Avaya G250 Administration page 370

Configuring IPSec VPN
To configure a transform-set:
1. Use the crypto ipsec transform-set command to enter the context of a
transform-set (and to create the transform-set if it does not exist). The command variables
include:
The name of the transform-set.
●
The encryption algorithm used by the transform-set. Possible values are esp-des,
●
esp-3des, esp-aes, esp-aes-192, esp-aes-256 and esp-null (no encryption).
The authentication algorithm used by the transform-set. Possible values are
●
esp-md5-hmac and esp-sha-hmac.
The IP compression algorithm used by the transform-set. The only possible value is
●
comp-lzs
!
Important:
You must define at least one transform-set.
Important:
G350-001# crypto ipsec transform-set ts1 esp-3des esp-md5-hmac comp-lzs
G350-001(config-transform:ts1)#
2. You can use the following commands to set the parameters of the transform-set:
Use the set pfs command to specify whether each IKE phase 2 negotiation employs
●
PFS (Perfect Forward Secrecy), and if yes, which Diffie-Hellman group to employ. PFS
ensures that even if someone were to discover the long-term secret(s), the attacker
would not be able to recover the session keys, both past and present. In addition, the
discovery of a session key compromises neither the long-term secrets nor the other
session keys. The default setting is no set pfs.
Use the set security-association lifetime seconds command to set the
●
security association lifetime in seconds.
Use the set security-association lifetime kilobytes command to set the
●
security association lifetime in kilobytes.
Use the mode command to set the IPSec mode (tunnel or transport).
●
Transport mode does not add an additional IP header (i.e., a tunnel header), but rather
uses the original packet's header. However, it can be used only when the VPN tunnel
endpoints are equivalent to the original packet's source and destination IP addresses.
This is generally the case when using GRE over IPSec. Note that transport mode
cannot be used unless the remote VPN peer supports that mode and was configured to
use it.
370 Administration for the Avaya G250 and Avaya G350 Media Gateways