Allied Telesis AlliedWare NetScreen Routers Instructions d'installation et d'entretien

C613-16098-00 REV E www.alliedtelesis.com

AlliedWareTM OS

How To |

Today’s network managers often need to incorporate other vendors’ equipment into their

networks, as companies change and grow. To support this challenge, Allied Telesis routers are

designed to inter-operate with a wide range of equipment.

This How To Note details one of the inter-operation solutions from Allied Telesis: creating

virtual private networks between Allied Telesis and SonicWALL routers. It shows you how to

configure a VPN between a local Allied Telesis router and a remote SonicWALL router, step-

by-step. On the Allied Telesis router, it uses the Site-To-Site VPN wizard for the VPN

configuration.

The wizard runs on selected AR400 Allied Telesis routers from the router’s web-based GUI

(graphical user interface). It asks you to enter a few details and from those it configures the

following settings:

zencryption to protect traffic over the VPN

zISAKMP with a pre-shared key to manage the VPN

zthe firewall, to protect the LANs and to allow traffic to use the VPN

zNetwork Address Translation (NAT), so that you can access the Internet from the private

LAN through a single public IP address. This Internet access does not interfere with the

VPN solution

z(in this example) NAT-Traversal because one end of the VPN tunnel is behind a separate

NAT device

Create a VPN between an Allied Telesis and a

SonicWALL Router, with NAT-T

Page 2 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

What information will you find in this document?

This How To Note begins with the following information:

z"Related How To Notes" on page 2

z"Which products and software version does it apply to?" on page 2

Then it describes the configuration, in the following sections:

z"The network" on page 3

z"How to configure the Allied Telesis router" on page 4

z"How to configure the SonicWALL router" on page 12

z"How to test the tunnel" on page 29

z"How to use the CLI instead of the GUI" on page 30

Related How To Notes

Allied Telesis offers How To Notes with a wide range of VPN solutions, from quick and

simple solutions for connecting home and remote offices, to advanced multi-feature setups.

Notes also describe how to create a VPN between an Allied Telesis router and equipment

from a number of other vendors.

For a complete list of VPN How To Notes, see the Overview of VPN Solutions in How To Notes

in the How To Library at www.alliedtelesis.com/resources/literature/howto.aspx.

Which products and software version does it apply to?

The VPN wizard is available on the following Allied Telesis routers, running Software Version

2.9.

or later:

zAR4

zAR440S, AR44

S, AR442S

You can use the command line to set up an equivalent configuration on AR700 and other

AR400 Series routers. See "How to use the CLI instead of the GUI" on page 30 for the

necessary commands.

We created this example with a SonicWALL TZ

70, running SonicOS Enhanced 2.5.

-65e.

SonicOS Standard does not support NAT-T draft 3, so this solution requires SonicOS

Enhanced.

The screenshots in this Note are from an Internet Explorer 6.0 browser running on

Windows XP.

Page 3 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

The network

This example illustrates a NAT-T solution, which you need when one or both of the routers

are behind a NAT device such as some xDSL and cable modems. In this example, an Allied

Te l e s i s A R 4

5S router is behind a NAT device. The following diagram shows the LANs and

their interfaces and addresses.

Note: You can still use this example if you have no NAT device between the Allied Telesis

router and the Internet, or if you have a NAT device between the SonicWALL router and the

Internet, with slight alterations. See "Appendix: Using this example if you don’t have a NAT

device in the same position" on page 31 for details.

