Firewall Considerations For Trusted And Untrusted Vpn Interfaces; Routing Considerations For Vpn (And Firewall); Perfect Forward Secrecy - Nortel Secure 4134 Configuration

However, defining the match policy alone is not sufficient to identify the
tunnel traffic. To ensure that traffic identified in the match command is
forwarded through the tunnel, you must identify at least one crypto trusted
interface that specifies where the source traffic enters the router (using the
crypto trusted command). This command identifies the interface as
the source of tunnel traffic.
If traffic meeting the match filter rules enters the router through an interface
that is not identified as crypto trusted, the traffic is not encrypted using
the VPN.

Firewall considerations for trusted and untrusted VPN interfaces

Identifying an interface as crypto trusted or untrusted has implications for
the firewall treatment of that interface.
When you set the external interface as crypto untrusted, the interface is
automatically added to the internet untrusted firewall zone.
For the untrusted crypto interfaces, you need to configure a firewall policy to
allow IKE negotiations to the local tunnel interface.
When you set the internal interface as crypto trusted, the interface is
automatically added to the trusted corp firewall zone. If you want the trusted
interface to belong to a different trusted firewall zone, you must configure
this preference using firewall commands.
For the trusted crypto interfaces, to allow VPN tunnel traffic to pass through
the firewall from the untrusted interface, you must configure an inbound
policy on the trusted interface.
By default, most trusted outbound traffic usually meets the default policy
of '1024 out allow' (unless this default policy has been administratively
altered), and so this traffic will pass.
Routing considerations for VPN (and firewall)
The security processing must be aware of the route not only to the
destination network (which is always required for basic routing), but also the
route to the source network. Knowledge of the route to the source network
is used by the firewall to prevent spoofing.

Perfect forward secrecy

The SR4134 supports Perfect forward secrecy (PFS) for IKE key negotiation.
With PFS enabled, the IKE phase 2 SA shares no key material with the IKE
phase 1 SA. This feature increases the security of an IPsec SA.
Copyright © 2007, Nortel Networks
.
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Perfect forward secrecy 57