Digi Digi Connect WAN Guide de l'utilisateur

Digi Connect® WAN Application Guide

Primary Connections via NAT-T, IPsec ESP or GRE

Scenario

Digi Connect WAN is used for primary remote site connectivity. IPsec VPN or GRE

traffic is terminated by routers or VPN appliance at each end. The Digi Connect WAN

passes this traffic through.

Theory of Operation

The router’s Ethernet WAN port attaches to the Ethernet port of the Digi Connect WAN,

typically via an Ethernet crossover cable.

The wireless carrier provides only one IP address to the mobile interface. The Digi

Connect WAN uses Network Address Translation (NAT) where only the mobile IP

address is visible to the outside. All outgoing traffic uses the mobile IP address of the

Digi Connect WAN.

Since NAT changes IPsec headers, devices that support GRE, IPsec ESP or NAT-T

(IPsec-in-UDP) “tunneling” at each end of the connection are usually required.

For incoming data, the Digi Connect WAN forwards IP traffic destined for GRE or IPsec

ESP protocol, TCP/UDP port or port range from the cellular IP interface to a private IP

address on the Digi Connect WAN’s Ethernet port.

Sample Diagram:

Wireless

Network

Digi

Connect

WAN

Internet or

Frame Relay

GRE Tunnel / IPSec ESP / IPSec in UDP

Router/VPN Router/VPN

Remote Site

LAN

Router/VPN

WAN Port

192.168.0.2

Connect WAN

Ethernet Port

192.168.0.1 Connect WAN

Mobile IP

166.123.123.123

Router/VPN

LAN Port

10.10.10.1

GSM GPRS/EDGE APN Type needed: Typically a Custom APN is required since the

VPN end-points must use usually have static (persistent) IP addresses. An Internet APN

may work if the main site (HQ) VPN appliance can support Dynamic DNS names.

Remote Site Router Requirements: Any router that supports GRE, IPsec ESP or NAT-T

(or uses IPsec-in-UDP) should work.

Remote Site Router / VPN Appliance Configuration:

Router default gateway: Digi Connect WAN’s Ethernet port IP address

Policy to use ESP, GRE or NAT-T tunneling; or just GRE if no encryption is required

7/18/2005 Digi International 1 of 3

Digi Connect Application Guide - Primary Connections

HQ Router / VPN Appliance Configuration: The HQ appliance’s tunnel policy peer

address will be the Connect WAN’s Mobile IP address. For this reason a static mobile IP

address is preferred on the Digi Connect WAN.

IPsec forwarding: Digi Connect WAN firmware revision D introduced IPsec forwarding

where IPsec ESP tunnel-mode traffic can be forwarded to a specific Ethernet IP address.

Current firmware is available via http://www.digi.com/support.

Console Port: As a side benefit, the Digi Connect WAN console port can configured for

“Console Management” to provide SSH or telnet access. It can be cabled to the router or

VPN appliance’s console port to provide true diverse out-of-band console access.

Digi Connect Typical WAN Configuration

1. Read and follow the quick-start guide for the Digi Connect WAN and optionally for

Digi Connectware® Manager if used.

2. Assign a static IP address to the Ethernet port. Note the default gateway may show or

change to an address such as 10.6.6.6. This is normal as it is the GSM provider’s

network default gateway.

3. Configure Forwarding via Network > IP Forwarding Settings:

a. For GRE: Enable GRE protocol forwarding and enter the IP address of the

router’s WAN Ethernet port (the router attached to the Digi Connect WAN).

b. For IPsec ESP forwarding: Enable IPsec ESP forwarding and enter the IP

address of the router’s WAN Ethernet port (attached to the Digi Connect

WAN)

c. For NAT-T: Create two UDP port forwarding entries for Ports 500 and 4500*

(both source and destination ports) and enter the IP address of the router’s

WAN Ethernet port (the router attached to the Digi Connect WAN).

*Some appliances may use ports other than 4500. Check the router

documentation for acceptable UDP port numbers. Note also that the Digi

Connect WAN can use different ports for source and destination. If the

HQ router uses port 10000, but the remote router uses 4500, for example,

create a port forwarding entry for source of 10000 and destination of 4500.

d. Press APPLY to accept the changes

4. Optionally configure IP filtering and TCP services to block any unwanted incoming

connections.