Initiating the

tunnel from

either end

In this example, you can only initiate the tunnel from the Allied Telesis end, not the

SonicWALL end. If you want to let the SonicWALL initiate the VPN too, you have to

configure your NAT device to allow it. To do this, set up pinholes (allow rules) on the NAT

device to allow through UDP traffic on ports 500 and 4500.

vlan1:

192.168.1.1

eth0:

192.168.254.1/30

Allied Telesis

router

192.168.254.2/30

100.100.100.1/30

NAT device

SonicWALL

router

Internet

WAN:

200.200.200.1/30

workstation:

192.168.1.100 by

automatic address

assignment

VLAN:

192.168.2.1

workstation:

192.168.2.100 by

automatic address

assignment

VPN

tunnel

200.200.200.2/30

100.100.100.2/30

at-sonic.eps

Page 4 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

How to configure the Allied Telesis router

Before you

start

1. Install and configure the NAT device.

2. Access the router via its GUI.

3. Customise the router and set up vlan

as the LAN interface. The site-to-site VPN wizard

always uses vlan

as the local LAN for the VPN connection, so you must make sure an IP

interface is configured on vlan

before running the wizard.

4. Create a security officer. If you use the Basic Setup wizard to customise the router, this

creates one security officer, with a username of “secoff”.

5. Set up the WAN interface. This example uses a fixed IP address on the WAN interface—

modify it to use an appropriate interface for your network.

The router setup of steps 2-5 is described in How To Use the Allied Telesis GUI to Customise the

Router and Set Up An Internet Connection, which is available from www.alliedtelesis.com/

resources/literature/howto.aspx.

In this example, the Allied Telesis router has the following settings:

The NAT device has the following settings:

Interface Address Mask

Allied Telesis router LAN vlan

92.

68.

255.255.255.0

Allied Telesis router WAN eth0

92.

68.254.

255.255.255.252

Remote site’s WAN settings 200.200.200.

Remote site’s LAN settings

92.

68.2.

255.255.255.0

Interface Address Mask

Private interface (towards the router) eth

92.

68.254.2 255.255.255.252

Public interface (towards the Internet) eth0

00.

255.255.255.252

Page 5 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Create the

VPN tunnel

changes to secure mode when you finish the VPN wizard and at that stage prompts you to

The Site-To-Site VPN wizard is one of the options on the Configuration Wizards page. Make

sure your browser’s pop-up blocker is disabled—the wizard needs to open pop-ups. If you

access the Internet through a proxy server, make sure your browser bypasses the proxy for

this address.

The GUI opens at this page the first time you configure your router. After initial configuration

it may open at the System Status page instead. If so, click on the Wizards button in the left-

hand menu to open the Configuration Wizards page.

1. Open the Configuration Wizards page

Page 6 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Click on the Site-to-Site VPN button.

The wizard starts by displaying a

welcome message.

Click the Next button.

Enter an appropriate VPN connection

name.

Click the Next button. If you have

multiple possible WAN interfaces

configured on the router, the wizard

next lets you select the appropriate

interface. In this example there is only

one WAN interface, so the wizard

selects it automatically and moves

directly to the remote site settings.

2. Start the Site-to-Site VPN wizard

3. Name the VPN connection

Page 7 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Enter the public IP address of the other

end of the tunnel. In this example, this

is 200.200.200.

, which is the IP

address of the SonicWALL WAN

interface.

Note that you can use the Tab key to

move between fields when entering the

address, but should not use the . key

(the period).

Click the Next button.

Enter the SonicWALL router’s LAN

subnet address and mask. In this

example, this is

92.

68.2.0 and a mask

of 255.255.255.0.

Click the Next button.

4. Enter the remote site’s WAN IP address

5. Enter the remote site’s LAN IP address

Page 8 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Enter the secret key, which is an

alphanumeric string between 2 and 64

characters long. Both routers must use

the same secret key. On the

SonicWALL router, this is the Site-to-

Site Policy’s preshared key.

Click the Next button.

Check the summary. If necessary, use

the wizard’s Back button to return and

correct any settings you want to

change.

Once you are happy with the settings,

click the Advanced Settings button to

modify Peer ID settings.

6. Enter the shared secret key

7. Check the settings

Page 9 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Peer IDs enable the routers to identify

each other when they exchange secret

key information. By default, the Peer

IDs are the router IP addresses. This

does not work when one (or both)

routers are behind a separate NAT

device, because the NAT device

changes the IP addresses.

