Enterasys ANG-1100 Series Instruction Manual

Rel. 3.5 Release Notes Page 1 of 30
Release Notes
Release 3.5 Enhanced Support for VPN Clients
Overview
This document describes Aurorean System Software Release 3.5 support for
Microsoft Windows XP VPN clients and enhanced ANG-1100 connectivity.
Features of the release include:
!Remote access inter-operability between Windows XP/2000 clients and
Aurorean Network Gateways, with support for:
–Layer 2 Tunnel Protocol (L2TP)/IPSec with IKE
–PPP Extensible Authentication Protocol (EAP)
–RADIUS extensions for EAP
–Certificate support within IKE/IPSec
–Certificate enrollment with Microsoft Windows 2000 Certificate
Authorities on the Aurorean Policy Server-3000/7000
!Network Extension Mode (NEM) for routing of the trusted subnet
connected to an ANG-1100 making those attached devices available to the
corporate network
!Peer to Peer Mode for tunneling between ANG-1100s to connect nodes on
both attached subnets
!Site to Site inter-operability with Cisco, Nortel and Nokia/Checkpoint
gateways
!RiverMaster tunnel configuration of L2TP and EAP protocols
!Resolved issues since the last release
!Known issues with this release
Aurorean Release 3.5 enhancements broaden the VPN options for clients, whether
they are operating on Windows XP/2000 platforms or connecting to an
ANG-1100/3000/7000. Network administrators and users are required to
perform some level of configuration to enable these enhancements, either on the
Command Line Interface to the ANG-3000/7000, the RiverMaster management
application, or the ANG-1100’s Web Config on-line tool, depending on which
options are implemented.
Also, administrators are required to upgrade their APS, ANG-3000/7000 and
RiverMaster software, install Microsoft Internet Explorer 5.5, configure the
Microsoft RADIUS server plugin on the APS, and set up L2TP and EAP protocols.
Instructions for network administrators and users to configure these
enhancements (or where directions can be found in associated documents), as
well as caveats to consider during configuration, are detailed in subsequent
sections of this document.

Page 2 of 30 Rel. 3.5 Release Notes
Overview Release Notes
Release 3.5 Enhanced Support for VPN Clients
NOTE
All Aurorean documentation can be found at the following URL:
http://www.enterasys.com/support/manuals
Figure 1 displays a varied topology of ANG-1100 connection options.
Figure 1 Enhanced VPN Client Topology
The illustration above displays sample enhanced VPN client configurations as
follows:
!Example 1: An Microsoft Windows XP client is connected to an ANG-3000
using L2TP/IPSec and EAP.
!Example 2: An ANG-1100 and ANG-3000 and their associated networks are
connected by a Client mode tunnel.
!Example 3: An ANG-1100 and ANG-3000 and their respective networks are
connected via Network Extension Mode.
!Example 4: Two ANG-1100s and their networks are connected through a Peer
to Peer tunnel.
mode
NEM tunnel RiverMaster
Peer to Peer
ANG-3000
ANG-1100
Nortel,
Cisco, or
1 - Microsoft inter-operability
2 - Client mode
3 - Network Extension Mode
4 - Peer to Peer mode
5 - Third party gateway
inter-operability
APS-3000
MS-RADIUS
Microsoft
1
2
3
4
5ANG-1100
ANG-1100
ANG-1100
Nokia/
Checkpoint
router
Router
tunnel
mode tunnel
WIN XP
L2TP/IPSec
EAP
Certificate
Authority
Client

