Avaya 2400 Series Digital Telephones Users Manual Ubigate NetScr

: Avaya Avaya-2400-Series-Digital-Telephones-Users-Manual-737270 avaya-2400-series-digital-telephones-users-manual-737270 avaya pdf

Open the PDF directly: View PDF .
Page Count: 27

Download
Open PDF In Browser	View PDF

Avaya Solution & Interoperability Test Lab

Configuring a Juniper Networks NetScreen-Remote VPN
Client to Support an Avaya IP Softphone Secure Connection
to a Samsung UbigateTM iBG3026 Gateway - Issue 1.0

Abstract
These Application Notes describe the procedures for configuring a secure VPN connection to
the Samsung UbigateTM iBG3026 Gateway using the Juniper Networks NetScreen-Remote
VPN Client to support the Avaya IP Softphone.
The Samsung iBG3026 functions as a multi-service IP switch/router. With the addition of a
VPN/Internet Protocol Security (IPSec) option card, the Samsung iBG3026 provides VPN
functionality to support remote users using Juniper NetScreen-Remote through the public
Internet. In a mixed customer environment where both Juniper and Samsung VPN gateways
are installed, the remote users can use the same Juniper NetScreen-Remote to securely connect
to the office network for telephony and data access.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

1 of 27
Ubigate-NetScr.doc

1. Introduction
These Application Notes describe the procedures for configuring a secure VPN connection to the
Samsung UbigateTM iBG3026 Gateway using the Juniper Networks NetScreen-Remote VPN
Client to support the Avaya IP Softphone.
The Samsung iBG3026 is designed to provide WAN-connectivity such as T1, E1, T3, and metro
Ethernet to a small-to-medium sized office. The Samsung iBG3026 provides VPN/firewall
functionality for WAN interfaces, so remote users can build secure communication channels
through the public Internet.

2. Test Configuration
The sample network implemented for these Application Notes is shown in Figure 1.

Figure 1: Test Configuration
The HQ Office consists of a Samsung iBG3026 functioning as a layer 2 Ethernet switch with
Power-over-Ethernet (PoE), layer 3 router, perimeter security device and Internet Protocol
Security (IPSec) VPN gateway. User authentication for remote users is done using the Microsoft
Internet Authentication Service (IAS) running on a Microsoft Windows Server 2003. Avaya
Communication Manager running on the Avaya S8300B Server and Avaya G350 Media
Gateway provides the IP telephony platform for local and remote users.
Remote users connected to the public internet use the Juniper NetScreen-Remote for secure
connection to the HQ Office and use the Avaya IP Softphone for telephony functionality.
JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

2 of 27
Ubigate-NetScr.doc

An Avaya C364T-PWR Converged Stackable Switch simulates the WAN by routing the IP
traffic between the remote user and the HQ Office.
The VPN tunnel between the Samsung iBG3026 and Juniper NetScreen-Remote is configured
based on the following parameters:
Phase 1
Authentication Method: Pre-shared Key with extended authentication (Xauth)
Encryption: Triple Data Encryption Standard (3DES)
Authentication: Secure Hash Algorithm-1 (SHA-1)
Diffie-Hellman (DH) Group: 2
Phase 2
Encapsulation: Encapsulation Security Payload (ESP)
Encryption: Advanced Encryption Standard (AES) 128-bit keys
Authentication: SHA-1
Perfect Forward Secrecy: Disabled

3. Equipment and Software Validated
The following equipment and software were used for the sample configuration provided:
Equipment
Avaya S8300B Server

Avaya G350 Media Gateway
Avaya 9630 IP Telephones
Avaya 4610SW IP Telephones
Avaya 2420 Digital Telephone
Avaya IP Softphone
Avaya C364T-PWR Converged Stackable Switch
Samsung UbigateTM iBG3026
Juniper Networks NetScreen-Remote VPN Client
Microsoft Windows Server 2003

JC; Reviewed:
SPOC 8/6/2007

Software
Avaya Communication Manager
3.1.2 (R013x.01.2.632.1)
Service Pack 12714
25.33.0
R1.1 (H.323)
R2.7 (H.323)
R5.2 Service Pack 1
4.5.14
SNOS 1.0.5.9 Advanced
DSP 1.0.2 firmware
8.7 build 12
Service Pack 1

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

3 of 27
Ubigate-NetScr.doc

4. Configure Avaya Communication Manager and Avaya IP
Telephones
These application notes assume that the configuration of Avaya Communication Manager and
the Avaya IP telephones are already in place. Refer to [1] for detail instructions on the
configuration on these components.

