12
To setup the sample IPSec tunneling configuration depicted above, use the following procedure
on SP200X router. Also, the corresponding configuration should be done on the remote VPN
router to complete the IPSec tunnel configuration.
1. Select the tunnel to use from "Select Tunnel to view/modify" field. For example:
Select tunnel 5
2. Enable the tunnel by selecting "YES" in the "Enable Tunnel 5" field.
3. Set the Subnet B's IP address range by specifying start and ending addresses in the "Remote IP
Address range" fields. For Example:
192.168.2.1 ~ 192.168.2.254
4. Set the IP address of the remote VPN router in the "Remote security gateway" field. For
example:
209.85.69.116
5. Set the security mode to "Tunnel" in the "Security mode" field. The "Transport" mode
is rarely used and is not applicable in this sample network configuration.
6. Configure IPSec parameters for outbound traffic (from the SP200X router to the remote VPN
router). There are two different methods to protect your packets:
•
AH(Authentication Header) is used to provide authentication
•
ESP(Encapsulating Security Payload) is used to keep privacy of the data by encrypting
payloads. The ESP also provides limited authentication, which makes the use of ESP
only secure enough in most situations.
You can enable AH and/or ESP by providing unique SPI(Security Parameter Index) numbers in
the "AH SPI" and/or "ESP SPI" fields. At least one of these (ESP in most cases) must be enabled
to do IPSec tunneling. In this example, we will assume only ESP is used with 3DES and MD5 for
encryption and authentication.
Outbound AH SPI:
blank (AH is not used)
Outbound ESP SPI:
2001
If AH is enabled by providing a unique SPI number, you can select a message digesting algorithm
from the "AH Authentication Algorithm" field, and provide the secret key value in the "AH
Authentication Key" field.
Outbound AH Authentication Algorithm:
blank (don't care)
Outbound AH Authentication Key:
blank (don't care)
If ESP is enabled by providing a unique ESP SPI number, you can select a message digesting
algorithm from the "ESP Authentication Algorithm" field, and provide the secret key value in the
"ESP Authentication Key" field. The ESP configuration also requires that the "ESP Encryption
Key" by set as well.
Outbound ESP Encryption Algorithm:
3DES-CBC
Outbound ESP Authentication Algorithm:
HMAC-MD5
Outbound ESP Encryption Key:
157f34683a295484236593486e8d3ab5642396897ace3fbd
Outbound ESP Authentication Key:
3587659a2f3da45c568a359f592d3ca81f326f2c
These parameters and algorithm selections should match those of the inbound parameters
