
VMware, Inc. 141
Appendix B vShield Edge VPN Configuration Examples
crypto map MYVPN interface untrusted
crypto isakmp enable untrusted
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 10.0.0.0 255.0.0.0 untrusted
telnet timeout 5
ssh timeout 5
console timeout 0
no threat-detection basic-threat
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username admin password f3UhLvUj1QsXsuK7 encrypted
tunnel-group 10.115.199.103 type ipsec-l2l
tunnel-group 10.115.199.103 ipsec-attributes
pre-shared-key *
!
!
prompt hostname context
Cryptochecksum:29c3cc49460831ff6c070671098085a9
: end
Using a WatchGuard Firebox X500
YoucanconfigureyourWatchGuardFireboxX500asaremotegateway.
To configure your WatchGuard Firebox X500
1IntheFireboxSystemManager,gotoTools>PolicyManager.
2InthePolicyManager,gotoNetwork>Configuration.
3ConfiguretheinterfacesandclickOK.
4 (Optional)GotoNetwork>Routestoconfigureadefaultroute.
5GotoNetwork>Branch
OfficeVPN>ManualIPSectoconfiguretheremotegateway.
6IntheIPSecConfigurationdialogbox,clickGatewaystoconfiguretheIPSECRemoteGateway.
7IntheIPSecConfigurationdialogbox,clickTunnelstoconfigureatunnel.
8IntheIPSecConfigurationdialogbox,clickAddtoaddaroutingpolicy.
9ClosetheIPSec
Configurationdialogbox.
10 Confirmthetunnelisup
Troubleshooting
Successful Negotiation (both Phase 1 and Phase 2)
vShield Edge
FromthevShieldEdgecommandlineinterface(ipsec auto -status,partofshow service ipsec
command):
000 #2: "s1-c1":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 2430s;
newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
NOTERefertoyourWatchGuardFireboxdocumentationforexactsteps.
Comentarios a estos manuales