5. Configure Microsoft Active Directory
5.1. Create User Accounts
The steps below create a new user account for the Juniper NetScreen-Remote user shown in
Figure 1. These Application Notes assume Microsoft Active Directory is installed and
operational.
Step Description
1. On the Microsoft Windows 2003 Server running Active Directory, open the Active
Directory Users and Computers application window by selecting Start > All Programs
> Administrative Tools > Active Directory Users and Computers. Right click the
Users folder and select New > User from the pop-up menu as shown below.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

4 of 27
Ubigate-NetScr.doc

Step Description
2. Enter the user information as highlighted below. All remaining fields may be left as the
defaults. Click Next to continue.

3. Enter the password and the password policy options shown below. Click Next to continue
then click Finish (not shown).

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

5 of 27
Ubigate-NetScr.doc

Step Description
4. To allow the new account to request authentication when connecting via VPN to the
Samsung iBG3026, the account’s remote access permission must be enabled. From the
Active Directory Users and Computers screen, right click the user name created in Step
2 under the Users folder and select Properties from the pop-up menu.

5. Select the Dial-in tab and then select the Allow access option. All remaining fields can be
left as the defaults. Click OK to save.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

6 of 27
Ubigate-NetScr.doc

5.2. Create User Group
The steps below create a new user group to allow all Juniper NetScreen-Remote user accounts to
be grouped together and allow Microsoft IAS to apply a consistent access policy.
Step Description
1. From the Active Directory Users and Computers screen, right click the Users folder
and select the New > Group from the pop-up menu as shown below.

2. Enter a descriptive name for Group name field as highlighted below. All remaining fields
may be left as the defaults. Click OK.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

7 of 27
Ubigate-NetScr.doc

5.3. Add Users to Group
The steps below add the newly created user to the newly created user group.
Step Description
1. Edit the properties of the new user group by right clicking the group name under the
Users folder. Select Properties from the pop-up menu.

2. Select the Members tab then click Add.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

8 of 27
Ubigate-NetScr.doc

Step Description
3. Enter the user name then click Check Names. The user should appear as shown below.
Click OK to save. Then click OK again (not shown) to exit the Group Properties screen.

6. Configure Microsoft Internet Authentication Service
The steps below add the Samsung iBG3026 to the Microsoft IAS as a Remote Authentication
Dial In User Service (RADIUS) client. This enables Microsoft IAS to exchange RADIUS
messages with the Samsung iBG3026. These Application Notes assume the Microsoft IAS is
installed and operational.

6.1. Add RADIUS Client
Step Description
1. Open the Internet Authentication Service application by selecting Start > All
Programs > Administrative Tools > IAS. Right click RADIUS Clients and select New
Radius Client from the pop-up menu as shown below.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

9 of 27
Ubigate-NetScr.doc

Step Description
2. Enter a descriptive name for Friendly name and the IP address of the Samsung iBG3026
for Client address (IP or DNS). Click Next to continue.

3. Enter a text string for Shared secret. In this configuration, the string is radiussecretkey.
This shared secret text is used by the Samsung iBG3026 in Section 6.2 to authenticate
with the Microsoft IAS for RADIUS communications. All remaining fields may be left as
the defaults. Click Finish.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

10 of 27
Ubigate-NetScr.doc

6.2. Configure Remote Access Policy
The steps below create a new access policy to be used for RADIUS requests coming from the
Samsung iBG3026 on behalf of NetScreen-Remote users.
Step Description
1. From the Internet Authentication Service screen, right click Remote Access Policies
and select New > Remote Access Policy from the pop-up menu.

2. From the New Remote Access Policy Wizard screen, select Set up a custom policy and
enter a descriptive name for Policy name. Click Next to continue.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

11 of 27
Ubigate-NetScr.doc

Step Description
3. From the Policy Conditions screen, click Add.

4. From the Select Attribute screen, select the attribute types to be applied to this access
policy. The Windows-Groups attribute is used in the sample configuration. Select
Windows-Groups and click Add.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

12 of 27
Ubigate-NetScr.doc

Step Description
5. Click Add to add a new group.