Release Notes Configuring VPN Inter-operability
Release 3.5 Enhanced Support for VPN Clients
Rel. 3.5 Release Notes Page 3 of 30
!Example 5: An ANG-1100 is connected to a Nortel, Cisco or
Nokia/Checkpoint router by a Peer to Peer tunnel.
Configuring VPN Inter-operability
Aurorean Release 3.5 provides seamless VPN inter-operability with Microsoft
Windows XP and Windows 2000 desktops featuring support for the L2TP/IPSec
tunneling protocol, EAP and Microsoft’s Certificate Authority (PKI). This
infrastructure permits a single user log on from a remote Win XP/2000 workstation
through a VPN tunnel to the Aurorean Network Gateway with authentication by a
RADIUS server (Microsoft’s IAS) to the Active Directory. The Aurorean Release 3.5
VPN works just as effectively with 2-factor authentication (SecurID), digital
certificates and smart cards.
To configure Windows XP/2000 clients for VPN, consult Microsoft documentation at
the following URL: www.microsoft.com/vpn.
Configuring an ANG server to connect with a Windows XP client consists of
performing certificate enrollment and adding a Microsoft RADIUS plugin on the
APS-3000/7000. Instructions are described later in this document.
Certificate Enrollment on the APS Using Windows 2000 CA
To perform certificate enrollment on your APS, refer to “Upgrading to Aurorean
Release 3.5”on page 4.
NOTE
To enroll in the Certificate Authority on the APS - if you have an Auorrean system
software release lower than 3.5 - you must first upgrade Windows Internet
Explorer to Release 5.5. Refer to “Installing Internet Explorer Version 5.5 on APS-
3000/7000”on page 5 for instructions.
Configuring the RADIUS Plugin
To configure the Microsoft RADIUS plugin on the APS, refer to “Configuring the
RADIUS Plugin”on page 3.
Caveats
The following combinations of protocol options that might be required by a non-
Windows VPN client are not supported in Release 3.5:
!L2TP is not supported without IPSec encryption. The ANG security policy
drops all L2TP packets not encrypted by IPSec.
!Since L2TP must be encrypted with IPSec, MPPE (encryption protocol used
by PPTP), is not supported within L2TP.
!The PPP PAP authentication protocol is not supported. User authentication
must be MS-Chap or EAP.

Page 4 of 30 Rel. 3.5 Release Notes
Upgrading to Aurorean Release 3.5 Release Notes
Release 3.5 Enhanced Support for VPN Clients
!If EAP and MS-Chap are both enabled then the ANG unconditionally will
prefer EAP over MS-Chap. It will request EAP authentication and then allow
the client to alternately select MS-Chap if it so chooses.
Upgrading to Aurorean Release 3.5
Upgrading your Aurorean software involves installing new certificates and
upgrading to IE version 5.5 to ensure smooth and secure communications with a
Microsoft XP VPN client. Invoking the ipsecDefault command on the ANG-
3000/7000’s Command Line Interface will prepare that device for the proper
IKE/IPSec (PKI), L2TP configuration. Lastly, setting up L2TP, EAP, and RADIUS
authentication is easy via the RiverMaster management application.
As with any major upgrade, Release 3.5 requires that you first install new software on
the APS-3000/7000, a new LINUX kernel and new software on the ANG-3000/7000,
and new software on your RiverMaster computer. Step-by-step upgrade instructions
are provided in the Installation & Service Guide which is included in a PDF-formatted
document on the Aurorean 3.5 CD ROM in the Aurorean 3.5 System
Software/Manuals directory or on the Web at the following URL:
http://www.enterasys.com/support/manuals
NOTE
Upgrade requirements for IE v5.5, LINUX kernel, ANG, APS and RiverMaster
software apply only if you have Aurorean system software lower than Rel. 3.5. If
you have new Aurorean Rel. 3.5 equipment, these upgrades are unnecessary.
To implement the application enhancements of Aurorean Release 3.5 you must
perform the following steps in order:
!Install new APS, LINUX kernel and ANG software: see the Installation &
Service Guide
!Install new RiverMaster software: see the RiverMaster Administrator’s Guide
!Install and update to Internet Explorer version 5.5 on the APS-3000/7000
!Delete all existing trusted root certificates on the Internet Explorer browser of
the APS-3000/7000
!Issue the ipsecDefault command on the ANG-3000/7000
!Enroll a digital certificate on the APS-3000/7000
!Configure L2TP and EAP protocols with RiverMaster: see the RiverMaster
Administrator’s Guide
!Configure the Microsoft RADIUS Plugin on your APS-3000/7000
The filepaths for software module upgrades are located on the CD ROM as follows:
!3rd Party Support Software/Linux/Kernel/
Linux-2.2.16-2.i386.rpm

