Allied Telesis AR440S User manual

C613-16049-00 REV E www.alliedtelesis.com
AlliedWareTM OS
How To |
Introduction
In this How To Note’s example, a headquarters office has VPNs to two branch offices and a
number of roaming VPN clients. The example illustrates the following possible components
that you could use in a corporate network:
zVPNs between a headquarters office and roaming VPN clients, such as travellers’ laptops
zVPNs between a branch office and roaming VPN clients, such as travellers’ laptops
za VPN between a headquarters office and a branch office with a fixed IP address, when the
branch office has an ADSL PPPoA connection to the internet
za VPN between a headquarters office and a branch office with a dynamically assigned IP
address, when the branch office has an ADSL PPPoEoA connection to the internet
zusing software QoS to prioritise voice (VoIP) traffic over the VPNs
Select the solution components that are relevant for your network requirements and
internet connection type.
Contents
Which products and software versions does this information apply to? ................................... 2
Related How To Notes .......................................................................................................................... 2
About IPsec modes: tunnel and transport ......................................................................................... 3
Background: NAT-T and policies .......................................................................................................... 4
How to configure VPNs in typical corporate networks ................................................................. 6
Before you start ............................................................................................................................... 7
How to configure the headquarters VPN access concentrator ........................................... 8
How to configure the AR440S router at branch office
1 ..................................................... 16
How to configure the AR440S router at branch office 2 ..................................................... 24
Configure VPNs in a Corporate Network, with
Optional Prioritisation of VoIP

Page 2 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
How to make voice traffic high priority ........................................................................................... 30
How to prioritise outgoing VoIP traffic from the headquarters router ............................ 31
How to prioritise outgoing VoIP traffic from the branch office
1 router ......................... 33
How to prioritise outgoing VoIP traffic from the branch office 2 router ......................... 35
How to test your VPN solution ......................................................................................................... 36
Configuration scripts for headquarters and branch offices ......................................................... 37
Before you use these scripts ....................................................................................................... 37
Headquarters VPN access concentrator's configuration ..................................................... 38
Branch office
1 AR440S configuration—the PPPoA site with VPN client access
and a fixed IP address ............................................................................................................ 43
Branch office 2 AR440S configuration—the PPPoEoA site with a dynamically
assigned IP address ................................................................................................................. 48
Extra configuration scripts for lab testing the VPN solution ...................................................... 52
ISP's PPPoE access concentrator configuration ...................................................................... 52
Hotel's NAT gateway firewall configuration ............................................................................ 53
Which products and software versions does this
information apply to?
The information provided in this document applies to the following products:
zAR400 Series routers
zAR750S and AR770S routers
zRapier and Rapier i Series switches
zAT-8800 Series switches
running software version 2.6.6 and above. However, prioritising the voice traffic requires
Software Quality of Service, which is available with version 2.7.
1 and above.
On the roaming VPN clients, we tested this solution with Microsoft®Windows Virtual
Private Network.
This How To Note shows how to prioritise VoIP traffic at the offices, but does not show how
to set up the VoIP facility itself on your VPN client PCs. You need to find suitable PC
software to provide that.
Related How To Notes
Allied Telesis offers How To Notes with a wide range of VPN solutions, from quick and
simple solutions for connecting home and remote offices, to advanced multi-feature setups.
Notes also describe how to create a VPN between an Allied Telesis router and equipment
from a number of other vendors.
For a complete list of VPN How To Notes, see the Overview of VPN Solutions in How To Notes
in the How To Library at www.alliedtelesis.com/resources/literature/howto.aspx.

Page 3 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
About IPsec modes: tunnel and transport
This solution uses two types of VPN:
zIPsec tunnel mode, for the headquarters office to branch office VPNs. These are site-to-
site (router-to-router) VPNs.
zIPsec transport mode with L2TP, for the roaming Windows VPN clients.
The following figure shows the protocol stacks for the tunnel mode VPN and the transport
mode VPN for the connection type PPPoA.
In this How To Note, branch office
1 uses PPPoA. The other offices in this How To Note use
different connection types and therefore have different stacks below IP. Branch office 2 uses
PPP over virtual Ethernet over ATM, and headquarters simply uses IP over an actual Ethernet
WAN connection.
IP
IPsec
IP
PPP
ATM
ADSL
statically-defined
interface ppp0
tunnel mode:
policy “hq”
IPsec payload L2TP
IPsec
IP
PPP
ATM
ADSL
statically-defined
interface ppp0
transport mode:
policy “roaming”
using L2TP server
definition
PPP IPsec payload (dynamic
PPP using template)
IP
Tunnel mode - for site-to-site VPNs Transport mode - for roaming clients
encrypted
by IPsec
vpn-protocol-stack.eps