Example NAT-T (IPsec in UDP) Setup

Refer to the diagram above using these IP addresses:

Remote site router 192.168.0.2

Digi Connect WAN Ethernet port 192.168.0.1

Digi Connect WAN Ethernet link 166.123.123.123

The HQ router will use the mobile IP address of the Digi Connect WAN (in this case

166.123.321.123) as its tunnel peer address.

7/18/2005 Digi International 2 of 3

Digi Connect Application Guide - Primary Connections

For a NAT-T (IPsec in UDP) configuration, create these entries on the Digi Connect

WAN via Network > IP Forwarding Settings:

Protocol Source Port Destination IP Address Destination Port

UDP 500 192.168.0.2 500

UDP 4500 192.168.0.2 4500

Press Apply. IPsec-in-UDP traffic should now pass through the Digi Connect WAN.

GRE or IPsec ESP Forwarding: Go to Configure > Network > IP Forwarding and

select either IPsec or GRE forwarding. Enter the IP address of the router / VPN appliance

Ethernet LAN port.

Client-to-Site VPNs: Port, GRE or IPsec forwarding may not be required if the VPN is

configured for client-to-site where the tunnel(s) is initiated only from the remote site.

Where to Get More Information

Refer to the Digi Connect WAN user documentation and Digi technical support website

at www.digi.com/support for more information. Technical assistance is available at

http://www.digi.com/support/eservice/eservicelogin.jsp.

For sales and product information, please contact Digi International at 952-912-3444 or

via www.digi.com.

7/18/2005 Digi International 3 of 3

Table des matières

Autres manuels Digi Routeur réseau

Digi

Digi TransPort WR11 Manuel utilisateur

Digi

Digi TransPort WR41 Manuel utilisateur

Digi

Digi WR44v1 Manuel utilisateur

Digi

Digi TransPort WR41 Manuel utilisateur

Digi

Digi IX14 Manuel utilisateur

Digi

Digi TransPort WR21 Manuel utilisateur

Digi

Digi ConnectPort X4 Manuel utilisateur

Digi

Digi TransPort Manuel utilisateur

Digi

Digi Connect WAN Sync Edge 10 Manuel utilisateur

Digi

Digi TransPort WR11 XT Manuel utilisateur

Digi

Digi TransPort WR11 XT Manuel utilisateur

Digi

Digi SR44-E Manuel utilisateur

Digi

Digi ConnectPort WAN GPS Manuel utilisateur

Digi

Digi ConnectPort X4 IA Manuel utilisateur

Digi

Digi 6310-DX Manuel utilisateur

Digi

Digi IX10-00G4 Manuel utilisateur

Digi

Digi TransPort WR11 Manuel utilisateur

Digi

Digi EX40 Manuel utilisateur

Digi

Digi TX54 Manuel utilisateur

Digi

Digi TransPort WR54 Guide d'application

Digi

Digi TransPort WR21 Instructions d'installation et d'utilisation

Digi

Digi XLR PRO Manuel utilisateur

Digi

Digi IX14 Manuel utilisateur

Digi

Digi Connect Series Guide de l'utilisateur

Manuels Routeur réseau populaires d'autres marques

Allnet

Allnet ALL0333AU Manuel utilisateur

HomeSeer

HomeSeer HT-SEL Manuel utilisateur

Sercomm

Sercomm Genesis OC3505D Manuel utilisateur

Billion

Billion BIPAC 5102 Series Manuel utilisateur

TP-Link

TP-Link TD-8817 Manuel utilisateur

Motorola

Motorola MR1900 Manuel utilisateur

Cisco

Cisco NCS 540 Manuel

XAVi

XAVi X8821e Manuel utilisateur

BEC

BEC 6200WZL Manuel utilisateur

MikroTik

MikroTik hAP ac3 Series Manuel utilisateur

Korenix

Korenix JetNet 5428G Series Manuel utilisateur

NETGEAR

NETGEAR FS526T - Switch Manuel utilisateur

Korenix

Korenix JetNet 5710G Series Manuel utilisateur

Automated Logic

Automated Logic ZN551 Manuel du propriétaire

Cisco

Cisco ASR 1000 Series Manuel de l'opérateur

EnGenius

EnGenius ESR-9710 Manuel utilisateur

Cisco

Cisco 805 Series Instructions d'utilisation et de sécurité

LevelOne

LevelOne FBR-1416 Manuel utilisateur