Release Notes Upgrading to Aurorean Release 3.5
Release 3.5 Enhanced Support for VPN Clients
Rel. 3.5 Release Notes Page 5 of 30
!Aurorean_3.5.00-<build #>/Aurorean 3.5 System
Software/Network Gateway/rts-3.5.00-<build #>.i386.rpm
!Aurorean_3.5.00-<build #>/Aurorean 3.5 System
Software/Policy Server/setup.exe
!Aurorean_3.5.00-<build #>/Aurorean 3.5 System
Software/RiverMaster/setup.exe
Installing Internet Explorer Version 5.5 on APS-3000/7000
You can install Internet Explorer version 5.5 on your APS-3000/7000 from an
executable file stored on the Aurorean Release 3.5 CD ROM. To upgrade IE, perform
the following steps:
1. Insert the Aurorean Release 3.5 CD ROM in your APS CD ROM drive.
2. Go to the 3rd Party Support Software/Browsers/Ie55/I386
directory and double click on the Ie5setup.exe file.
3. Follow the IE prompts to install the program.
Deleting Trusted Root/Intermediate Certificates
To delete existing certificate authorities from your Internet Explorer, perform the
following steps:
1. Open a session of Internet Explorer on your ANG-3000/7000.
2. Click on the Tools main menu option.
3. In the pull-down screen, select Internet Options.
The Internet Options window appears as shown in Figure 2.

Page 6 of 30 Rel. 3.5 Release Notes
Upgrading to Aurorean Release 3.5 Release Notes
Release 3.5 Enhanced Support for VPN Clients
Figure 2 Windows IE Internet Options Window
4. Click on the Content tab.

Release Notes Upgrading to Aurorean Release 3.5
Release 3.5 Enhanced Support for VPN Clients
Rel. 3.5 Release Notes Page 7 of 30
5. Click on the Certificates button.
The Certificate Manager window appears as shown in Figure 3.
Figure 3 Windows IE Certificate Manager Window
6. Click on the Intermediate Certification Authorities tab.
7. Select all authorities displayed and remove them.
8. Repeat the step in the Trusted Root Certification Authorities tab.
Enrolling Certificates from Corporate Certification Authority on
the APS
To enroll in certification authorities on your APS, perform the following steps:
1. Start the VNC application by pointing your Web browser at the
APS-3000/7000. In the Location field, type: http://<APS IP address>:5800

Page 8 of 30 Rel. 3.5 Release Notes
Upgrading to Aurorean Release 3.5 Release Notes
Release 3.5 Enhanced Support for VPN Clients
and press ENTER.
The VNC Authentication window appears as shown in Figure 4. The IP
address you typed includes the port number (5800) with which to access the
APS.
Figure 4 Starting VNC Remote Control
2. Type welcome in the Password field and click OK.
The APS desktop appears.
3. On the APS, open another Web browser and point it at your Microsoft
Certification Authority. Type http://<your Microsoft Certification
Authority>/certsrv and press ENTER.
The Network Password window appears within the APS browser window as
shown in Figure 5.

Release Notes Upgrading to Aurorean Release 3.5
Release 3.5 Enhanced Support for VPN Clients
Rel. 3.5 Release Notes Page 9 of 30
Figure 5 Network Password Window
4. Enter your network User Name and Password. The Domain name should
already be entered. Press OK.
The Microsoft Certificate Services Welcome window appears as shown in
Figure 6.