6. The Active Directory Users group created in Section 5.2 is added to this access policy as
shown below. Click OK twice to return to the Policy Conditions screen in Step 3 and
then click Next to continue.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

13 of 27
Ubigate-NetScr.doc

Step Description
7. Select Grant remote access permission and click Next to continue.

8. Click Edit Profile.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

14 of 27
Ubigate-NetScr.doc

Step Description
9. In the Authentication tab, ensure that the field Unencrypted authentication (PAP,
SPAP) is checked. All other authentication methods can be unchecked. Click OK to
return to the screen in Step 7, followed by Next and then Finished (not shown) to
complete the wizard.

7. Configure Samsung iBG3026
The Samsung iBG3026 provides both browser-based and command-line-based (telnet or console
port access) administrative interfaces. However, since the full range of necessary configuration
features is supported only via the command line interface (CLI), the steps in this section use only
the CLI.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

15 of 27
Ubigate-NetScr.doc

7.1. Configure Ethernet and VLAN Interfaces
Step Description
1. Connect to the Samsung iBG3026 command line interface via a terminal emulation
program (e.g., HyperTerminal) using the serial cable provided for the console port at the
back of the machine. Enter the username (samsung) and default password (see [4]) to log
in. Enter configure terminal to access the configure mode.
#----------------------------------------------------------------------# SAMSUNG ELECTRONICS CO., LTD. Login
#----------------------------------------------------------------------login: samsung
password:
SAMSUNG ELECTRONICS CO., LTD. CLI
sarak2# configure terminal
sarak2/configure#

2. Configure the ethernet 0/2 as an untrusted interface to connect to the public WAN.
sarak2/configure# interface ethernet 0/2
Configuring existing Ethernet interface
sarak2/configure/interface/ethernet (0/2)# ip address 2.2.2.1/24
sarak2/configure/interface/ethernet (0/2)# crypto untrusted
sarak2/configure/interface/ethernet (0/2)# exit
sarak2/configure#

3. Create a VLAN for the Ethernet ports used by IP telephones and Windows 2003 server
and configure the VLAN as a trusted interface. The configuration below is shown for
Ethernet ports 1/18 and 1/19. Repeat the steps as necessary to configure other Ethernet
ports.
sarak2/configure# vlan database
sarak2/configure/vlan/database# vlan 101 bridge 1 name Remote
sarak2/configure/vlan/database# exit
sarak2/configure# interface vlan vlan1.101
sarak2/configure/interface/vlan vlan1.101# ip address 192.168.1.1 255.255.255.0
sarak2/configure/interface/vlan vlan1.101# crypto trusted
sarak2/configure/interface/vlan vlan1.101# exit
sarak2/configure# interface ethernet 1/18
Configuring existing Ethernet interface
sarak2/configure/interface/ethernet (1/18)# switchport mode access
sarak2/configure/interface/ethernet (1/18)# switchport access vlan 101
sarak2/configure/interface/ethernet (1/18)# exit
sarak2/configure# interface ethernet 1/19
Configuring existing Ethernet interface
sarak2/configure/interface/ethernet (1/19)# switchport mode access
sarak2/configure/interface/ethernet (1/19)# switchport access vlan 101
sarak2/configure/interface/ethernet (1/19)# exit
sarak2/configure#

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

16 of 27
Ubigate-NetScr.doc

Step Description
4. Add a default route to the router on the public Internet.
sarak2/configure# ip route 0.0.0.0/0 2.2.2.254
sarak2/configure#

7.2. Configure RADIUS
Configure the Samsung iBG3026 as a RADIUS client to the Microsoft IAS for the authentication
of remote VPN users.
Step Description
1. Configure the Samsung iBG3026 to connect to the Microsoft IAS with the secret key as
radiussecretkey.
sarak2/configure# aaa
sarak2/configure/aaa# radius
sarak2/configure/aaa/radius#
sarak2/configure/aaa/radius#
sarak2/configure/aaa/radius#
sarak2/configure/aaa/radius#
sarak2/configure/aaa# enable
sarak2/configure/aaa# exit
sarak2/configure#

JC; Reviewed:
SPOC 8/6/2007

primary_server 192.168.1.110
src_address 192.168.1.1
shared_key radiussecretkey
exit

