Avaya G250 Administration page 470

Configuring IPSec VPN
- Within the interface context, specify the IP address and mask using the ip
G350-001(config-if:FastEthernet 10/2)# ip address 192.168.49.1
25.255.255.0
To configure a dynamic IP address, see
●
3. Use the ip crypto-group command, followed by the index of the crypto-group, to
assign a crypto-group to the interface.
!
Important:
ip crypto-group is a mandatory parameter.
Important:
4. Optionally, you can set the following parameters:
The crypto ipsec minimal pmtu command is intended for advanced users only.
●
It sets the minimal PMTU value which can be applied to an SA when the G250/G350
participates in Path MTU Discovery (PMTUD) for the tunnel pertaining to that SA.
The crypto ipsec df-bit command is intended for advanced users only. It sets
●
the Do Not Fragment (DF) bit to either clear or copy mode:
- copy – the DF bit of the encapsulated packet is copied from the original packet,
- clear – the DF bit of the encapsulated packet is never set, and PMTUD is not
G350-001(config-if:FastEthernet 10/2)# ip crypto-group 901
Done!
G350-001(config-if:FastEthernet 10/2)# crypto ipsec minimal pmtu 500
Done!
G350-001(config-if:FastEthernet 10/2)# crypto ipsec df-bit copy
Done!
5. Exit the interface context using the exit command.
G350-001(config-if:FastEthernet 10/2)# exit
G350-001#
470 Administration for the Avaya G250 and Avaya G350 Media Gateways
address command.
and Path MTU Discovery (PMTUD) is maintained for the IPSec tunnel.
maintained for the IPSec tunnel. Packets traversing an IPSec tunnel are
pre-fragmented according to the MTU of the SA, regardless of their DF bit. In case
packets are fragmented, the DF bit is copied to every fragment of the original
packet
.
Using dynamic local peer IP on page 480.