Avaya G250 Administration page 360

Configuring IPSec VPN
Note:
For more information on DNS Resolver, see
Note:
information about object tracking, see
The peer group entity
●
R3.0 offers the capability of defining a peer group, which is a list of redundant remote peers.
When the G250/G350 senses that the currently active peer is not responding, the next peer
in the list becomes the active peer and the G250/G350 will try to re-establish the VPN
connection with that peer. The G250/G350 can sense that a peer is dead when IKE
negotiation times-out, through DPD keepalives, and through object tracking. Note that a
peer group can contain remote peer IP addresses as well as hostnames.
VPN keepalives
VPN keepalives can dramatically improve the speed with which the G250/G350 detects loss of
connectivity with the remote VPN peer. Two types of VPN keepalives are available. You can use
either or both methods:
DPD keepalives, a standard VPN keepalive. This type of detection can be used only if it is
●
supported also by the remote peer.
Object Trackers, a new R3.0 feature. Object Trackers track the state (up/down) of remote
●
devices using keepalive probes, and notify registered applications such as VPN when the
state changes. Object tracking allows monitoring of hosts inside the remote peer's
protected network, not just of the remote peer itself as in DPD.
Note:
For more information on Object Trackers, see
Note:
NAT Traversal
A NAT (Network Address Translation) device allows an organization with a single public IP
address to connect multiple computers to the Internet sharing a single public IP address.
However, NAT can cause compatibility problems for many types of network applications, VPN
among them.
NAT Traversal enables detecting the presence of NAT devices along the path of the VPN
tunnel. Once detected, the two peers tunnel IKE and IPSEC traffic encapsulated in UDP,
allowing the NAT device to work seamlessly with VPN.
Stronger encryption
R3.0 offers stronger encryption algorithms (AES with 192-bit and 256-bit keys), and supports
stronger Diffie-Hellman encryption (Diffie-Hellman groups 5 and 14) for use in both IKE phase 1
and PFS (i.e., IKE phase-2).
360 Administration for the Avaya G250 and Avaya G350 Media Gateways
DNS Resolver on page 65. For more
Object tracking on page 171.
Object tracking on page 171