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

17 of 27
Ubigate-NetScr.doc

7.3. Configure VPN Remote Access Policy
Create the VPN Remote Access Policy to support remote users.
Step Description
1. Configure dynamic Phase 1 IKE policy for a group of remote users. The pre-shared key is
set to interoptest in this configuration. For dynamic policy, set the mode to aggressive.
Configure the IKE phase 1 proposal as described in Section 3. Create an address pool for
the Samsung iBG3026 to use for assigning IP addresses to Juniper NetScreen-Remote
clients when an IPSec tunnel is successfully established. Configure the Samsung iBG3026
to use Password Authentication Protocol (PAP) to authenticate with the Microsoft Internet
Authentication Service (RADIUS) for user authentication.
sarak2/configure# crypto
sarak2/configure/crypto# dynamic
sarak2/configure/crypto/dynamic# ike policy remusers modecfg-group
sarak2/configure/crypto/dynamic/ike/policy remusers# local-address 2.2.2.1
sarak2/configure/crypto/dynamic/ike/policy remusers# remote-id domain-name
avaya.com
Default proposal created with priority1-des-sha1-rsa-g1
Default ipsec policy 'remusers' of type modecfg added with proposal priority13des-sha1-tunnel
sarak2/configure/crypto/dynamic/ike/policy remusers# key interoptest
sarak2/configure/crypto/dynamic/ike/policy remusers# mode aggressive
sarak2/configure/crypto/dynamic/ike/policy remusers# proposal 1
sarak2/configure/crypto/dynamic/ike/policy remusers/proposal 1# authenticationmethod pre-shared-key
sarak2/configure/crypto/dynamic/ike/policy remusers/proposal 1# dh-group group2
sarak2/configure/crypto/dynamic/ike/policy remusers/proposal 1# encryptionalgorithm 3des-cbc
sarak2/configure/crypto/dynamic/ike/policy remusers/proposal 1# exit
sarak2/configure/crypto/dynamic/ike/policy remusers# client configuration
sarak2/configure/crypto/dynamic/ike/policy remusers/client/configuration#
address-pool 1 192.168.11.101 192.168.11.120
sarak2/configure/crypto/dynamic/ike/policy remusers/client/configuration# dnsserver 192.168.1.110
sarak2/configure/crypto/dynamic/ike/policy remusers/client/configuration# exit
sarak2/configure/crypto/dynamic/ike/policy remusers# client authentication
sarak2/configure/crypto/dynamic/ike/policy remusers/client/authentication#
radius pap
sarak2/configure/crypto/dynamic/ike/policy remusers/client/authentication# exit
sarak2/configure/crypto/dynamic/ike/policy remusers# exit
sarak2/configure/crypto/dynamic#

2. Configure dynamic Phase 2 IPSec policy for the same group of remote users. Configure
the IPSec phase 2 proposal as described in Section 3.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

18 of 27
Ubigate-NetScr.doc

Step Description
sarak2/configure/crypto# dynamic
sarak2/configure/crypto/dynamic# ipsec policy remusers modecfg-group
sarak2/configure/crypto/dynamic/ipsec/policy remusers# match address
192.168.1.0/24
sarak2/configure/crypto/dynamic/ipsec/policy remusers# proposal 1 esp
sarak2/configure/crypto/dynamic/ipsec/policy remusers/proposal 1# encryptionalgorithm aes128-cbc
sarak2/configure/crypto/dynamic/ipsec/policy remusers/proposal 1# hash-algorithm
sha1-hmac
sarak2/configure/crypto/dynamic/ipsec/policy remusers/proposal 1# exit
sarak2/configure/crypto/dynamic/ipsec/policy remusers# exit
sarak2/configure/crypto/dynamic# exit
sarak2/configure/crypto# exit
sarak2/configure#

7.4. Configure Firewall Policies
Configure the firewall policies to allow traffic between the office network and the remote users.
Step Description
1. Assign the interfaces to the appropriate firewall map. By default, the Samsung iBG3026
creates two firewall maps:
• internet – Untrusted interfaces connecting to the public WAN
• corp – Trusted interfaces connected to the local LAN
The ethernet0/2 interface is assigned to the internet map while the VLAN created in
Section 7.1 Step 3 is assigned to the corp map.
sarak2/configure# firewall internet
sarak2/configure/firewall internet# interface ethernet0/2
sarak2/configure/firewall internet# exit
sarak2/configure# firewall corp
sarak2/configure/firewall corp# interface vlan1.101
sarak2/configure/firewall corp# exit
sarak2/configure#

