Avaya Configuring IPsec Services Bedienungsanleitung PDF herunterladen (Seite 102)

Configuring IPsec Services

C-18

308630-14.00 Rev 00

Configuration Specifics

Configuring a Contivity switch to interoperate with BayRS IPsec requires that you

configure the Contivity switch with a “Branch Office Connection” with a tunnel

type equal to “IPsec.”

The Contivity documentation provides detailed configuration steps for Branch

Office Connections. As you go through those steps, consider the following

interoperability information:

• When configuring IP network addresses, note that BayRS lets you configure a

network range that can include from one to any number of valid IP addresses.

This provides flexibility for BayRS-to-BayRS IPsec implementations.

However, many IPsec platforms, such as Contivity, require that you configure

IP addresses by subnet and mask. This means that for BayRS to work with

Contivity, a BayRS policy must contain source and destination IP address

ranges that match the exact ranges of the corresponding Contivity Branch

Office Connection’s local and remote accessible networks.

For example, if the Contivity side of the IPsec tunnel Branch Office

Connection has a remote network of 192.32.54.128/255.255.255.224 and a

local network of 192.32.13.128/255.255.255.224, then the corresponding

BayRS policy must have a source address range of exactly 192.32.54.128 to

192.32.54.159, and a destination address range of exactly 192.32.13.128 to

192.32.13.159.

• Routing: Currently, only static routing is supported between the Contivity

switch and BayRS IPsec gateways. Although Contivity offers “VPN

Routing,” which sends RIP routes through an IPsec tunnel, this is proprietary

to the Contivity switch. A BayRS router interface with IPsec sends broadcasts

out the interface in cleartext only. The Contivity switch’s public interface will

not accept these cleartext broadcasts.

• Performance: The BayRS implementation is slower than Contivity. Consider

performance when determining what traffic needs IPsec protection and what

traffic does not need protection. If perfect forward secrecy (PFS) is

unnecessary, disable PFS on the Contivity switch (PFS is disabled by default

on BayRS). Using DES encryption instead of Triple DES encryption may be

preferable when considering a tradeoff between performance and protection.

Triple DES computational requirements for encrypting data are higher than

those for DES.

1 2 ... 97 98 99 100 101 102 103 104 105 106 107 ... 121 122

Keine Kommentare

Avaya Configuring IPsec Services Bedienungsanleitung Seite 102