Enterasys X-Pedition XSR-3150 Getting Started Manual page 74

VPN Sample Configuration with Network Extension Mode
Create the VPN virtual subnet:
XSR(config)#ip local pool virtual_subnet 10.10.10.0 255.255.255.248
Configure AAA authentication by assigning a virtual subnet to the DEFAULT AAA group,
associate it with DNS and WINs servers, and add two AAA users with passwords.
When a remote XSR tunnels into the local XSR, it will be assigned these DNS, WINS and PPTP
values and be assigned dynamically to the IP pool virtual_subnet. Be aware that users not added to
a specified group will automatically be assigned to the DEFAULT group and groups must be
created before users can be added to them. Remember to create the same users and passwords on
the remote XSRs.
XSR(ip-local-pool)#aaa group DEFAULT
XSR(aaa-group)#ip pool virtual_subnet
Configure DNS and WINS parameters:
XSR(aaa-group)#dns server primary 172.16.10.10
XSR(aaa-group)#dns server secondary 172.16.10.11
XSR(aaa-group)#wins server primary 172.16.10.10
XSR(aaa-group)#wins server secondary 172.16.10.11
Create user(s), specify an IP from virtual subnet, and assign a password:
XSR(config)#aaa user nem-test
XSR(config)#password welcome
XSR(config)#aaa user jeffb
XSR(config)#password welcome
Check to make sure the transforms and proposals were created properly:
XSR#show crypto ipsec transform-set
Name
----
*ez-esp-3des-sha-pfs
*ez-esp-3des-sha-no-pfs
*ez-esp-3des-md5-pfs
*ez-esp-3des-md5-no-pfs
*ez-esp-aes-sha-pfs
*ez-esp-aes-sha-no-pfs
*ez-esp-aes-md5-pfs
*ez-esp-aes-md5-no-pfs
XSR#show crypto isakmp proposal
Name
----
*ez-ike-3des-sha-psk
*ez-ike-3des-md5-psk
*ez-ike-3des-sha-rsa
*ez-ike-3des-md5-rsa
Create the ISAKMP IKE global peer:
XSR#crypto isakmp peer 0.0.0.0 0.0.0.0
XSR#config-mode gateway
XSR#exchange-mode aggressive
XSR#proposal ez-ike-3des-sha-psk ez-ike-3des-md5-psk
3-32 Software Configuration
PFS ESP
--- ---
Modp768 3DES
Disabled 3DES
Modp768 3DES
Disabled 3DES
Modp768 AES
Disabled AES
Modp768 AES
Disabled AES
Authentication Encrypt
-------------- -------
PreSharedKeys 3DES
PreSharedKeys 3DES
RSASignature 3DES
RSASignature 3DES
ESP-AH AH IPCOMP
------ -- ------
HMAC-SHA None
HMAC-SHA None
HMAC-MD5 None
HMAC-MD5 None
HMAC-SHA None
HMAC-SHA None
HMAC-MD5 None
HMAC-MD5 None
Integrity Group
--------- -----
HMAC-SHA Modp1024
HMAC-MD5 Modp1024
HMAC-SHA Modp1024
HMAC-MD5 Modp1024
None
None
None
None
None
None
None
None
Lifetime
--------
28800
28800
28800
28800