Page 10 of 30 Rel. 3.5 Release Notes
Upgrading to Aurorean Release 3.5 Release Notes
Release 3.5 Enhanced Support for VPN Clients
Figure 6 Microsoft Certificate Services Welcome Window
5. Choose Request a Certificate and click Next.
The Advanced Certificate Requests window appears as shown in Figure 7.
Figure 7 Advanced Certificate Requests Window

Release Notes Upgrading to Aurorean Release 3.5
Release 3.5 Enhanced Support for VPN Clients
Rel. 3.5 Release Notes Page 11 of 30
6. Select Submit a certificate request to this CA using a form and press Next.
The Advanced Certificate Request window appears as shown in Figure 8.
Figure 8 Advanced Certificate Request Window

Page 12 of 30 Rel. 3.5 Release Notes
Upgrading to Aurorean Release 3.5 Release Notes
Release 3.5 Enhanced Support for VPN Clients
7. Make the following selections:
–From the Certificate Template pull-down menu, choose User.
–From the Key Options CSP pull-down menu, choose Microsoft Base
Cryptographic Provider v1.0.
–For Key Usage, select Both.
–For Key Size, enter 1024
–Select Create new key set
–Select Use local machine store
–From the Additional Options pull-down menu, select SHA1 as the Hash
Algorithm.
–Click Submit.
The Certificate Issued window appears as shown in Figure 9.
Figure 9 Certificate Issued Window
8. Click Install this certificate.
A window appears indicating the certificate was successfully issued.
9. Reboot the APS.
Invoke the Default Configuration on your ANG-3000/7000
A default IPSec configuration - the initial IPSec policy - is provided on the
ANG-3000/7000 that permits PPTP, IRPP, Firewall Traversal, and IKE/IPSec traffic
but drops all other packets. Be aware that issuing the ipsecDefault command
restores the IPSec configuration to the factory default setting.
CAUTION
This script first erases all IPSec configuration settings and then reloads it with the
factory default. Any configurations you added earlier are lost. As a precaution
against inadvertent use of the command, the script interactively prompts you to
confirm that you intend to erase and then restore the IPSec configuration.

Release Notes Upgrading to Aurorean Release 3.5
Release 3.5 Enhanced Support for VPN Clients
Rel. 3.5 Release Notes Page 13 of 30
To issue the ipsecDefault command, perform the following:
1. Log into the ANG-3000/7000 with the login and password netadmin (default)
and press ENTER.
2. At the command prompt, change directory to usr/indus/ipsec.
3. Type ipsecDefault and press ENTER.
4. Reboot the ANG-3000/7000.
Configuring L2TP and EAP
To configure L2TP and EAP protocols using the RiverMaster management program,
refer to the RiverMaster Administrator’s Guide.
Configuring the Microsoft RADIUS Plugin
To configure Microsoft RADIUS authentication, set the parameters as you would set
any authentication plugin parameter in RiverMaster (refer to Figure 10) including the
ServerAddress,Shared Secret, Authentication andAccounting Portnumber,Timeout,
Retry, IR Group Attribute, and Hash values.
NOTE
The IR Group Attrib field requires the Microsoft IAS RADIUS number.
CAUTION
You must checkmark the Default Plugin box.
For more detailed information, refer to the RiverMaster Administrator’s Guide.

Page 14 of 30 Rel. 3.5 Release Notes
Using Network Extension Mode for ANG-1100 Tunnels Release Notes
Release 3.5 Enhanced Support for VPN Clients
Figure 10 Configuring the Microsoft RADIUS Plugin on RiverMaster
Using Network Extension Mode for ANG-1100 Tunnels
Network Extension Mode (NEM) is designed to open up network resources situated
behind ANG-1100s. Using the Command Line Interface (CLI) on the ANG-3000/7000,
you configure NEM to provide routing for nodes connected to the trusted port of an
ANG-1100 so that locally and remotely connected devices can discover and
communicate with each other across an IKE/IPSec tunnel (refer to Figure 1).
Capabilities
Tunnels on the ANG-1100 can be configured in Client mode, NEM, or Peer to Peer
mode (described in a later section) by setting radio buttons on Web Config. Client
mode provides the functionality of Aurorean Releases 3.1/3.2 on the ANG-1100 while
NEM modifies the behavior of a tunnel in these ways:
!NAT is disabled for that tunnel. All traffic from the ANG-1100 trusted
network is passed, as is, across the tunnel, with the benefit of improved
tunnel performance.
!A new IPSec Security Policy Database rule is automatically inserted into the
SPD to secure traffic from the subnet (by default 192.168.1.0/24) attached to
the ANG-1100 trusted network into the intranet. (The original rule that
secures traffic sent to the address assigned to the ANG-1100 is retained to

Release Notes Using Network Extension Mode for ANG-1100 Tunnels
Release 3.5 Enhanced Support for VPN Clients
Rel. 3.5 Release Notes Page 15 of 30
provide a path to remotely manage the ANG-1100 over the tunnel). The new
rule automatically secures data to whatever subnet is configured on the
ANG-1100's trusted interface.
!RIP packets sent from the ANG-1100 into the tunnel broadcast reachability to
the ANG-1100's trusted subnet. Routing protocols on the ANG-3000/7000, if
enabled, then relay those routes into the intranet routing fabric.
The combination of the above configuration changes enables NEM on the ANG-1100.
The implementation also provides the following features:
!Parallel tunnels with NEM may be built from the ANG-1100 to multiple
ANG-3000/7000s to provide failover if routing tables exported from central
ANG-3000/7000s are identical (refer to Figure 11). In other words, central
ANGs must have their trusted interfaces connected to the same network. Be
aware that, on average, about 60 seconds pass for tunnel keep-alives and the
routing protocols to detect and reconfigure around a tunnel failure. Refer to
the Application Note: Auto-Link Recovery for configuration information.
Figure 11 Failover on Network Extension Mode Tunnels
!Client mode and NEM tunnels can coexist simultaneously (refer to Figure 12).
For example, one tunnel from the ANG-1100 can use NEM to access an
intranet at one site and to provide access to the local trusted network from
that site. Other tunnels can use Client mode to simultaneously provide access
from the ANG-1100 trusted network to the intranet at other sites. Those other
sites cannot access the trusted network behind the ANG-1100 because NAT is
applied to tunnels configured in Client mode.
Figure 12 Coexisting Client Mode and Network Extension Mode Tunnels
ANG-1100
ANG-7000
ANG-7000
Router
Network Extension Mode tunnel
Primary
Secondary
ANG-1100
ANG-7000
ANG-7000
Router
INTERNET
Client Mode tunnel
Network Extension Mode tunnel

Page 16 of 30 Rel. 3.5 Release Notes
Using Network Extension Mode for ANG-1100 Tunnels Release Notes
Release 3.5 Enhanced Support for VPN Clients
Caveats
If you configure NEM, be aware that:
!The subnet attached to the remote ANG-1100’s trusted interface is the only
subnet routed across the tunnel to the central ANG-3000/7000. Other subnets
connected via routers to the ANG-1100’s trusted interface are not routed.
NOTE
IP address space management is not automatic: the network administrator must
assure that each ANG-1100 using NEM has a unique subnet on its trusted
interface by setting the DHCP server enabled parameter and an IP address pool in
the LAN Setup window of the ANG-1100’s Web Config utility to distribute
unique IP addresses. Refer to the ANG-1100 User’s Guide for more information.
!An ANG-1100 may use NEM to tunnel to one site only. That site can have
multiple ANG-3000/7000s for failover but the ANG-1100 cannot export its
trusted network to two or more separate sites.
Configuring Network Extension Mode
All ANG-1100 internal tunnel configuration is automatic based on the choice of
Connection Mode choices - Client, Network Extension or Peer to Peer (described in
the next section).
Additionally, a user must configure the IP subnet of the trusted network with a subnet
provided by the network administrator who manages the IP address space of remote
ANG-1100 sites using NEM (refer to note above). Trusted subnets at those remote sites
are routed to a central intranet so they must have distinct IP addresses. By default, the
ANG-1100 uses 192.168.1.0/24 as the trusted network subnet but that address must be
changed (on the LAN Setup window of the ANG-1100’s Web Config utility) to a
unique subnet that is not in use elsewhere in the network.
NOTE
For detailed instructions on how to configure Network Extension Mode on an
ANG-1100, refer to the ANG-1100 User’s Guide.
The network administrator must also reconfigure the ANG-3000/7000 which includes
reserving a pool of unique IP addresses for ANG-1100 users and changing IPSec
policy. Perform the steps below to configure NEM on the central ANG-3000/7000:
1. Set up a pool of Class C virtual subnets on the central ANG to use as trusted
networks for ANG-1100 devices. In this example, all 192.168.0.0/16 networks
are reserved and distributed in blocks to the ANG-1100s. For example, assign
192.168.1.0/24 to Network A, 192.168.2.0/24 to Network B, etc., up to 255
remote sites (see Figure 13). Refer to "Configuring Subnet Parameters" in the
Installation & Service Guide for more detailed instructions.