Page 4 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
Background: NAT-T and policies
NAT-T NAT Traversal (NAT-T) can be enabled on any of our IPsec VPN links. It automatically allows
IPsec VPNs to traverse any NAT gateways that may be in the VPN path. This is likely to occur
with the VPNs from the roaming VPN clients—they are likely to use a LAN at a remote site
that is behind a NAT gateway.
NAT-T may also be applicable for a site-to-site VPN, if one of the routers is behind a NAT
gateway, such as some ADSL devices. Note that AR44xS series routers provide an ADSL
interface, which removes the need for a separate ADSL device. Therefore, the examples in
this How To Note do not include NAT-T for the site-to-site VPNs.
The following figure shows how the addresses in the IPsec headers change as a packet from a
roaming client traverses NAT gateways in the VPN pathway. The figure illustrates IPsec
transport mode with L2TP.
NAT gateway
Dest Addr
IP
PPP
L2TP
IPsec
IP
ETH
Source Addr
192.168.143.1
N/A
N/A
N/A
192.168.200.1
192.168.140.27
N/A
N/A
N/A
200.200.200.1
N/A N/A
Encrypted
192.168.200.1
roaming VPN
client
192.168.200.254
211.211.211.1
hotel
Dest Addr
IP
PPP
L2TP
IPsec
IP
ETH
Source Addr
192.168.143.1
N/A
N/A
N/A
211.211.211.1
192.168.140.27
N/A
N/A
N/A
200.200.200.1
N/A N/A
Encrypted
Internet
headquarters
VPN access
concentrator
Dest Addr
IP
ETH
Source Addr
192.168.143.1
N/A
192.168.140.27
N/A
200.200.200.1
192.168.140.254
192.168.140.27
hotel
headquarters
vpn-nat-t.eps

Page 5 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
Policies and
interfaces
It is useful to keep in mind that you apply firewall rules and IPsec policies to interfaces in the
following different ways:
zFirewall rules can be applied on either private or public interfaces. The rules are matched
against traffic that comes into the interface to which they were applied. Rules applied to
private interfaces are typically quite different to rules applied to public interfaces.
zIPsec policies are applied only on the public interface. The policy definitions, and any active
Security Associations (SAs), are considered for both incoming and outgoing traffic on that
interface.

Page 6 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
How to configure VPNs in typical corporate
networks
This section describes a typical corporate network using secure VPN. The network consists
of a headquarters (HQ) router and two branch office routers. The headquarters router is
acting as a VPN Access Concentrator, and allows for VPN access from either of the branch
office sites or from roaming laptop VPN clients. The network is illustrated in the following
figure.
Branch office
1 uses the PPPoA ADSL link type, and branch office 2 uses the PPPoEoA ADSL
link type. We have done this to illustrate these two commonly used ADSL link types. For
information about the ADSL link type you need, see your ADSL provider.
This How To Note gives you the commands for configuring each of the following:
1. The headquarters VPN access concentrator router, which includes:
zan ethernet connection to the Internet
za fixed Internet address. This means that the branch offices and the roaming VPN
clients have a known target for the headquarters end of the VPN
zVPN access to and from branch office 1 . This can be initiated from the headquarters
or branch office end. This is a site-to-site VPN and uses IPsec tunnel mode (see
"Background: NAT-T and policies" on page 4).
zVPN access from branch office 2. This can only be initiated from the branch office end,
because the branch office has a dynamically-assigned IP address. This also uses IPsec
tunnel mode.
zVPN client access from roaming users on Windows 2000 and Windows XP. This is
provided by using IPsec transport mode with L2TP (see "About IPsec modes: tunnel
and transport" on page 3)
zoptionally, prioritisation of voice (VoIP) traffic for these VPN clients by using Software
Quality of Service (SQoS). If the VPN clients use VoIP to establish voice calls via the
headquarters network, this helps maintain voice quality.
VLAN 1
192.168.141.254
222.222.222.1 222.222.222.254 200.200.200.254 192.168.140.254
211.211.211.1
192.168.200.254
physical address: 192.168.200.1
VPN tunnel address frompool: 192.168.143.1
211.211.211.254
200.200.200.1
ISP’s
router
headquarters
VPN access
concentrator
corporate
LAN
hotel’s NAT gateway
roaming VPN client
branch office 1
VPN router
branch office 2
dynamically
assigned
VLAN 1
192.168.142.254
Telco’s ADSL
exchange
Pool ofaddresses available
for roaming clients:
192.168.143.1-50
vpn-corporate.eps

