ERP项目SAPROUTER配置文档.docVIP

OSS VPN Connection Overview Figure 1 - Internet VPN Internet VPN Internet connection: recommended minimum bandwidth = 64 kbps SAProuter machine Two (2) official IP subnets. These IP subnets are assigned to: The public interface of the VPN box. Additionally, this IP subnet must be routed in the Internet. The customer’s SAProuter If the customer is operating any firewall(s) to secure its Internet connection, the firewall(s) must permit the edge VPN equipment to exchange IPsec packets using their respective public interfaces (the VPN gateway may also serve as the firewall). Specifically, the customer’s firewall must allow UDP port 500 (IKE) and IP Protocol 50 (ESP) Recommended VPN equipment: Nortel Contivity 1500 Extranet Switch or Nortel Contivity 600 Extranet Switch (with 3DES encryption). Customers may also try to connect using other IPsec compliant VPN equipment. The equipment must support certain IPsec features (see Appendix A) that are mandatory to establish communication with SAP’s VPN. SAP cannot guarantee interoperability between the Nortel Contivity 1500 Extranet Switch and other types of VPN equipment that the customer selects to use instead. If you wish to use other VPN equipment, contact SAP. Other networking equipment (routers and switches / hubs) needed to form the network at the customer’s premises (see Figure 2). Prerequisite Cisco1721直接在Internet接入路由器后面 给Csico1721配一个外部地址如5。在路由器上设置静态路由将外部访问6（saprouter的外部地址）的请求路由到5上,由Cisco1721完成将6映射到(saprouter的内部地址)。 Cisco1721接在Firewall后面 给Csico1721配一个外部地址如5。在防火墙上设置静态路由将外部访问6（saprouter的外部地址）的请求路由到5上,由Cisco1721完成将6映射到(saprouter的内部地址)。防火墙上给5打开UDP port 500 (IKE) ，IP Protocol 50 (ESP) TCP port 3299 (saprouter)端口。 设置Cisco 1721 我们使用Cisco1721建立与sap的OSSVPN连接。在Cisco1721上需要进行如下设置（命令参见1721Command.TXT）： 设置Cisco的console密码和telnet密码 设置Cisco interface的地址，并将相应的interface设置为对外端口（或对内端口）。 设置网关 设置路由 定义隧道 crypto isakmp policy 10 encr 3des hash md5 authentication pre-share