TMS zl Management and Configuration Guide ST.1.2.100916

7-252

Virtual Private Networks

Configure a GRE over IPsec VPN with IKE

Caution For this policy, you will specify a local TMS zl Module IP address. Be very

careful to specify GRE for the protocol. Otherwise, you might be locked out

of the Web browser interface.

If you do lock yourself out, access the module and delete the IPsec policy:

■ If the module has multiple IP addresses in its management-access zone,

you might be able to contact the module’s Web browser interface at one

of the other addresses. You can then delete the faulty IPsec policy from

the VPN > IPsec > IPsec Policies window.

■ If you have locked yourself out entirely, you can use the CLI to delete the

faulty IPsec policy. Access the host switch CLI and enter these commands:

hostswitch(config)# services <slot ID> name tms-module

hostswitch(tms-module-<slot ID>)# config

hostswitch(tms-module-<slot ID>:config) no ipsec policy

Replace <slot ID> with the ID of the slot in which the TMS zl Module

is installed. Replace <policy name> with the IPsec policy name. (You

can use the show ipsec policy command to view the name.)

Note If your traffic selector will include traffic that is also selected for NAT, you

must create a NAT exclusion policy. See “Exclusion NAT Policies” in

Chapter 5: “Network Address Translation.”

Refer to Figure 7-221 for help configuring the traffic selector.

Figure 7-221. Example GRE over IPsec VPN