Jump to content

This is the support site for Andrews & Arnold Ltd, a UK Internet provider. Information on these pages is generally for our customers but may be useful to others, enjoy!

IPsec Firewall: Difference between revisions

IPsec Firewall (view source)

Revision as of 20:02, 30 July 2015

40 bytes removed ,  30 July 2015
m
no edit summary
mNo edit summary
mNo edit summary
*IP protocol ESP (50) for the data channel.
 
Example:
<syntaxhighlight>
<rule-set name="IPsec" source-interface="pppoe" target-interface="self" no-match-action="continue" comment="Non-NATed IPsec connections from PPP to the Brick">
The config force-NAT option [Note the capitalisation ] can be used to force IKE to treat the connection as if it was NATed. This is in the top-level ipsec-ike config item and you need "Show all" on the UI.
 
Example:
Here is an example rule set for allowing IPsec in to a FireBrick:
 
<syntaxhighlight>
<rule-set name="IPsec" source-interface="pppoe" target-interface="self" no-match-action="continue" comment="Allow NATed IPsec connections from PPP to the Brick">
</syntaxhighlight>
 
You can join the two rules to create a set that will work for NAT and NONNon-NAT:
 
Example:
<syntaxhighlight>
<rule-set name="IPsec" source-interface="pppoe" target-interface="self" no-match-action="continue" comment="Allow NATed and Non-NATed IPsec connections from PPP to the Brick">
AA-Andrew
autoreview, Bureaucrats, editor, Interface administrators, reviewer, Administrators
12,341

edits

Retrieved from ‘http://support.aa.net.uk/Special:MobileDiff/10271’