HP TMS zl Module Security Administrator's Guide

ManualsBrandsHP ManualsComputer AccessoriesHP ProCurve Switch xl Access Controller Module

451

452

453

454

455

456

457

458

459

460

4-280

Configuring a VPN on the HP TMS zl Module

L2TP over IPsec VPNs

A default IPsec policy prevents all traffic from being encrypted by the VPN

engine; therefore, all IPsec policies that you configure must have a higher

priority than this default policy.

Next, you configure the VPN traffic selector, which determines which traffic

is selected by the policy. In this case, you configure the selector to select L2TP

traffic between the TMS zl Module and remote endpoints.

Caution For this policy, you will specify a local TMS zl Module IP address. Be very

careful to specify UDP for the protocol and 1701 for the local port. Otherwise,

you might select management traffic for the VPN, which would cause NIM to

lose its connection to the module and you lock yourself out of the modules’s

Web browser interface.

If you do cause NIM to lose contact with a TMS zl Module, follow this

procedure:

1. Access the module and delete the IPsec policy:

• If the module has multiple IP addresses in its management-access

zone, you might be able to contact the module’s Web browser inter-

face at one of the other addresses. You can then delete the faulty IPsec

policy from the VPN > IPsec > IPsec Policies window (the policy will

be labeled with the name that you specified in the wizard).

• If you cannot reach the module’s Web browser interface, you can use

the CLI to delete the faulty IPsec policy. Access the host switch CLI

and enter these commands:

hostswitch(config)# services <slot ID> name tms-module

hostswitch(tms-module-<slot ID>)# config

hostswitch(tms-module-<slot ID>:config) no ipsec policy

Replace <slot ID> with the ID of the slot in which the TMS zl

Module is installed. Replace <policy name> with the name that you

specified in the wizard. (You can also use the show ipsec policy

command to view the name.)

2. NIM should now be able to contact the TMS zl Module. It is best practice

to synchronize the TMS properties before you continue configuring.

Note If your traffic selector will include traffic that is also selected for NAT, you

must create a NAT exclusion policy. See Chapter 6: “Configuring the TMS zl

Module Firewall.”

Refer to Figure 4-196 for help configuring the next settings.