Enterasys Networks Security Router X-PeditionTM - Manual (Page 415)

Configuration Examples
XSR User’s Guide 16-29
XSR(config-isakmp-peer)#proposal xp soho p2p
XSR(config-isakmp-peer)#config-mode gateway
XSR(config-isakmp-peer)#nat-traversal automatic
Configure the following IPSec SAs:
XSR(config)#crypto ipsec transform-set esp-3des-md5 esp-3des esp-md5-hmac
XSR(cfg-crypto-tran)no set security-association lifetime kilobytes
XSR(config)#crypto ipsec transform-set esp-3des-sha esp-3des esp-sha-hmac
XSR(cfg-crypto-tran)set security-association lifetime kilobytes 10000
Configure the following four crypto maps to match ACLs 150, 140, 120, and 110:
XSR(config)#crypto map test 50
XSR(config-crypto-m)#set transform-set esp-3des-sha
XSR(config-crypto-m)#match address 150
XSR(config)#crypto map test 40
XSR(config-crypto-m)#set transform-set esp-3des-sha
XSR(config-crypto-m)#match address 140
XSR(config)#crypto map test 20
XSR(config-crypto-m)#set transform-set esp-3des-md5
XSR(config-crypto-m)#match address 120
XSR(config-crypto-m)#mode transport
XSR(config-crypto-m)#set security-association level per-host
XSR(config)#crypto map test 10
XSR(config-crypto-m)#set transform-set esp-3des-sha
XSR(config-crypto-m)#match address 110
Configure FastEthernet interface 1 to permit multicast packets in and out:
XSR(config)#interface FastEthernet1
XSR(config-ifF1>)#ip address 96.96.96.7 255.255.255.0
XSR(config-ifF1>)#ip firewall ip-multicast in
XSR(config-ifF1>)#ip firewall ip-multicast out
XSR(config-ifF1>)#no shutdown
Configure FastEthernet interface 2 with the attached crypto map test:
XSR(config)#interface FastEthernet2
XSR(config-ifF2>)#crypto map test
XSR(config-ifF2>)#ip address 141.154.196.106 255.255.255.192
XSR(config-ifF2>)#no shutdown
Configure the VPN virtual interface as a terminating tunnel server with IP multicast redirection
back to the gateway, add an OSPF network with cost and disable the firewall:
XSR(config)#interface Vpn1 multi-point
XSR(config-int-vpn)#ip multicast-redirect tunnel-endpoint
XSR(config-int-vpn)#ip address 10.120.70.1 255.255.255.0
XSR(config-int-vpn)#ip firewall disable
XSR(config-int-vpn)#ip ospf priority 10
XSR(config-int-vpn)#ip ospf network nbma
Add a default route to the next hop Internet gateway: