAN would be

10.10.13.2 with a mask of 255.255.255.255. To send packets through the tunnel without NAT

applied, configure the LANs with the local Private IP network(s) and the Remote Accessible

Networks with the networks on the other side of the Remote Endpoint. Using the above example,

we know that the other interfaces on the local BCM have IP addresses of 10.10.10.1 and

10.10.11.1. The remote BCM has a subnet of 12.12.12.1. Therefore, the LAN would have two

networks configured as 10.10.10.0 with a mask 255.255.255.0 and 10.10.11.0 with a mask

255.255.255.0 and the Remote Accessible Networks would be 12.12.12.0 with a mask of

255.255.255.0. All packets that do not match these rules will be NATed and sent out the interface

and not through the tunnel. This is a useful configuration if access to both the Internet and the

other side of an IPSec tunnel is desired.

Dialup ISDN connections

When you are creating an IPSec tunnel over a Dialup ISDN connection, the endpoint must have a

fixed IP address.

Note: The maximum number of concurrent tunnels the BCM supports is 16.

However, this number could be less depending on the configuration.

Note: In this section, the term LAN is referring to the Local Accessible

Network.

1 2 ... 649 650 651 652 653 654 655 656 657 658 659 ... 757 758

Kommentare zu diesen Handbüchern

Keine Kommentare

Avaya BCM 4.0 Networking Konfigurationsanleitung Seite 654

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Vernetzung Avaya BCM 4.0 Networking