Digi Digi Connect WAN Guía del usuario
Digi Connect® WAN Application Guide
Primary Connections via NAT-T, IPsec ESP or GRE
Scenario
Digi Connect WAN is used for primary remote site connectivity. IPsec VPN or GRE
traffic is terminated by routers or VPN appliance at each end. The Digi Connect WAN
passes this traffic through.
Theory of Operation
The router’s Ethernet WAN port attaches to the Ethernet port of the Digi Connect WAN,
typically via an Ethernet crossover cable.
The wireless carrier provides only one IP address to the mobile interface. The Digi
Connect WAN uses Network Address Translation (NAT) where only the mobile IP
address is visible to the outside. All outgoing traffic uses the mobile IP address of the
Digi Connect WAN.
Since NAT changes IPsec headers, devices that support GRE, IPsec ESP or NAT-T
(IPsec-in-UDP) “tunneling” at each end of the connection are usually required.
For incoming data, the Digi Connect WAN forwards IP traffic destined for GRE or IPsec
ESP protocol, TCP/UDP port or port range from the cellular IP interface to a private IP
address on the Digi Connect WAN’s Ethernet port.
Sample Diagram:
Wireless
Network
Digi
Connect
WAN
Internet or
Frame Relay
GRE Tunnel / IPSec ESP / IPSec in UDP
Router/VPN Router/VPN
Remote Site
LAN
LAN
HQ
Router/VPN
WAN Port
192.168.0.2
Connect WAN
Ethernet Port
192.168.0.1 Connect WAN
Mobile IP
166.123.123.123
Router/VPN
LAN Port
10.10.10.1
GSM GPRS/EDGE APN Type needed: Typically a Custom APN is required since the
VPN end-points must use usually have static (persistent) IP addresses. An Internet APN
may work if the main site (HQ) VPN appliance can support Dynamic DNS names.
Remote Site Router Requirements: Any router that supports GRE, IPsec ESP or NAT-T
(or uses IPsec-in-UDP) should work.
Remote Site Router / VPN Appliance Configuration:
Router default gateway: Digi Connect WAN’s Ethernet port IP address
Policy to use ESP, GRE or NAT-T tunneling; or just GRE if no encryption is required
7/18/2005 Digi International 1 of 3
Digi Connect Application Guide - Primary Connections
HQ Router / VPN Appliance Configuration: The HQ appliance’s tunnel policy peer
address will be the Connect WAN’s Mobile IP address. For this reason a static mobile IP
address is preferred on the Digi Connect WAN.
IPsec forwarding: Digi Connect WAN firmware revision D introduced IPsec forwarding
where IPsec ESP tunnel-mode traffic can be forwarded to a specific Ethernet IP address.
Current firmware is available via http://www.digi.com/support.
Console Port: As a side benefit, the Digi Connect WAN console port can configured for
“Console Management” to provide SSH or telnet access. It can be cabled to the router or
VPN appliance’s console port to provide true diverse out-of-band console access.
Digi Connect Typical WAN Configuration
1. Read and follow the quick-start guide for the Digi Connect WAN and optionally for
Digi Connectware® Manager if used.
2. Assign a static IP address to the Ethernet port. Note the default gateway may show or
change to an address such as 10.6.6.6. This is normal as it is the GSM provider’s
network default gateway.
3. Configure Forwarding via Network > IP Forwarding Settings:
a. For GRE: Enable GRE protocol forwarding and enter the IP address of the
router’s WAN Ethernet port (the router attached to the Digi Connect WAN).
b. For IPsec ESP forwarding: Enable IPsec ESP forwarding and enter the IP
address of the router’s WAN Ethernet port (attached to the Digi Connect
WAN)
c. For NAT-T: Create two UDP port forwarding entries for Ports 500 and 4500*
(both source and destination ports) and enter the IP address of the router’s
WAN Ethernet port (the router attached to the Digi Connect WAN).
*Some appliances may use ports other than 4500. Check the router
documentation for acceptable UDP port numbers. Note also that the Digi
Connect WAN can use different ports for source and destination. If the
HQ router uses port 10000, but the remote router uses 4500, for example,
create a port forwarding entry for source of 10000 and destination of 4500.
d. Press APPLY to accept the changes
4. Optionally configure IP filtering and TCP services to block any unwanted incoming
connections.
Example NAT-T (IPsec in UDP) Setup
Refer to the diagram above using these IP addresses:
Remote site router 192.168.0.2
Digi Connect WAN Ethernet port 192.168.0.1
Digi Connect WAN Ethernet link 166.123.123.123
The HQ router will use the mobile IP address of the Digi Connect WAN (in this case
166.123.321.123) as its tunnel peer address.
7/18/2005 Digi International 2 of 3
Digi Connect Application Guide - Primary Connections
For a NAT-T (IPsec in UDP) configuration, create these entries on the Digi Connect
WAN via Network > IP Forwarding Settings:
Protocol Source Port Destination IP Address Destination Port
UDP 500 192.168.0.2 500
UDP 4500 192.168.0.2 4500
Press Apply. IPsec-in-UDP traffic should now pass through the Digi Connect WAN.
GRE or IPsec ESP Forwarding: Go to Configure > Network > IP Forwarding and
select either IPsec or GRE forwarding. Enter the IP address of the router / VPN appliance
Ethernet LAN port.
Client-to-Site VPNs: Port, GRE or IPsec forwarding may not be required if the VPN is
configured for client-to-site where the tunnel(s) is initiated only from the remote site.
Where to Get More Information
Refer to the Digi Connect WAN user documentation and Digi technical support website
at www.digi.com/support for more information. Technical assistance is available at
http://www.digi.com/support/eservice/eservicelogin.jsp.
For sales and product information, please contact Digi International at 952-912-3444 or
via www.digi.com.
7/18/2005 Digi International 3 of 3
Tabla de contenidos
Otros manuales de Enrutador de red de Digi
Digi
Digi TransPort WR44 v2 Manual de usuario
Digi
Digi One TS W Manual de usuario
Digi
Digi TransPort WR64 Manual de usuario
Digi
Digi TransPort WR11 Manual de usuario
Digi
Digi TransPort LR54-AA401 Manual de usuario
Digi
Digi TX54 Manual de usuario
Digi
Digi 6310-DX Manual de usuario
Digi
Digi TransPort LR54 Manual de usuario
Digi
Digi TransPort WR11 Manual del operador
Digi
Digi TransPort WR11 XT Manual de usuario
Digi
Digi Connect IT 4 Manual de usuario
Digi
Digi HR4420i Manual de usuario
Digi
Digi XPressWireless Manual de usuario
Digi
Digi TransPort WR31 Manual de usuario
Digi
Digi TransPort WR31 Manual de usuario
Digi
Digi TransPort WR11 Manual de usuario
Digi
Digi Transport DR64-H Manual de usuario
Digi
Digi TransPort WR11 Manual de usuario
Digi
Digi 6330-MX Manual de usuario
Digi
Digi IX14 Manual de usuario
Manuales populares de Enrutador de red de otras marcas
Korenix
Korenix JetNet 5710G Series Manual de usuario
Automated Logic
Automated Logic ZN551 Manual del propietario
Cisco
Cisco ASR 1000 Series Manual del operador
EnGenius
EnGenius ESR-9710 Manual de usuario
Cisco
Cisco 805 Series Instrucciones de funcionamiento y seguridad
LevelOne
LevelOne FBR-1416 Manual de usuario