Vpn; Site-To-Site Policy-Based Ipsec L3Vpn - GE MDS ORBIT MCR Technical Manual

Using the CLI
To perform the same procedure with the CLI, first change to configuration mode. The steps needed to
produce the same destination NAT rule set and apply it to the cell interface follow.
1. Enable firewall service, if it is not already enabled.
% set services firewall enabled true
2. Create a static NAT rule set. The rule set name used below is Static_NAT_Network_A.
% set services firewall nat static rule-set Static_NAT_Network_A
Create rule for translating the original "static-nat address" to the translated "match dst-address."
3.
% set services firewall nat static rule-set Static_NAT_Network_A rule 1 match dst-address
10.10.1.0/24
% set services firewall nat static rule-set Static_NAT_Network_A rule 1 static-nat address
192.168.1.0/24
4. To apply the rule-set to an existing IPsec connection (here named IPSEC_CONN), use the
following command.
% set services vpn ipsec connection IPSEC_CONN nat static Static_NAT_Network_A
5. Commit configuration and exit configuration mode.
% commit
3.8.12

VPN

Understanding
Orbit supports following types of Virtual Private Network (VPN) setups:
1. Site-to-Site Policy-Based IPsec L3VPN – This is enables routing of traffic to/from single local LAN of
Orbit from/to single remote LAN on the other side of the Remote IPsec router through an IPsec
tunnel. Only unicast IP traffic matching the local and remote subnets can be sent over this tunnel. If
more than a single pair of local or remote subnets need to exchange data then each pair requires its
own tunnel. This is called a policy based VPN since the traffic selector/policy i.e. the local and
remote IP subnets is included in the IPsec configuration.
Orbit
Local LAN
192.168.1.0/24
In this setup, there is single LAN behind Orbit and traffic from this LAN needs to
be routed towards a single remote LAN on the other side of the remote router
through an IPsec tunnel. If the remote LAN is configured as 0.0.0.0/0, then Orbit
will route traffic from local LAN to any other destination through this tunnel.
MDS 05-6632A01, Rev. F
Cellular
network
IPsec Tunnel
carrying traffic
between local
and remote
LANs
MDS Orbit MCR/ECR Technical Manual
Customer
Network/
Internet
Remote IPsec
Gateway/Router
Remote LAN
10.1.1.0/24
245