7
IPsec VPN
135
Setting up IPsec tunnels
Other
sections
explore
IPsec
components
in
detail.
This
section
provides
a
summary
of
the
essential
steps
needed
for
IPsec
setup.
It
outlines
the
individual
steps
in
setting
up
IPsec
for
the
following
scenarios:
•
IPsec
LAN
to
LAN
with
Pre
‐
shared
Keys
•
IPsec
LAN
to
LAN
with
Certificates
Note:
VPN
tunnels
themselves
do
not
require
IP
rules
as
explained
in
IPsec
with
the
SEG
on
page
132
,
IP
rules
do
not
need
to
be
defined
in
the
SEG
for
VPN
tunnel
establishment.
It
is
the
data
passing
through
a
tunnel
that
requires
IP
rules
which
allow
it
to
flow.
Common tunnel setup requirements
Before
looking
at
each
of
these
scenarios
separately,
it
is
useful
to
summarize
the
common
SEG
requirements
when
setting
up
any
VPN
tunnel,
regardless
of
the
type.
•
Define
the
tunnel
First,
you
must
define
the
tunnel
itself.
The
SEG
has
various
tunnel
object
types
which
are
used
to
do
this,
such
as
an
IPsec
Tunnel
object.
•
A
route
must
exist
Before
any
traffic
can
flow
into
the
tunnel,
a
route
must
be
defined
in
an
SEG
routing
table
.
This
route
tells
the
SEG
which
network
can
be
found
at
the
other
end
of
the
tunnel
so
it
knows
which
traffic
to
send
into
the
tunnel.
In
most
cases,
this
route
is
created
automatically
when
the
tunnel
is
defined
and
this
can
be
checked
by
examining
the
routing
tables.
If
a
route
is
defined
manually,
the
tunnel
is
treated
exactly
like
a
physical
interface
in
the
route
properties,
as
it
is
in
other
aspects
of
the
SEG.
In
other
words,
the
route
is
saying
to
the
SEG
that
a
certain
network
is
found
at
the
other
end
of
the
tunnel.
•
Define
an
IP
rule
to
allow
VPN
traffic
An
IP
rule
must
be
defined
that
explicitly
allows
traffic
to
flow
between
a
network
and
the
tunnel.
As
with
route
definitions,
the
tunnel
is
treated
exactly
like
a
physical
interface
when
defining
the
IP
rule.
IP
rules
are
not
created
automatically
after
defining
the
tunnel
object
and
if
they
do
not
exist
then
no
traffic
can
flow
through
the
tunnel
and
will
be
dropped
instead.
The
following
sections
will
look
at
the
detailed
setup
for
each
of
the
VPN
scenarios
listed
earlier.
Important:
The
current
version
of
the
SEG
does
not
support
the
use
of
IPv6
internet
addresses
with
IPsec.
For
this
reason,
the
predefined
IP
address
all
‐
nets
should
not
be
used
since
this
includes
both
IPv4
and
IPv6
addresses.
Instead,
use
the
predefined
address
all
‐
nets
‐
ip4
.
