SupportDocumentationRoutersAccess RoutersAR600&6100&6200&6300Configuration & CommissioningConfiguration Guide

NetEngine AR600, AR6100, AR6200, and AR6300 V300R019 CLI-based Configuration Guide - VPN

Using an ACL to Establish an IPSec Tunnel

Using an ACL to Establish an IPSec Tunnel

Pre-configuration Tasks

On an IPSec tunnel established in manual or IKE negotiation mode, an ACL defines data flows to be protected. The packets that match the permit clauses in the ACL are protected, and the packets that match the deny clauses are not protected. The ACL can define packet attributes such as the IP address, port number, and protocol type, which help you flexibly define IPSec policies.

Before establishing an IPSec tunnel using an ACL, complete the following tasks:
  • Configure a reachable route between source and destination interfaces.
  • (Optional) If L2TP over IPSec needs to be configured, perform the following configurations:
    1. Configure LAC on the branch gateway. If a client on the branch network dials to connect to the headquarters network through the LAC, configure NAS-initiated VPN LAC. If the LAC connects to the headquarters network through automatic dial-up, configure LAC auto-dial.
    2. Configure LNS on the headquarters gateway.

  • (Optional) If ACL-based GRE over IPSec needs to be configured, perform the following configurations:

    1. Create a tunnel interface and set the type of the interface to GRE.
    2. Configure source and destination IP addresses, and interface IP addresses. The source IP address is the IP address of the outbound interface on the gateway, and the destination IP address is the IP address of the outbound interface on the remote gateway.
    3. Add tunnel interfaces to a zone.

Enabling the IPsec function on the AC deteriorates the forwarding performance of the device. Therefore, do not enable the IPSec function unless necessary.

Configuration Process

Figure 5-27 shows the configuration process (IKEv1 is used).

Figure 5-27 Using an ACL to establish an IPSec tunnel