Motorola WS2000 - Wireless Switch - Network Management Device System Reference Manual page 78

4-24 WS2000 Wireless Switch System Reference Guide
4.5.6.7 How can I setup the WS 2000 switch to accept VPN tunnels from gateways that have a
DHCP WAN address?
To accept a VPN tunnel from a unknown (DHCP) address, the WS 2000 Wireless Switch operates in what is
called responder-only mode. That is, it cannot initiate the VPN connection. It can only wait for a VPN
connection to come in. Clients behind a responder-only cannot connect to the remote subnet until the remote
subnet has connected to them.
To setup responder-only mode, set the Remote Gateway to 0.0.0.0. If you are using IKE the following
restrictions are in place:
• Remote ID type cannot be IP. We do not know the IP of the remote since it is DHCP.
• IKE Authentication Mode cannot be set to
• You may not use
4.5.6.8 I have two WS 2000 switches and both have DHCP WAN addresses. Is there any possible
way to open a VPN tunnel between them?
Yes, but the configuration for each tunnel will need to change anytime a WAN IP lease expires. You can make
this work temporarily by performing the following steps:
1. Set 0.0.0.0 as the local WAN IP for each gateway.
2. Configure the opposite WS 2000 switch's current DHCP address as the Remote Gateway. This is the field
that needs to change every time the DHCP addresses change.
3. If using IKE, you cannot use ID type IP for either Local or Remote ID types.
4.5.6.9 I have set up my tunnel and the status still says "Not Connected." What should I do now?
VPN tunnels are negotiated on an as-needed basis. If you have not sent any traffic between the two subnets,
the tunnel will not be established. Once a packed is sent between the two subnets, the VPN tunnel setup
will occur.
4.5.6.10 I still can't get my tunnel to work after attempting to initiate traffic between the 2 subnets.
What now?
Here are some troubleshooting tips:
1. Verify that you can ping each of the remote gateway IP addresses from clients on either side. Failed pings
can indicates general network connection problems.
2. Pinging the internal gateway address of the remote subnet should run the ping through the tunnel as
well. Allowing you to test even if there are no clients on the remote end.
3. Verify that your WAN IP address is not DHCP. VPN requires a static WAN IP address to work.
PSK
xAuth for this tunnel.
if IKE mode is set to Main Mode.