1. Przykładowa konfiguracja VPMa pomiędzy BR-804V a Er-903V

BR-804V Er-903V
_________ _________
| | | |
| | 172.16.1.5/23 | |
| |---------------------| |
| | 172.16.1.1/23 | |
|_________| |_________|
| |
| 10.2.0.1/24 | 192.168.12.43/23
| |
| 10.2.0.2/24 | 192.168.12.44/23
__|__ __|__
| | VPN | |
| PC1 | <====================> | PC2 |
|_____| |_____|

1. Konfiguracja Er-903V
a) konfiguracja ogólna
- eth1: ip address 192.168.12.43/23
- eth2: ip address 172.16.1.1/24
- napt dynamic add
konfigurujemy NAT (musimy wyłączyć z NAT zdalną podsieć VPN)
napt dynamic add

Do you want default dynamic NAPT rule's addition? [Y/n][N] y
Just press ENTER to keep the default.
Do you want NAPT Rule's addition? [Y/n][Y] y
Do you want ADDRESS connection Rule's addition? [Y/n][N] y
Input SOURCE IP or network (eg, 10.0.0.1) :
Input DESTINATION IP or network (eg, 10.0.0.2) : 10.2.0.0/24 adres zdalnej sieci
Do you want INVERSE of value about input? [Y/n][N] y
Do you want PROTOCOL connection Rule's addition? [Y/n][N]
Do you want DEVICE connection Rule's addition? [Y/n][N] y
Input OUT-device to do napt (eg, eth1, ppp0) : eth2
Do you want INVERSE of value about input? [Y/n][N]
- route 0.0.0.0/243 192.168.12.2

/* opcja - - - nie potrzebne w standardowej konfiguracji
- shell: iptables -A INPUT -p udp --sport 500 --dport 500 -j ACCEPT
- shell: iptables -A OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT
*/

b) konfigurujemy połączenie VPN
- vpn setup conf
config setup
interfaces="ipsec0=eth2"
klipsdebug=none
plutodebug=none
plutoload=%search
plutostart=%search
uniqueids=yes

conn %default
keyingtries=0
disablearrivalcheck=no
keyexchange=ike
ikelifetime=28800
keylife=3600
pfs=yes
compress=no
authby=secret
auto=add

conn sample
type=tunnel
left=172.16.1.1
leftsubnet=192.168.12.0/23
right=172.16.1.5
rightsubnet=10.2.0.0/24
auto=start
- vpn setup secret
172.16.1.1 172.16.1.5 : PSK "secure"
- vpn enable

2. Konfiguracja Br-804V
a) konfiguracja ogólna
- WAN :
adres IP - 172.16.1.5
maska - 255.255.255.0
brama - 172.16.1.1
- LAN :
adres IP - 10.2.0.1
maska - 255.255.255.0

b) konfiguracja VPN
Connection Name - sample
UID (Unique Identifier String) - Disable

Enabled Keep Alive - zaznaczone
Enabled NetBIOS Broadcast - dowolnie

Remote IP Network - 192.168.12.0
Remote IP Netmask - 255.255.254.0
Remote Gateway IP - 172.16.1.1
Network Interface - AUTOWAN

Secure Association - IKE
Perfect Forward Secure - Enabled
Encryption Protocol - 3DES
PreShared Key - secure
Key Life 3600 Seconds
IKE Life Time 28800 Seconds