HP TMS zl Module Security Administrator's Guide

4-386

Configuring a VPN on the HP TMS zl Module

GRE Tunnels

Next, you configure the VPN traffic selector, which determines which traffic

will use the VPN tunnel. For a GRE over IPsec VPN, the traffic selector must

specify the GRE traffic between the TMS zl Module and the remote tunnel

endpoint.

Caution For this policy, you will specify a local TMS zl Module IP address. Be very

careful to specify GRE for the protocol. Otherwise, you might select manage-

ment traffic for the VPN and lock yourself out of he Web browser interface.

If you do cause NIM to lose contact with a TMS zl Module, follow this

procedure:

1. Access the module and delete the IPsec policy:

• If the module has multiple IP addresses in its management-access

zone, you might be able to contact the module’s Web browser inter-

face at one of the other addresses. You can then delete the faulty IPsec

policy from the VPN > IPsec > IPsec Policies window (the policy will

be labeled with the name that you specified in the wizard).

• If you cannot reach the module’s Web browser interface, you can use

the CLI to delete the faulty IPsec policy. Access the host switch CLI

and enter these commands:

hostswitch(config)# services <slot ID> name tms-module

hostswitch(tms-module-<slot ID>)# config

hostswitch(tms-module-<slot ID>:config) no ipsec policy

Replace <slot ID> with the ID of the slot in which the TMS zl

Module is installed. Replace <policy name> with the name that you

specified in the wizard. (You can also use the show ipsec policy

command to view the name.)

2. NIM should now be able to contact the TMS zl Module. It is best practice

to synchronize the TMS properties before you continue configuring.

Note If your traffic selector will include traffic that is also selected for NAT, you

must create a NAT exclusion policy. See Chapter 6: “Configuring the TMS zl

Module Firewall.”

Refer to Figure 4-288 for help configuring the traffic selector.