Page 7 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
2. The branch office 1 router, which provides:
zan ADSL PPPoA Internet connection. Note that the PPPoA connection requires an
ATM DSLAM
zVPN access to headquarters using IPsec tunnel mode
zincoming VPN client access from roaming users
za fixed Internet address so that roaming VPN clients have a known target for the
branch office end of the VPN
3. The branch office 2 router, which provides:
zan ADSL PPPoEoA Internet connection
zVPN access to headquarters using IPsec tunnel mode
za dynamically assigned Internet address, as used by many ISPs.
Color coding For your convenience, the configurations are color-coded:
Before you start
Don’t forget to check you have the following when planning your secure VPN network:
1. ISAKMP shared key
2. Fixed public IP addresses to use where appropriate
3. The IP subnets to use on private LANs at the branch and headquarters sites
4. The range of IP addresses to use in the IP pools for allocating to the remote users
5. Usernames and passwords for the remote users
6. IP addresses from which SSH connections can be made to the routers (if applicable)
7. Connection parameters for the ADSL connections at the branch offices
8. VPN client PCs set up, as described in the How To Notes in "Related How To Notes" on
page 2.
headquarters
branch office 1
branch office 2

Headquarters
Page 8 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
How to configure the headquarters VPN access
concentrator
Before you begin to configure your router, ensure that it is running the appropriate software
release, patch and GUI files and has no configuration.
set inst=pref rel=<rel-file> pat=<patch-file> gui=<gui-file>
set conf=none
disable system security
restart reboot
Note: A software QoS extension to this configuration, to prioritise VoIP traffic over the
VPNs, is available in "How to prioritise outgoing VoIP traffic from the headquarters router" on
page 31.
Name the router
set system name=HQ
Define a security officer.
add user=secoff pass=<your-secoff-password> priv=securityofficer
lo=yes telnet=yes
Do not forget your “secoff” password.
Enable security mode so that VPN keys are stored securely, and other security features are
enabled.
enable system security
Once security mode is enabled, you need to log in as a security officer to enter most
configuration-altering commands.
login secoff
password: <your-secoff-password>
It is important to keep this security officer username and password secure, and to consider
proper handover of it in the event of IT staff changes.
Also, we recommend you leave a “manager” privilege user defined because this may provide
backup access if the security officer password is lost. Do not leave the manager password at
the factory default—change it to a password in keeping with your company's security policy.
set user=manager password=<your-company-policy-password>
When security mode is enabled, router configuration access times out after inactivity to
prevent unauthorised access. The default timeout is 60 seconds, but you may temporarily
raise it to 600 seconds if desired.
set user securedelay=600
1. Configure general system and user settings

Headquarters
Page 9 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
Give a fixed public address to the interface eth0, which is the Internet connection interface.
You can replace eth0 with ppp0 if you use a leased line.
enable ip
add ip int=eth0 ip=200.200.200.1
Give a fixed private address to the interface vlan 1 , which connects the router to the
headquarters LAN.
add ip int=vlan1 ip=192.168.140.254
Set the default route. The next hop is the gateway address provided by the ISP.
add ip rou=0.0.0.0 mask=0.0.0.0 int=eth0 next=200.200.200.254
If desired, set up the router as a DHCP server for the headquarters LAN.
create dhcp policy=hq lease=7200
add dhcp policy=hq rou=192.168.140.254
add dhcp policy=hq subn=255.255.255.0
create dhcp range=hq_hosts policy=hq ip=192.168.140.16 num=32
ena dhcp
If you need remote management access, we strongly recommend that you use Secure Shell
(SSH). You should not telnet to a secure gateway.
To configure SSH, define appropriate RSA encryption keys, then enable the SSH server.
create enco key=2 type=rsa length=1024 description="host key"
format=ssh
create enco key=3 type=rsa length=768 description="server key"
format=ssh
enable ssh server serverkey=3 hostkey=2
Enable the user who connects via SSH to log in as secoff, by adding the secoff user as an SSH
user. Also, you may choose to restrict access so that it is only permitted from particular
addresses.
add ssh user=secoff password=<secoff-password>
ipaddress=<trusted-remote-ip-address>
mask=<subnet-mask-of-trusted-hosts>
disable telnet server
Secure Shell is a more secure, encrypted method of remote management access than telnet.
If you need to use telnet, even though it is insecure, you should restrict access by defining
2. Configure IP for internet access
3. Configure remote management access, if desired