Towards the bottom of the Advanced

Settings page, enter a local ID (to

identify this router) and a remote ID

(to identify the router at the other end

of the link). It does not matter what

text you use as the IDs, so long as each

ID is different.

Then click the OK button.

8. Specify Peer IDs

Page 10 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Check the summary. It now includes

the Peer ID settings. If necessary,

correct any settings you want to

change.

When all the settings are correct, click

the Apply button.

Security

officer

If you are logged in as the security

officer, the GUI displays a completion

message. Click the Finish button to

finish the Wizard and save the VPN

settings.

9. Check the settings again

10. Finish the wizard

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Allied Telesis Routeur réseau

Allied Telesis

Allied Telesis Rapier AR 700 Series Manuel utilisateur

Allied Telesis

Allied Telesis AT-8000GS/24POE Manuel utilisateur

Allied Telesis

Allied Telesis AT-GS950/24 Manuel utilisateur

Allied Telesis

Allied Telesis AT WA1104G SOHO Wireless Router AT-WA1104G-10... Mode d’emploi

Allied Telesis

Allied Telesis AT-GS950/16 Manuel utilisateur

Allied Telesis

Allied Telesis AR 300 AT-AR300 AT-AR300 Mode d’emploi

Allied Telesis

Allied Telesis AT-AR236E Manuel utilisateur

Allied Telesis

Allied Telesis AT-10408XP Manuel utilisateur

Allied Telesis

Allied Telesis AR400 Series Manuel utilisateur

Allied Telesis

Allied Telesis AT-AR240E Manuel utilisateur

Allied Telesis

Allied Telesis AR100 series Manuel utilisateur

Allied Telesis

Allied Telesis AT-GS950/8 Manuel utilisateur

Allied Telesis

Allied Telesis AT-9408LC/SP Series Manuel utilisateur

Allied Telesis

Allied Telesis AT-AR236E Manuel utilisateur

Allied Telesis

Allied Telesis AT-8000C Guide de référence

Allied Telesis

Allied Telesis AT-AAR256E v3 Manuel utilisateur

Allied Telesis

Allied Telesis AR400 Series Manuel utilisateur

Allied Telesis

Allied Telesis AT-AR256E Manuel utilisateur

Allied Telesis

Allied Telesis 86222-06 Manuel utilisateur

Allied Telesis

Allied Telesis AT-FS724L Manuel utilisateur

Allied Telesis

Allied Telesis SwitchBlade AT-AR440S Manuel utilisateur

Allied Telesis

Allied Telesis AT-8000S Series Mode d’emploi

Allied Telesis

Allied Telesis AT-WR4662n Manuel utilisateur

Allied Telesis

Allied Telesis AT-AR3050S Manuel d'installation

Manuels Routeur réseau populaires d'autres marques

Allnet

Allnet ALL0333AU Manuel utilisateur

HomeSeer

HomeSeer HT-SEL Manuel utilisateur

Sercomm

Sercomm Genesis OC3505D Manuel utilisateur

Billion

Billion BIPAC 5102 Series Manuel utilisateur

TP-Link

TP-Link TD-8817 Manuel utilisateur

Motorola

Motorola MR1900 Manuel utilisateur

Digi

Digi IX14 Manuel utilisateur

Cisco

Cisco NCS 540 Manuel

XAVi

XAVi X8821e Manuel utilisateur

BEC

BEC 6200WZL Manuel utilisateur

MikroTik

MikroTik hAP ac3 Series Manuel utilisateur

Korenix

Korenix JetNet 5428G Series Manuel utilisateur

NETGEAR

NETGEAR FS526T - Switch Manuel utilisateur

Korenix

Korenix JetNet 5710G Series Manuel utilisateur

Automated Logic

Automated Logic ZN551 Manuel du propriétaire

Cisco

Cisco ASR 1000 Series Manuel de l'opérateur

EnGenius

EnGenius ESR-9710 Manuel utilisateur

Cisco

Cisco 805 Series Instructions d'utilisation et de sécurité