
Chapter 68 Virtual Private Networks (VPN) 655
BCM 4.0 Networking Configuration Guide
Compatibility with Extranet Switch and Nortel Services Edge Router 5500
(formerly known as Shasta 5000)
When connecting to a Contivity Server, you must disable Vendor ID, Nailed Up and Compression
on the Contivity Server.
BCM does not support the IPSec RIP implementation used by the Contivity Server. Use Static
Routes when connecting to the Extranet Switch.
When connecting to a Nortel Services Edge Router (formerly known as Shasta 5000), you must
disable Perfect Forward Secrecy (PFS) on the BCM Branch Office Tunnel Configuration.
Multiple IP Address restrictions
Although the BCM supports the configuration of additional IP addresses on its network interfaces,
IPSec does not currently support the use of these additional IP addresses for Branch Office Local
Endpoint Addresses, Remote Endpoint Addresses or the Destination IP Address for IPSec VPN
Clients.
Firewall rules for IPSec Branch Office and Remote User Tunnels
In order to allow IPSec packets through the firewall interface which blocks all incoming packets, a
number of rules must be configured. In addition to allowing the IPSec packets through, you must
also remember to create rules to allow the packets that come through the tunnel.
Firewall Rules for Branch Office
In the Branch office case, four rules must be created. One is for the key exchange protocol (IKE),
the other two are for the type of protocol used (ESP and/or AH). The fourth rule is for the inbound
rules. Table 161, Table 162, Table 163 and Table 164 show the rules required.
Table 161 Rule 1
Protocol UDP
Source IP Remote Endpoint address of Branch Office Tunnel
Source Mask 255.255.255.255
Source Port 500
Destination IP Local Endpoint address of Branch Office Tunnel
Destination Mask 255.255.255.255
Destination Port 500
Table 162 Rule 2
Protocol IPSEC_ESP
Source IP Remote Endpoint address of Branch Office Tunnel
Source Mask 255.255.255.255
Kommentare zu diesen Handbüchern