2. Configure firewall policies to allow IKE negotiation into the untrusted ethernet0/2
interface.
sarak2/configure# firewall internet
sarak2/configure/firewall internet# policy 1000 in self
sarak2/configure/firewall internet/policy 1000 in# exit
sarak2/configure/firewall internet# exit
sarak2/configure#

3. Configure firewall policies to allow the remote users to access the office network. The
remote users are assigned with the IP addresses from the address pool configured in
Section 7.3 Step 1.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

19 of 27
Ubigate-NetScr.doc

Step Description
sarak2/configure# firewall corp
sarak2/configure/firewall corp# policy 1000 in address 192.168.11.101 192.168.11
.120 192.168.1.0 24
sarak2/configure/firewall corp/policy 1000 in# exit
sarak2/configure/firewall corp# exit
sarak2/configure#

8. Configure Juniper NetScreen-Remote
This section shows the configuration of the Juniper NetScreen-Remote on a single remote user
machine.
Step Description
1. Launch the NetScreen-Remote Security Policy Editor by selecting Start > Programs >
NetScreen-Remote > Security Policy Editor. Right click the folder My Connections
and select Add > Connection (not shown). Name the new connection as ToHQOffice.
Configure the highlighted fields shown below.
• Select Secure for Connection Security.
• Select IP Subnet for ID Type.
• Enter 192.168.1.0 in the field Subnet and 255.255.255.0 in the field Mask.
• Check the Use box.
• Select All in the Protocol field and Secure Gateway Tunnel in the Use field.
• Select IP Address in the field ID Type and enter 2.2.2.1 (IP address of the
Samsung iBG3026 public interface) as the tunnel endpoint IP address.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

20 of 27
Ubigate-NetScr.doc

Step Description
2. Expand the ToHQOffice folder and select My Identity. Configure the highlighted fields
shown below. Select Domain Name for ID Type field and enter avaya.com. Select
Preferred for Virtual Adapter field. All remaining fields can be left as the defaults.
Click Pre-Shared Key to continue.

3. Click Enter Key and type the Pre-Shared Key interoptest. Click OK.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

21 of 27
Ubigate-NetScr.doc

Step Description
4. Select Security Policy. Configure the highlighted fields shown below. Select Aggressive
Mode for Select Phase 1 Negotiation Mode. Uncheck Enable Perfect Forward Secrecy
(PFS). Check Enable Replay Detection field.

5. Expand folder Security Policy > Authentication (Phase 1) and select Proposal 1.
Configure the highlighted fields shown below. Select Pre-Shared Key; Extended
Authentication for Authentication Method field. Select Triple DES for Encrypt Alg
field, and SHA-1 for Hash Alg field. Select Diffie-Hellman Group 2 for Key Group
field. All remaining fields can be left as the defaults.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

22 of 27
Ubigate-NetScr.doc

Step Description
6. Expand folder Security Policy > Key Exchange (Phase 2) and select Proposal 1.
Configure the highlighted fields shown below. All remaining fields can be left as the
defaults.
• Check Encapsulation Protocol (ESP) field.
• Select AES-128 for Encrypt Alg field.
• Select SHA-1 for Hash Alg field.
• Select Tunnel for Encapsulation field.
From the menu, select File > Save to save the configuration.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

23 of 27
Ubigate-NetScr.doc

9. Verification Steps
The following steps can be used to verify that the configuration steps documented in these
Application Notes have been done correctly.

9.1. Verify Juniper NetScreen-Remote
Step Description
1. Right-click on the NetScreen-Remote icon and select Connect > My Connections\
ToHQOffice.

2. Enter the username and password created in the Microsoft Active Directory in Section
5.1.

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

24 of 27
Ubigate-NetScr.doc

Step Description
3. Verify that the Manual Connection Status screen is displayed and shows that the
connection is successful. Launch Avaya IP Softphone and verify that it can register with
Avaya Communication Manager successfully.

