HP TMS zl Module Security Administrator's Guide

4-177
Configuring a VPN on the HP TMS zl Module
Configuring an IPsec Site-to-Site VPN with IKE
Caution The wizard combines the local network settings for both sites to produce a
traffic selector for the VPN. For example, the Hub module selects incoming
traffic between the Hub local network and the Spoke 1 local network for the
VPN, and vice versa. Typically, the selected traffic does not include manage-
ment traffic for the TMS zl Modules themselves. If, however, it does, you first
must configure Bypass policies with top priority that select the management
traffic. Otherwise, NIM will lose contact with the module, and you will be
locked out of the Web browser interface.
If you do cause NIM to lose contact with a TMS zl Module, follow this
procedure:
1. Access the module and delete the IPsec policy:
• If the module has multiple IP addresses in its management-access
zone, you might be able to contact the module’s Web browser inter-
face at one of the other addresses. You can then delete the faulty IPsec
policy from the VPN > IPsec > IPsec Policies window (the policy will
be labeled with the deployment name that you specified in the wiz-
ard).
• If you cannot reach the module’s Web browser interface, you can use
the CLI to delete the faulty IPsec policy. Access the host switch CLI
and enter these commands:
hostswitch(config)# services <slot ID> name tms-module
hostswitch(tms-module-<slot ID>)# config
hostswitch(tms-module-<slot ID>:config) no ipsec policy
<policy name>
Replace <slot ID> with the ID of the slot in which the TMS zl
Module is installed. Replace <policy name> with the deployment
name that you specified in the wizard. (You can also use the show
ipsec policy command to view the name.)
2. NIM should now be able to contact the TMS zl Module. It is best practice
to synchronize the TMS properties before you continue configuring.
3. You should also delete any objects that were applied to your modules
before the faulty IPsec policy was applied. Otherwise, if you try to use the
same deployment name when you run the wizard again, you will receive
an error.
Caution Typically, the local addresses are internal addresses on the site’s private
network while the local gateway address (which you configured in previous
window) is the TMS zl Module’s public or external address. If, however, for
whatever reason the set of local addresses specified here includes the local