Security Policy Database; Pmtu Support; Firewall Considerations With Vpn - Nortel Secure 4134 Configuration

Security Policy Database

The SPD determines which traffic going through the gateway needs to be
secured. In order to determine this, you must configure policies and specify
the required level of security. You can specify the source and destination
IP address (host or subnet or range of address) that need to be secured.
Optionally, the protocol, source and destination ports can also be configured.
Policies can be administratively enabled or disabled.

PMTU support

Path MTU is a technique used by the hosts to discover the lowest MTU
value along the tunnel path. The discovered value can be used to limit
the IP packet size to this value so that fragmentation along the path can
be avoided.
To support PMTU, the SR4134 performs the following:
•
•
•

Firewall considerations with VPN

To allow VPN connections, you must configure an inbound firewall policy in
the internet zone for IKE negotiation that allows self connections to UDP
port 500.
In addition, in cases where there is a NAT in the middle between the VPN
peers, you must allow IKE self connections to UDP port 4500 to support
NAT traversal. In cases where the NAT is enabled on one of the peers
themselves, you do not need to open port 4500.
For site to site VPN, it is rare (though possible) to encounter a NAT in
the middle between the peers. However, for remote access VPN, remote
access clients are most often behind a NAT, in which case, UDP port 4500
must be opened.
Finally, to support L2TP and IPsec remote access VPN, in addition to
allowing the IKE port connection, you must configure an inbound self firewall
policy in the internet zone that allows L2TP connections to UDP port 1701.
Copyright © 2007, Nortel Networks
.
generates an ICMP message back to the host behind the gateway if the
host forwards a packet that needs IP fragmentation but has the Don't
Fragment (DF) bit set.
records the PMTU value in the ICMP message received from the peer
security gateway in the corresponding SA and uses the new value for
future packets from the corresponding host behind the gateway.
preserves the DF bit while encapsulating the original packet.
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600 01.02 Standard
10.0 3 August 2007
Firewall considerations with VPN 59