9.2. Verify Samsung iBG3026
9.2.1. Verify Client Connections
Enter the command show crypto dynamic clients using the Samsung iBG3026 CLI. Verify that
the client is connected as shown below.

sarak2/configure# show crypto dynamic clients
Client Address
-------------7.7.7.7

Client Id
--------avaya.com

Policy
-----remusers:192.168.11.101

Advanced
-------ModecfgGrp-Xauth-Radius

sarak2/configure#

9.2.2. Verify Phase 1 Status
Enter the command show crypto ike sa all using the Samsung iBG3026 CLI. Verify that the
State of the client connection shows SA_MATURE.

sarak2/configure# show crypto ike sa all
Policy
-----remusers

Peer
---7.7.7.7

State
----SA_MATURE

Bytes
----2052

Transform
--------pre-g2-3des-sha1

sarak2/configure#

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

25 of 27
Ubigate-NetScr.doc

9.2.3. Verify Phase 2 Status
Enter the command show crypto ipsec sa all using the Samsung iBG3026 CLI. Verify that the
IPSec policies for the tunnels going to and coming from the Juniper NetScreen-Remote are
created.

sarak2/configure# show crypto ipsec sa all
Policy
-----INremusers
remusers

Dest IP
------2.2.2.1
7.7.7.7

Spi
--0xbb3d0e65
0xea2383bf

Packets
-----1121
1322

Transform
--------esp-aes-sha1-tunl
esp-aes-sha1-tunl

sarak2/configure#

10. Conclusion
The Samsung UbigateTM iBG3026 is able to successfully interoperate with Juniper Networks
NetScreen-Remote VPN Client to support remote users running the Avaya IP Softphone.

11. Additional References
The following Avaya product documentation is available from http://support.avaya.com.
[1] Configuring the Samsung UbigateTM iBG-3026 with Avaya SIP Enablement Services and
Avaya Communication Manager, Issue 1.0, 12 Feb 2007
The following Samsung iBG3026 guides are available from Samsung for registered partner of
Samsung Electronics. Visit http://www.samsungen.com for company and product information.
[2] Samsung Ubigate iBG3026 Configuration Guide
[3] Samsung Ubigate iBG3026 Command Reference
[4] Samsung Ubigate iBG3026 Installation Manual
[5] Samsung Ubigate iBG3026 System Description
[6] Samsung Ubigate iBG3026 Message Reference Manual
The following Juniper Networks product documentations are available from
http://www.juniper.net/techpubs/:
[7] Juniper Netscreen-Remote VPN Client Administrator’s Guide, Version 8.7, P/N 0931635-000, Rev. B

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

26 of 27
Ubigate-NetScr.doc

©2007 Avaya Inc. All Rights Reserved.

Avaya and the Avaya Logo are trademarks of Avaya Inc. All trademarks identified by ® and ™
are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the
property of their respective owners. The information provided in these Application Notes is
subject to change without notice. The configurations, technical data, and recommendations
provided in these Application Notes are believed to be accurate and dependable, but are
presented without express or implied warranty. Users are responsible for their application of any
products specified in these Application Notes.
Please e-mail any questions or comments pertaining to these Application Notes along with the
full title name and filename, located in the lower right corner, directly to the Avaya Solution &
Interoperability Test Lab at interoplabnotes@list.avaya.com

JC; Reviewed:
SPOC 8/6/2007

Solution & Interoperability Test Lab Application Notes
©2007 Avaya Inc. All Rights Reserved.

27 of 27
Ubigate-NetScr.doc



---

Source Exif Data:

File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.4
Linearized                      : Yes
Page Count                      : 27
XMP Toolkit                     : XMP toolkit 2.9.1-13, framework 1.6
About                           : uuid:fcb39862-7ef1-44a3-84c6-1efabf013b50
Producer                        : Acrobat Distiller 6.0 (Windows)
Create Date                     : 2007:08:06 08:53:59-04:00
Creator Tool                    : PScript5.dll Version 5.2
Modify Date                     : 2007:08:06 08:53:59-04:00
Document ID                     : uuid:13e275e3-a545-4084-9829-3ad2755ad226
Format                          : application/pdf
Title                           : Microsoft Word - Ubigate-NetScr.doc
Creator                         : verma
Author                          : verma

EXIF Metadata provided by EXIF.tools