GE MDS ORBIT ECR User Manual

260 MDS Orbit MCR/ECR Technical Manual MDS 05-6632A01, Rev. F
The following table describes the VPN connection attempt retries and time interval between them. After
giving up as listed below, the unit waits for “failure-retry-interval” and repeats the connection attempt
sequence.
Table 3-19. VPN Connection Retry
Attempt#
Relative Timeout
Between Attempts (secs)
Absolute Timeout
From First Attempt (secs)
1
0
0
2 (1
st
retry)
4
4
3 (2
nd
retry)
7
11
4 (3
rd
retry)
13
24
5 (4
th
retry)
23
47
6 (5
th
retry)
42
89
Give up
76
165
Wait for “failure-retry-interval”, then repeat above sequence
During initial configuration set failure-retry-interval to lowest value of 1 min, to have Orbit attempt
connection more quickly. This allows debugging of any connection-related issue by watching logs on
peer side etc. Be sure to change this value to 5 minutes or higher to prevent excessive attempts and traffic.
Commit configuration to save the changes.
% commit
Following shows IKE policy configuration for public-key encryption based authentication method:
Create IKE policy with auth-method “public-key encryption”. 1.
% set services vpn ike policy IKE-POLICY-1 auth-method pub-key
Configure Public Key Infrastructure (PKI) security credentials. 2.
d. Certificate type as “rsa” if RSA public key encryption based certificates are being used.
e. Client certificate ID – This is the ID that was assigned to the client certificate obtained via
SCEP or loaded manually (assumed to be ID-1).
f. Client private key ID – This is the ID that was assigned to the client private key generated
during SCEP procedure or loaded manually (assumed to be ID-1).
g. Certificate Authority (CA) certificate ID – This is the ID that was assigned to the CA certificate
obtained via SCEP or loaded manually (assumed to be CA-1).
% set services vpn ike policy IKE-POLICY-1 pki cert-type rsa
% set services vpn ike policy IKE-POLICY-1 pki cert-id ID-1
% set services vpn ike policy IKE-POLICY-1 pki key-id ID-1
% set services vpn ike policy IKE-POLICY-1 pki ca-cert-id CA-1
Firewall Configuration
The VPN wizard automatically configures the firewall to allow incoming and outgoing IKE/IPsec traffic
over the Cell/WAN interface. However, when VPN is configured manually via Services->VPN->Basic
Config menu or via CLI, the firewall needs to be manually configured as well:
1. Add following rules to IN_UNTRUSTED filter that is applied to the Cell interface in the incoming
direction:
% set services firewall filter IN_UNTRUSTED rule 1 match protocol icmp

GE MDS ORBIT ECR Specifications

General

Brand	GE
Model	MDS ORBIT ECR
Category	Network Router
Language	English