Amer Networks E5Web GUI - Manual (Page 570)

9.2.1. IPsec LAN to LAN with Pre-shared Keys
The objective is to create a secure means of joining two networks: a Local Network which is on
the protected side of a local security gateway; and a Remote Network which is on the other side
of some remote device, located across an insecure network.
The steps for setup are as follows:
1. Create a Pre-shared Key object.
2. Optionally create a new IKE Algorithms object and/or an IPsec Algorithms object if the
default algorithm proposal lists do not provide a set of algorithms that are acceptable to the
tunnel remote end point. This will depend on the capabilities of the device at the other end
of the VPN tunnel.
3. In the Address Book create IP objects for:
• The remote VPN gateway which is the IPv4 address of the network device at the other
end of the tunnel (let's call this object remote_gw). This may or may not be another
Clavister Security Gateway.
• The remote network which lies behind the remote VPN gateway (let's call this object
remote_net).
• The local network behind the Clavister Security Gateway which will communicate across
the tunnel. Here we will assume that this is the predefined address lan_net and this
network is attached to the cOS Core lan interface which has the IPv4 address lan_ip.
4. Create an IPsec Tunnel object (let's call this object ipsec_tunnel). Specify the following
tunnel parameters:
• Set Local Network to lan_net.
• Set Remote Network to remote_net.
• Set Remote Endpoint to remote_gw.
• Set Encapsulation mode to Tunnel.
• Choose the IKE and IPsec algorithm proposal lists to be used.
• For Authentication select the Pre-shared Key object defined in step (1) above.
The IPsec Tunnel object can be treated exactly like any cOS Core Interface object in later
steps.
5. Set up two IP rules in the IP rule set for the tunnel:
Chapter 9: VPN
570