beautypg.com

Enterasys Networks XSR-3020 User Manual

Page 75

background image

VPN Sample Configuration with Network Extension Mode

XSR Getting Started Guide 3-31

Configure AAA authentication by assigning a virtual subnet to the DEFAULT AAA group,
associate it with DNS and WINs servers, and add two AAA users with passwords.

When a remote XSR tunnels into the local XSR, it will be assigned these DNS, WINS and PPTP
values and be assigned dynamically to the IP pool virtual_subnet. Be aware that users not added to
a specified group will automatically be assigned to the DEFAULT group and groups must be
created before users can be added to them. Remember to create the same users and passwords on
the remote XSRs.

XSR(ip-local-pool)#aaa group DEFAULT
XSR(aaa-group)#ip pool virtual_subnet

Configure DNS and WINS parameters:

XSR(aaa-group)#dns server primary 172.16.10.10
XSR(aaa-group)#dns server secondary 172.16.10.11
XSR(aaa-group)#wins server primary 172.16.10.10
XSR(aaa-group)#wins server secondary 172.16.10.11

Create user(s), specify an IP from virtual subnet, and assign a password:

XSR(config)#aaa user nem-test
XSR(config)#password welcome
XSR(config)#aaa user jeffb
XSR(config)#password welcome

Check to make sure the transforms and proposals were created properly:

Router#show crypto ipsec transform-set
Name

PFS ESP ESP-AH AH IPCOMP

----

--- --- ------ -- ------

*ez-esp-3des-sha-pfs Modp768 3DES HMAC-SHA None None
*ez-esp-3des-sha-no-pfs Disabled 3DES HMAC-SHA None None
*ez-esp-3des-md5-pfs Modp768 3DES HMAC-MD5 None None
*ez-esp-3des-md5-no-pfs Disabled 3DES HMAC-MD5 None None
*ez-esp-aes-sha-pfs Modp768 AES HMAC-SHA None None
*ez-esp-aes-sha-no-pfs Disabled AES HMAC-SHA None None
*ez-esp-aes-md5-pfs Modp768 AES HMAC-MD5 None None
*ez-esp-aes-md5-no-pfs Disabled AES HMAC-MD5 None None

XSR#show crypto isakmp proposal
Name Authentication Encrypt Integrity Group Lifetime
---- -------------- ------- --------- ----- --------
*ez-ike-3des-sha-psk PreSharedKeys 3DES HMAC-SHA Modp1024 28800
*ez-ike-3des-md5-psk PreSharedKeys 3DES HMAC-MD5 Modp1024 28800
*ez-ike-3des-sha-rsa RSASignature 3DES HMAC-SHA Modp1024 28800
*ez-ike-3des-md5-rsa RSASignature 3DES HMAC-MD5 Modp1024 28800

Create the ISAKMP IKE global peer:

XSR(config)#crypto isakmp peer 0.0.0.0 0.0.0.0
XSR#config)#config-mode gateway
XSR(config)#exchange-mode aggressive
XSR(config)#proposal ez-ike-3des-sha-psk ez-ike-3des-md5-psk

Create the ACL for trusted subnet of the XSR and virtual subnet of XSR:

XSR(config)#access-list 101 permit ip any 10.11.11.0 0.0.0.255
XSR(config)#access-list 102 permit ip any 10.12.12.0 0.0.0.255