TMS zl Management and Configuration Guide ST.1.2.100916

7-130

Virtual Private Networks

Configure an IPsec Site-to-Site VPN with Manual Keying

A default IPsec policy prevents all traffic from being encrypted by the VPN

engine; therefore, all IPsec policies that you configure must have a higher

priority than this default policy.

Next, you configure the VPN traffic selector, which determines which traffic

is selected by the policy. For example, the selector might specify all IP traffic

between 192.168.2.0/24 (a local network) and 192.168.3.0/24 (a remote net-

work). For a policy with the Apply action, the selected traffic is the traffic that

is sent and received (and secured) on the IPsec SA.

Caution If your traffic selector will include management traffic, you must configure a

Bypass policy with top priority that selects the management traffic, or you will

be locked out of the Web browser interface. See “Configure Bypass and Deny

IPsec Policies” on page 7-354.

If you do lock yourself out, access the module and delete the IPsec policy:

■ If the module has multiple IP addresses in its management-access zone,

you might be able to contact the module’s Web browser interface at one

of the other addresses. You can then delete the faulty IPsec policy from

the VPN > IPsec > IPsec Policies window.

■ If you have locked yourself out entirely, you can use the CLI to delete the

faulty IPsec policy. Access the host switch CLI and enter these commands:

hostswitch(config)# services <slot ID> name tms-module

hostswitch(tms-module-<slot ID>)# config

hostswitch(tms-module-<slot ID>:config) no ipsec policy

Replace <slot ID> with the ID of the slot in which the TMS zl Module

is installed. Replace <policy name> with the IPsec policy name. (You

can use the show ipsec policy command to view the name.)

Note If your traffic selector will include traffic that is also selected for NAT, you

must create a NAT exclusion policy. See “Exclusion NAT Policies” in

Chapter 5: “Network Address Translation.”

Refer to Figure 7-110 for help in configuring the traffic selector.