Headquarters
Page 10 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
remote security officers (RSOs). RSO definitions specify trusted remote addresses for
security officer users.
add user rso ip=<ipadd>[-<ipadd>]
enable user rso
enable telnet server
If desired, set the router to send log messages to a syslog server.
create log output=2 destination=syslog server=<syslog-server-address>
syslogformat=extended
add log out=2 filter=1 sev=>3
If desired, you can configure SNMP to inform you or your service provider of network
events, such as the LAN interface of the router going down. We recommend SNMPv3 for
security reasons. For details, see How To Configure SNMPv3 On Allied Telesis Routers and
Managed Layer 3 Switches. This How To Note is available from www.alliedtelesis.com/
resources/literature/howto.aspx.
You need to configure dynamic PPP over L2TP to accept incoming Windows VPN client
connections.
Create an IP pool to allocate unique internal payload addresses to incoming VPN clients.
create ip pool=roaming ip=192.168.143.1-192.168.143.50
Define a PPP template. This defines authentication and uses the IP pool of addresses.
create ppp template=1
set ppp template=1 bap=off ippool=roaming authentication=chap echo=10
lqr=off
Configure L2TP. When the router successfully negotiates an L2TP tunnel connection from
any remote peer, it then creates a PPP interface over that tunnel, using the PPP parameters
defined by the PPP template. If you intend to prioritise voice traffic (see page 30), also turn
on TOS (type of service) reflection, so that DSCP marked VoIP packets can be classified for
prioritisation at the PPP level.
enable l2tp
enable l2tp server=both
add l2tp ip=1.1.1.1-255.255.255.254 ppptemplate=1 tos=on
Add your approved roaming VPN client usernames.
add user=roaming1 pass=roaming1 lo=no telnet=no
add user=roaming2 pass=roaming2 lo=no telnet=no
If desired, you can instead use a RADIUS authentication server.
add radius server=<radius-server-address> secret=<secret-key>
4. Capture status information remotely, if desired
5. Configure dynamic PPP over L2TP connections

Headquarters
Page 11 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
Check that you have a 3DES feature licence for the ISAKMP policies.
show feature
You can purchase feature licences from your Allied Telesis distributor.
If necessary, install the licence, using the password provided by your distributor.
enable feature=3des pass=<licence-number>
Enable IPsec
enable ipsec
In this example, IPsec SA specifications propose:
zISAKMP as the key management protocol
zESP as the IPsec protocol
z(for site-to-site VPNs) 3DESOUTER as the encryption algorithm for ESP
z(for site-to-site VPNs) SHA as the hashing algorithm for ESP authentication
z(for roaming client VPNs) four possible variants of VPN encryption, for added flexibility.
We propose the most secure option first.
Create an SA specification for the branch office site-to-site VPN. This SA specification uses
tunnel mode by default.
create ipsec sas=1 key=isakmp prot=esp enc=3desouter hasha=sha
Create a group of SA specifications for the roaming VPN clients. These SA specifications use
IPsec transport mode for Windows VPN interoperability. Multiple specifications allow IPsec
to negotiate different levels of encryption to match what your version of the VPN client
provides.
create ipsec sas=2 key=isakmp prot=esp enc=3desouter hasha=sha
mod=transport
create ipsec sas=3 key=isakmp prot=esp enc=3desouter hasha=md5
mod=transport
create ipsec sas=4 key=isakmp prot=esp enc=des hasha=sha mod=transport
create ipsec sas=5 key=isakmp prot=esp enc=des hasha=md5 mod=transport
Create two IPsec bundles, one for the remote branch routers and one for the roaming VPN
clients.
create ipsec bund=1 key=isakmp string="1"
create ipsec bund=2 key=isakmp string="2 or 3 or 4 or 5"
6. Check feature licences
7. Configure the VPNs for the branch offices and roaming clients

