ELTEX ESR Series User Manual

ESR-Series. User manual
203
2.
Create security parameters profile for IPsec tunnel. Specify 3DES encryption algorithm and SHA1
authentication algorithm in the profile. Use the following parameters to secure IPsec tunnel:
esr(config)# security ipsec proposal IPSECPROP
esr(config-ipsec-proposal)# authentication algorithm sha1
esr(config-ipsec-proposal)# encryption algorithm 3des
esr(config-ipsec-proposal)# exit
Create a policy for IPsec tunnel. For the policy, specify the list of IPsec tunnel profiles that may be used
for node negotiation:
esr(config)# security ipsec policy IPSECPOLICY
esr(config-ipsec-policy)# proposal IPSECPROP
esr(config-ipsec-policy)# exit
CreateIPsec VPN. For VPN, specify IKE protocol gateway, IPsec tunnel policy, key exchange mode and
waiting mode for the incoming IPsec connection – by-request. When all parameters are entered, enable
tunnel using the enable command.
esr(config)# security ipsec IPSECVPN
esr(config-ipsec-vpn)# mode ike
esr(config-ipsec-vpn)# ike establish-tunnel by-request
esr(config-ipsec-vpn)# ike gateway IKEGW
esr(config-ipsec-vpn)# ike ipsec-policy IPSECPOLICY
esr(config-ipsec-vpn)# enable
esr(config-ipsec-vpn)# exit
Allow esp protocol and udp ports 500, 4500 in the firewall configuration for establishing IPsec VPN:
esr(config)# security zone-pair untrusted self
esr(config-zone-pair)# rule 1
esr(config-zone-pair-rule)# action permit
esr(config-zone-pair-rule)# match protocol udp
esr(config-zone-pair-rule)# match destination-port ISAKMP
esr(config-zone-pair-rule)# enable
esr(config-zone-pair-rule)# exit
esr(config-zone-pair)# rule 2
esr(config-zone-pair-rule)# action permit
esr(config-zone-pair-rule)# match protocol esp
esr(config-zone-pair-rule)# enable
esr(config-zone-pair-rule)# exit
esr(config-zone-pair)# end
R2 configuration
Configure external network interface and identify its inherence to a security zone:
esr# configure
esr(config)# interface gi 1/0/1
esr(config-if)# ip address 120.11.5.1/24
esr(config-if)# security-zone untrusted
esr(config-if)# exit

ELTEX ESR Series Specifications

General

Model	ESR Series
Category	Network Router
Manufacturer	ELTEX
Management	Web interface, CLI, SNMP
Operating Temperature	0°C to 40°C
Dimensions	Varies by model
Weight	Varies by model
Routing Protocols	OSPF, BGP
WAN Interfaces	Ethernet, SFP
LAN Interfaces	Ethernet, SFP
VPN Support	IPsec, L2TP, PPTP
Firewall	Stateful packet inspection, ACLs
Power over Ethernet (PoE)	Available on some models
QoS	Traffic prioritization