Release Notes Using Network Extension Mode for ANG-1100 Tunnels
Release 3.5 Enhanced Support for VPN Clients
Rel. 3.5 Release Notes Page 17 of 30
Figure 13 Multiple Network Extension Mode Tunnels
CAUTION
Be sure no central ANG-3000/7000 virtual subnet pools overlap with this range of
network addresses.
2. Telnet to the central ANG-3000/7000 (with the login and password netadmin)
to begin IPSec policy changes.
3. Change directory to /usr/indus/ipsec and press ENTER to access the CLI.
4. Create a set of security parameters for use with the IPSec tunnel. Type
./ipsecEsp -a -n ezipsec -e 3des -i hmac-sha and press ENTER.
The encryption and integrity algorithms used above should match the same
tunnel security parameters set in RiverMaster.
5. Type ./ipsecEsp -L and press ENTER to display and verify the security
parameters were added.
6. Create an IPSec proposal. Type ./ipsecProposal -a -n ezipsec -p
enabled -g modp768 -e ezipsec and press ENTER.
You may select another Modp number if required.
7. Type ./ipsecProposal -L and press ENTER to display and verify the
proposal was added.
8. Type ./ipsecSelector -a -n ezipsec -o 0.0.0.0/0 -r
192.168.0.0/16 and press ENTER.
This command creates an IPSec selector covering the entire pool of networks
for use by all ANG-1100 devices.
9. Type ./ipsecSelector -L and press ENTER to display and verify the
selector was added.
ANG-1100
ANG-7000
ANG-7000
Router
Network Extension Mode tunnel
ANG-1100
ANG-1100
192.168.1.0
192.168.2.0
192.168.3.0
Network A
Network B
Network C

Page 18 of 30 Rel. 3.5 Release Notes
Using Network Extension Mode for ANG-1100 Tunnels Release Notes
Release 3.5 Enhanced Support for VPN Clients
10. Create an IPSec rule. Type ./ipsecRule -a -n ezipsec -s ezipsec
-w process -b spd -e tunnel -p ezipsec and press ENTER.
11. Type ./ipsecRule -L and press ENTER to display and verify the rule was
added.
12. Type ./ipsecSpd -n external -r 'gre;ike;ezipsec;pptpIn;
pptpOut;irppIn;irppOut;https;l2tpIntout’ and press ENTER.
This adds the previously created rule to the IPSec Security Policy Database on
the external interface of the central ANG-3000/7000.
NOTE
If you issue the ipsecDefault command later, these changes will disappear.
13. Type ./ipsecSpd -L and press ENTER to display and verify the changes
were made to the IPSec Security Policy Database.
14. Type SU - root and press ENTER.
15. Type the default password welcome.
16. Change directory to /usr/indus/irc and press ENTER.
17. Issue the ircreboot command to enable the security policy changes and
press ENTER.
Caveats
A central ANG-3000/7000 using Aurorean 3.5 firmware must manage a considerable
amount of “overhead”for all tunnel traffic to an ANG-1100 using NEM. The
performance impact of tunnels between these devices may be appreciable if a large
number of ANG-1100s enable NEM. You should conform to the following guidelines
to mitigate the impact of this linear search:
!Limit the number of ANG-1100s using NEM to a maximum of 64, or,
!Group remote sites into blocks of 64 (or less) which share a common SPD rule
on the ANG-3000/7000.