Headquarters
Page 12 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
Create IPsec policies to bypass IPsec for ISAKMP messages and the “port floated” key
exchange that NAT-T uses.
create ipsec pol=isakmp int=eth0 ac=permit lp=500 rp=500
create ipsec pol=isakmp_float int=eth0 ac=permit lp=4500
Create an IPsec policy for the VPN traffic between headquarters and branch office 1 . Identify
the traffic by its local and remote addresses—in this example the subnet used on the LAN at
branch office
1 (remote) is 1 92. 1 68. 1 4 1 .0/24. Note that the local address selector is wider
than the headquarter’s LAN; in fact, we cover all site subnets with this supernet.
create ipsec pol=branch1 int=eth0 ac=ipsec key=isakmp isa=branch1
bund=1 peer=222.222.222.1 lad=192.168.0.0 lma=255.255.0.0
rad=192.168.141.0 rma=255.255.255.0
Create another IPsec policy for the VPN traffic between headquarters and branch office 2.
The subnet used on the LAN at branch office 2 is
1 92. 1 68. 1 42.0/24. This policy uses
peeraddress=dynamic. The dynamic option is designed for only one dynamic peer to
connect at a time under that policy, which makes sense when the policy is intended for one
branch office.
create ipsec pol=branch2 int=eth0 ac=ipsec key=isakmp isa=branch2
bund=1 peer=dynamic lad=192.168.0.0 lma=255.255.0.0
rad=192.168.142.0 rma=255.255.255.0
Create another IPsec policy for roaming VPN clients to access headquarters. Identify the
traffic by the L2TP port (UDP traffic to port
1 70 1 ). This policy uses peeraddress=any. The
any option allows simultaneous VPN clients to be set up under the policy.
create ipsec pol=roaming int=eth0 ac=ipsec key=isakmp bund=2 peer=any
isa=roaming lp=1701 tra=udp
Create another IPsec policy for direct Internet traffic from the headquarters LAN to the
Internet, such as web browsing.
create ipsec pol=internet int=eth0 ac=permit
Note: The order of the IPsec policies is important. The Internet permit policy must be last.
Create your ISAKMP pre-shared key. This key is used when initiating your VPN during phase
one ISAKMP exchanges with your VPN peers. Share the value of this pre-shared key with all
VPN peers that use it—in this example, the roaming VPN clients and the branch office
routers. The router only uses this key during phase one ISAKMP exchanges.
create enco key=1 type=general value=<alphanumeric-preshared-key>
Enable ISAKMP.
ena isa
This example uses separate ISAKMP policies for each peer. Note the following points about
the policies:
zdifferent ISAKMP policies meet the different needs of the different types of peer—Allied
Telesis routers versus Windows VPN clients. For example, Allied Telesis peers support
heartbeats; Windows VPN clients do not.

Headquarters
Page 13 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
zthe branch office policies use a different encryption transform—3des2key—than the
roaming policy. When a new incoming ISAKMP message starts, this lets the router identify
whether to match it to the roaming policy or one of the branch office policies.
zthe policies include local IDs. These allow the remote peers to identify incoming ISAKMP
packets from the headquarters router through any NAT gateways in the path.
Create an ISAKMP policy for the VPN to branch
1 , with a fixed address. Use ISAKMP
heartbeats, which allow ISAKMP to clear SAs if either end of the link resets.
create isakmp pol=branch1 pe=222.222.222.1 sendd=true key=1 heart=both
encalg=3des2key localid=hq
Create an ISAKMP policy for the VPN to branch 2, with peer=any because the branch 2
router has a dynamic address.
create isakmp pol=branch2 pe=any sendd=true key=1 heart=both
encalg=3des2key localid=hq
Create an ISAKMP policy for VPNs to roaming VPN clients, with peer=any because the
peers have dynamic addresses. Note that you cannot use heartbeats with Windows peers.
We recommend that you enable NAT-T, because the roaming VPN clients will sometimes
need to connect through a NAT-T gateway.
create isakmp pol=roaming pe=any key=1 sendd=true natt=true sendi=on
localid=hq2
The roaming policy uses the same key as the branch office policies. If you want to, you can
instead generate a unique pre-shared key to use with the roaming clients, and attach it to the
roaming policy.
Enable the firewall and create a firewall policy.
enable firewall
create firewall policy=hq
enable firewall policy=hq icmp_f=all
Specify the LAN-facing interface of the router as a private (trusted) interface on the firewall.
add firewall policy=hq int=vlan1 type=private
Specify the Internet-facing interface of the router as a public (not trusted) interface on the
firewall.
add firewall policy=hq int=eth0 type=public
Define a firewall dynamic definition to enable dynamically created interfaces to participate in
the firewall. In this case, the definition provides for the dynamic PPP over L2TP interfaces
that incoming Windows VPN connections use. In other words, when the router dynamically
creates PPP interfaces over the L2TP connections from the roaming PC clients, the router
automatically adds these dynamic interfaces as private interfaces on the firewall. The router
8. Configure the firewall’s basic settings

Headquarters
Page 14 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
can trust traffic arriving on the dynamic interfaces because—in this example configuration—it
can only come from an authenticated and encrypted VPN connection.
create firewall policy=hq dynamic=roaming
add firewall policy=hq dynamic=roaming user=any
add firewall policy=hq int=dyn-roaming type=private
Define NAT definitions to use when traffic from the local LAN accesses the Internet and to
allow Internet access for remote VPN client users.
add firewall policy=hq nat=enhanced int=vlan1 gblin=eth0
add firewall policy=hq nat=enhanced int=dyn-roaming gblin=eth0
Note: Windows VPN client default behaviour does not support “split tunnelling”. This
means that when the Windows VPN tunnel is up, all traffic passes through it, whether the
traffic is destined for the headquarters office LAN or for Internet surfing destinations.
Therefore, we suggest you define the second NAT above, to allow clients to access the
Internet via the headquarters router when their VPN connection is up.
Create a rule to allow incoming ISAKMP negotiation messages to pass through the firewall.
add firewall policy=hq ru=1 ac=allo int=eth0 prot=udp po=500
ip=200.200.200.1 gblip=200.200.200.1 gblp=500
Create a rule to support NAT-T. If a NAT gateway is detected in the VPN path, NAT-T “port
floats” IKE to port 4500, and also encapsulates IPsec inside UDP headers to the same port.
Therefore, UDP traffic to port 4500 must be allowed to pass through the firewall.
add firewall policy=hq ru=2 ac=allo int=eth0 prot=udp po=4500
ip=200.200.200.1 gblip=200.200.200.1 gblp=4500
Create a rule for the roaming VPN clients. Windows VPN client uses L2TP (UDP to port
1 70 1 ) encapsulated inside IPsec. This rule allows L2TP traffic through the firewall if it
originally arrived at the router encapsulated in IPsec (and was decapsulated by the IPsec
process before it passed to the firewall).
add firewall policy=hq ru=3 ac=allo int=eth0 prot=udp po=1701
ip=200.200.200.1 gblip=200.200.200.1 gblp=1701 enc=ips
Create a pair of rules to allow office-to-office payload traffic to pass through the firewall
without applying NAT. This traffic must bypass NAT so that the traffic matches subsequent
IPsec policy address selectors. You need two rules—one for the public interface and one for
the private interface—so that office-to-office payload traffic bypasses NAT regardless of
which side initiated the session.
The rule for the public interface uses encapsulation=ipsec to identify incoming VPN
traffic—decrypted payload data that came from the IPsec module.
add firewall policy=hq ru=4 ac=non int=eth0 prot=all enc=ips
9. Configure the firewall’s access rules

Headquarters
Page 15 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
The rule for the private interface uses both source and destination addresses to identify
outgoing VPN traffic.
add firewall policy=hq ru=5 ac=non int=vlan1 prot=all
ip=192.168.140.1-192.168.140.254 rem=192.168.141.0-192.168.144.254
If you configured SSH (recommended), create a rule to allow SSH traffic to pass through the
firewall.
add firewall policy=hq ru=6 ac=allo int=eth0 prot=tcp po=22
ip=200.200.200.1 gblip=200.200.200.1 gblp=22
If you instead stayed with telnet (not recommended) and configured RSOs, create a rule to
allow telnet traffic to pass through the firewall.
add firewall policy=hq ru=7 ac=allo int=eth0 prot=tcp po=23
ip=200.200.200.1 gblip=200.200.200.1 gblp=23
It is important to save your configuration when you finish, to preserve the configuration over
any power cuts.
create conf=<your-file.cfg>
This is particularly important in security configurations because it preserves the security
officer definition. Without this, regaining configuration access would destroy encryption
information such as keys.
Once you have saved the configuration to a file, specify that file as the configuration script to
use when the router boots up.
set config=<your-file.cfg>
Note: If you forget your secoff user password, log in as manager. The manager user cannot
edit a router in system security mode, so enter the command disable system security. This
destroys your encryption keys. Edit your configuration file to redefine your secoff user
password, then reboot, then log in as secoff, then enable system security again, then recreate
the keys.
10. Save your configuration