Release Notes Using Peer to Peer Tunnels
Release 3.5 Enhanced Support for VPN Clients
Rel. 3.5 Release Notes Page 19 of 30
Using Peer to Peer Tunnels
Aurorean Release 3.5 introduces Peer to Peer tunnel mode, which is designed to
connect ANG-1100s in remote branch offices, giving a device on one remote network
access to a device on another remote network as well as connect to a central
ANG-3000/7000 or third-party VPN gateway (refer to Figure 14).
Figure 14 Peer to Peer Mode Tunnels
Configuration requirements are as follows:
!Configuring Peer to Peer tunnels requires setting preshared keys (passwords),
public IP addresses, and knowing both devices are on reachable networks.
!Peer to Peer tunnels use IKE Main Mode with Group 2 (1024-bit modulus),
3DES encryption, and either the SHA or MD5 hash functions. The identity of
each peer is implicitly the peer's IP address.
!Routing information is defined for each Peer to Peer tunnel. The network
administrator may enter up to 3 IP subnets (subnet and mask) which are
reachable via the remote security gateway. (Only one subnet is supported per
tunnel if both peers are ANG-1100 gateways).
!Peer to Peer mode tunnels can coexist with Client mode tunnels (refer to
Figure 15). For example, a set of ANG-1100s can be configured with a mesh of
Peer to Peer tunnels and each of those ANG-1100s can also be connected to a
central ANG-3000/7000 via a Client mode tunnel. Note that if the same
remote subnet is reachable by a Client mode and Peer to Peer tunnel, the
Client tunnel takes precedence.
Figure 15 Coexisting Peer to Peer Mode and Client Mode Tunnels
ANG-1100
Router
ANG-7000
Router
Client Mode tunnel
ANG-1100 Third-party
ANG-1100
ANG-7000
ANG-1100 Client Mode tunnel
Peer to Peer Mode tunnel
ANG-1100
Router

Page 20 of 30 Rel. 3.5 Release Notes
Using Peer to Peer Tunnels Release Notes
Release 3.5 Enhanced Support for VPN Clients
!The Security Policy used by a Peer to Peer networking tunnel is identical to
that used by EZ-IPSec, the streamlined implementation of IPSec on the
ANG-1100. The encryption and integrity algorithms offered during Phase 2
security association construction, in order of preference, are:
–Triple DES / SHA-1
–Triple DES / MD5
–ARCFOUR-128 / SHA-1
–ARCFOUR-128 / MD5
–Triple DES / NONE
–DES / SHA-1
–DES / MD5
–DES / NONE
!Perfect Forward Secrecy is preferred (Modp768 - Group 1 is supported), but
not required, for all Phase 2 negotiations.
Configuring Peer to Peer Tunnels
To configure Peer to Peer mode between attached ANG-1100s, network
administrators need to configure each ANG-1100 with the following values:
!Up to three (reachable) IP addresses and Subnet Masks of the remote peers
that each ANG-1100 will connect to
!The public IP address (Gateway IP address) of the ANG-1100 at the opposite
end of the connection
!The pre-shared keys (Passwords) of the ANG-1100 at the opposite end of the
connection
For detailed instructions on how to configure Peer to Peer mode, refer to the
ANG-1100 User’s Guide.
Caveats
The following features are not supported:
!ANG-1100s connected to ANG-3000/7000s must use Client mode or NEM,
not Peer to Peer mode. At this time, ANG-1100s connect to ANG-3000/7000s
using EZ-IPSec with Client mode or NEM enabled.
!Failover from one Peer to Peer tunnel to another is not supported.
!Remote DNS and WINS name server IP addresses are not passed from one
VPN peer to another when using Peer to Peer tunnels. DNS and WINS must
be provided by the ISP, via another Client mode tunnel, by statically
configuring them on the PC, or setting up an external DHCP server.
!Dynamic routing information is not exchanged between peers connected by
Peer to Peer tunnels. All routing is defined statically in the tunnel
configuration.
!Routing information is not exchanged between Peer to Peer tunnels and
Client mode tunnels. Each ANG-1100 which requires central site access via an
ANG-3000/7000 must have its own Client mode tunnel. It may not access the
central site via another ANG-1100's Peer to Peer tunnel.