Page 16 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
branch office
1
How to configure the AR440S router at branch office 1
Before you begin to configure your router, ensure that it is running the appropriate software
release, patch and GUI files and has no configuration.
set inst=pref rel=<rel-file> pat=<patch-file> gui=<gui-file>
set conf=none
disable system security
restart reboot
Note: A software QoS extension to this configuration, to prioritise VoIP traffic over the
VPNs, is available in "How to prioritise outgoing VoIP traffic from the branch office
1
router" on page 33.
Name the router
set system name=Branch1
Define a security officer.
add user=secoff pass=<your-secoff-password> priv=securityofficer
lo=yes telnet=yes
Do not forget your “secoff” password.
Enable security mode so that VPN keys are stored securely, and other security features are
enabled.
enable system security
Once security mode is enabled, you need to log in as a security officer to enter most
configuration-altering commands.
login secoff
password: <your-secoff-password>
It is important to keep this security officer username and password secure, and to consider
proper handover of it in the event of IT staff changes.
Also, we recommend you leave a “manager” privilege user defined because this may provide
backup access if the security officer password is lost. Do not leave the manager password at
the factory default—change it to a password in keeping with your company's security policy.
set user=manager password=<your-company-policy-password>
When security mode is enabled, router configuration access times out after inactivity to
prevent unauthorised access. The default timeout is 60 seconds, but you may temporarily
raise it to 600 seconds if desired.
set user securedelay=600
1. Configure general system and user settings

Page 17 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
branch office
1
Create your Asymmetric Digital Subscriber Line (ADSL) connection. Asynchronous Transfer
Mode (ATM) is always used over ADSL.
enable adsl=0
create atm=0 over=adsl0
add atm=0 channel=1
Create your PPPoA link, and define the username and password needed for Internet access.
This is provided by your Internet Service Provider (ISP).
create ppp=0 over=atm0.1 echo=10 lqr=off bap=off idle=off
set ppp=0 username="branch office 1" password=branch1 iprequest=off
Note that this interface needs a permanent IP address because this branch office allows
incoming roaming VPN client connections. The clients can only target a known, unchanging
address.
Enable IP
enable ip
Define the vlan 1 interface address. This VLAN connects the router to the branch office LAN.
add ip int=vlan1 ip=192.168.141.254
Define the fixed IP address of the ADSL PPP interface.
add ip int=ppp0 ip=222.222.222.1
Add a default route out the ADSL PPP interface. When using PPP, it is valid to define a null
value next hop.
add ip rou=0.0.0.0 mask=0.0.0.0 int=ppp0 next=0.0.0.0
If desired, set up the router as a DHCP server for the branch office 1 LAN.
create dhcp policy=branch1 lease=7200
add dhcp policy=branch1 rou=192.168.141.254
add dhcp policy=branch1 subn=255.255.255.0
create dhcp range=branch1_hosts poli=branch1 ip=192.168.141.16 num=32
ena dhcp
2. Configure ADSL for internet access
3. Configure PPP for PPPoA
4. Configure IP

Page 18 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
branch office
1
If you need remote management access, we strongly recommend that you use Secure Shell
(SSH). You should not telnet to a secure gateway.
To configure SSH, define appropriate RSA encryption keys, then enable the SSH server.
create enco key=2 type=rsa length=1024 description="host key"
format=ssh
create enco key=3 type=rsa length=768 description="server key"
format=ssh
enable ssh server serverkey=3 hostkey=2
Enable the user who connects via SSH to log in as secoff, by adding the secoff user as an SSH
user. Also, you may choose to restrict access so that it is only permitted from particular
addresses.
add ssh user=secoff password=<secoff-password>
ipaddress=<trusted-remote-ip-address>
mask=<subnet-mask-of-trusted-hosts>
disable telnet server
Secure Shell is a more secure, encrypted method of remote management access than telnet.
If you need to use telnet, even though it is insecure, you should restrict access by defining
remote security officers (RSOs). RSO definitions specify trusted remote addresses for
security officer users.
add user rso ip=<ipadd>[-<ipadd>]
enable user rso
enable telnet server
If desired, set the router to send log messages to a syslog server.
create log output=2 destination=syslog server=<syslog-server-address>
syslogformat=extended
add log out=2 filter=1 sev=>3
If desired, you can configure SNMP to inform you or your service provider of network
events, such as the LAN interface of the router going down. We recommend SNMPv3 for
security reasons. For details, see How To Configure SNMPv3 On Allied Telesis Routers and
Managed Layer 3 Switches. This How To Note is available from www.alliedtelesis.com/
resources/literature/howto.aspx.
5. Configure remote management access, if desired
6. Capture status information remotely, if desired

Page 19 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
branch office
1
You need to configure dynamic PPP over L2TP to accept incoming Windows VPN client
connections.
Create an IP pool to allocate unique internal payload addresses to incoming VPN clients.
create ip pool=roaming ip=192.168.144.1-192.168.144.50
Define a PPP template. This defines authentication and uses the IP pool of addresses.
create ppp template=1
set ppp template=1 bap=off ippool=roaming authentication=chap echo=10
lqr=off
Configure L2TP. When the router successfully negotiates an L2TP tunnel connection from
any remote peer, it then creates a PPP interface over that tunnel, using the PPP parameters
defined by the PPP template.
enable l2tp
enable l2tp server=both
add l2tp ip=1.1.1.1-255.255.255.254 ppptemplate=1
Add your approved roaming VPN client usernames.
add user=roaming2 pass=roaming2 lo=no telnet=no
If desired, you can instead use a RADIUS authentication server.
add radius server=<radius-server-address> secret=<secret-key>
Check that you have a 3DES feature licence for the ISAKMP policies.
show feature
You can purchase feature licences from your Allied Telesis distributor.
If necessary, install the licence, using the password provided by your distributor.
enable feature=3des pass=<licence-number>
Enable IPsec
enable ipsec
In this example, IPsec SA specifications propose:
zISAKMP as the key management protocol
zESP as the IPsec protocol
7. Configure dynamic PPP over L2TP connections
8. Check feature licences
9. Configure the VPNs for connecting to headquarters and roaming clients

Page 20 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
branch office
1
z(for site-to-site VPNs) 3DESOUTER as the encryption algorithm for ESP
z(for site-to-site VPNs) SHA as the hashing algorithm for ESP authentication
z(for roaming client VPNs) four possible variants of VPN encryption, for added flexibility.
We propose the most secure option first.
Create an SA specification for the headquarters office site-to-site VPN. This SA specification
uses tunnel mode by default.
create ipsec sas=1 key=isakmp prot=esp enc=3desouter hasha=sha
Create a group of SA specifications for the roaming VPN clients. These SA specifications use
IPsec transport mode for Windows VPN interoperability. Multiple specifications allow IPsec
to negotiate different levels of encryption to match what your version of the VPN client
provides.
create ipsec sas=2 key=isakmp prot=esp enc=3desouter hasha=sha
mod=transport
create ipsec sas=3 key=isakmp prot=esp enc=3desouter hasha=md5
mod=transport
create ipsec sas=4 key=isakmp prot=esp enc=des hasha=sha mod=transport
create ipsec sas=5 key=isakmp prot=esp enc=des hasha=md5 mod=transport
Create two IPsec bundles, one for the headquarters router VPN and one for the roaming
VPN clients.
create ipsec bund=1 key=isakmp string="1"
create ipsec bund=2 key=isakmp string="2 or 3 or 4 or 5"
Create IPsec policies to bypass IPsec for ISAKMP messages and the “port floated” key
exchange that NAT-T uses.
create ipsec pol=isakmp int=ppp0 ac=permit lp=500 rp=500
create ipsec pol=isakmp_float int=ppp0 ac=permit lp=4500
Create an IPsec policy for the VPN traffic between headquarters and branch office 1 . Identify
the traffic by its local and remote addresses—in this example the subnet used on the LAN at
branch office
1 (local) is 1 92. 1 68. 1 4 1 .0/24. Note that the remote address selector is wider
than the headquarter’s LAN; in fact, we cover all site subnets with this supernet.
create ipsec pol=hq int=ppp0 ac=ipsec key=isakmp bund=1
peer=200.200.200.1 isa=hq lad=192.168.141.0 lma=255.255.255.0
rad=192.168.0.0 rma=255.255.0.0
Create another IPsec policy for roaming VPN clients to access headquarters. Identify the
traffic by the L2TP port (UDP traffic to port
1 70 1 ). This policy uses peeraddress=any. The
any option allows simultaneous VPN clients to be set up under the policy.
create ipsec pol=roaming int=ppp0 ac=ipsec key=isakmp bund=2 peer=any
isa=roaming lp=1701 tra=udp
Create another IPsec policy for direct Internet traffic from the headquarters LAN to the
Internet, such as web browsing.
create ipsec pol=internet int=ppp0 ac=permit
Note: The order of the IPsec policies is important. The Internet permit policy must be last.