It creates large number of IPSec SA continuously

show ipsec stats
this command was introduced in code 7.0
it will show the active tunnels, the previous tunnels and several other stats of inbound and outbound packets.....
for example:- IPsec Global Statistics ----------------------- Active tunnels: 2 Previous tunnels: 9 Inbound Bytes: 4933013 Decompressed bytes: 4933013 Packets: 80348 Dropped packets: 0 Replay failures: 0 Authentications: 80348 Authentication failures: 0 Decryptions: 80348 Decryption failures: 0 Decapsulated fragments needing reassembly: 0 Outbound Bytes: 4441740 Uncompressed bytes: 4441740 Packets: 74029 Dropped packets: 0 Authentications: 74029 Authentication failures: 0 Encryptions: 74029 Encryption failures: 0 Fragmentation successes: 3 Pre-fragmentation successes:2 Post-fragmentation successes: 1 Fragmentation failures: 2 Pre-fragmentation failures:1 Post-fragmentation failures: 1 Fragments created: 10 PMTUs sent: 1 PMTUs recvd: 2 Protocol failures: 0 Missing SA failures: 0 System capacity failures: 0

Create an IPSEC tunnel between you and your friends computer. Your friends computer should act as the gateway. Allow your packet information will be encapsulated within the tunnel and the router will not see the IP Header. This should work for you.

save what you need and format the hard drive it will be like new

First check to see if your brand of router will allow you to connect via VPN not all do..

Cisco VPN
Upgrade your router to the latest firmware. You can download firmware at http://www.dlink.com.au/tech/ .
Disable all Firewall Software (ZoneAlarm, Windows XP Firewall, etc.).
Configuring PC running VPN Client Software:
Step 1 Disable all Firewall Software (ZoneAlarm, Windows XP Firewall, etc.).
Step 2 Change IP Address to be outside of the routers DHCP Pool (i.e. 192.168.0.99). By default the DHCP pool is 192.168.0.100 - 192.168.0.199.
Step 3 Configure Cisco VPN Client - Connection Properties.
Step 4 Check Enable Transparent Tunneling.
Step 5 Allow IPSec over UDP ( NAT/PAT).
Configuring Router using the Web-based configuration:
Step 1 Open the Web Configuration Page by entering 192.168.0.1 into your web browser. Enter username (admin) and your password (blank by default).
Step 2 Check the Status tab and make sure that you are running the latest version of firmware. If not, upgrade firmware before proceeding.
Step 3 Click on the Miscellaneous button on the Tools tab. Enable both PPTP and IPSec.
Step 4 Click Apply.
Step 5 Click on the Virtual Servers button on the Advanced tab.
Step 6 Enable IPSec from the list and configure as follows:
Private IP: IP Address of the PC running Cisco VPN Client
Protocol: UDP
Private Port: 500
Public Port: 500
Schedule: Always.
Step 7 Click Apply and then Continue.
Step 8 Enable PPTP from the list and configure as follows:
Private IP: IP Address of the PC running Cisco VPN Client
Protocol: TCP
Private Port: 1723
Public Port: 1723
Schedule: Always.
Step 9 Click Apply and then Continue.


http://www.dlink.com.au/tech/default.asp?model=DI-524UP

04810481

Windows XP or Windows 2000 IP Address: 140.111.1.2 ? User ISP provide IP Address, this is only a sample Subnet Mask: 255.255.255.0 BEFVP41 WAN IP Address: 140.111.1.1 ? User ISP provide IP Address, this is only a sample Subnet Mask: 255.255.255.0 LAN IP Address: 192.168.1.1 Subnet Mask: 255.255.255.0 Step-by-Step [Windows 2000/XP] Create IPSec Policy 1. Click the Start button, select Run, and type secpol.msc. in the open field. 2. Right-click IP Security Policies on Local Computer and click Create IP Security Policy. 3. Click the Next button, and then type a name for your policy (for example, ?to_befvp41?). Then, click Next. 4. Deselect the Activate the default response rule check box and then click the Next button. 5. Click the Finish button, making sure the Edit check box is checked. Build 2 Filter Lists: ?WinXP? BEFVP41? and ?BEFVP41? WinXP?. Note: The references in this section to ?WinXP? can easily be exchanged for ?Win2000?, if running Windows 2000. Filter List 1: WinXP? BEFVP41 1. In the new policy properties, deselect the Use Add Wizard check box and then click the Add button to create a new rule. 2. From the IP Filter List tab, click the Add button. 3. Type an appropriate name ?WinXP? BEFVP41? for the filter list, deselect the Use Add Wizard check box, and click the Add button. 4. In the Source address field, select My IP Address. 5. In the Destination address field, select A specific IP Subnet, and fill in the IP Address 192.168.1.0 and Subnet mask 255.255.255.0. 6. If you want to type a description for your filter, click the Description tab. 7. Click the OK button. Then click the OK (for WinXP) or Close (for WIN2000) button on the IP Filter List window. Filter List 2: BEFVP41? WinXP 8. On the IP Filter List tab, click the Add button. 9. Type an appropriate name ?BEFVP41? WinXP? for the filter list, deselect the Use Add Wizard check box, and click the Add button. 10. In the Source address field, select A specific IP Subnet, and fill in the IP Address 192.168.1.0 and Subnet mask 255.255.255.0. 11. In the Destination address field, select My IP Address. 12. If you want to type a description for your filter, click the Description tab. 13. Click the OK button and click the OK (for WinXP) or Close (for Win2000) button on IP Filter List window. Configure Individual Rule of 2 Tunnels Tunnel 1: WinXP? BEFVP41 1. From the IP Filter List tab, click the filter list WinXP? BEFVP41. 2. From the Filter Action tab, click the filter action ?Require Security?, and click the Edit button. 3. verify that the Negotiate security option is enabled, and deselect the Accept unsecured communication, but always respond using IPSec check box. 4. Select the Session key perfect forward secrecy (PFS) and remember to check the PFS option on the BEFVP41, and click the OK button. 5. From the Authentication Methods tab, click the Edit button. 6. Change the authentication method to Use this string (preshared key), enter the string ?XYZ12345?, and click the OK button. This new Preshared key will be displayed. Click the OK button to continue. 7. From the Tunnel Setting tab, click The tunnel endpoint is specified by this IP Address radio button and type the WAN IP Address 140.111.1.1 of the BEFVP41. 8. From the Connection Type tab, Select All network connections and click the OK button to finish this rule. Tunnel 2: BEFVP41? WinXP 9. In the new policy properties, deselect the Use Add Wizard check box and click the Add button to create the second IP Filter. 10. From the IP Filter List tab, click the filter list BEFVP41? WinXP. 11. From the Filter Action tab, select the filter action Require Security. 12. From the Authentication Methods tab, click the Edit button. 13. Change the authentication method to Use this string (preshared key), enter the string ?XYZ12345?, and then click the OK button. This new Preshared key will be displayed. Click the OK button to continue. 14. From the Tunnel Setting tab, click the radio button for The tunnel endpoint is specified by this IP Address and type the Windows 2000/XP IP Address 140.111.1.2. 15. From the Connection Type tab, select All network connections. Then, click the OK (for WInXP) or Close (for Win2000) button to finish . 16. From the Rules tab, click the OK button to go back to the secpol screen. Assign New IPSec Policy 1. In the IP Security Policies on Local Computer MMC snap-in, right-click the policy named to_befvp41, and click Assign. A green arrow appears in the folder icon. [BEFVP41] Setup Screen 1. Open your web browser and enter 192.168.1.1 in the Address field and press the Enter key. 2. When the User name and Password field appears, skip the user name and enter the default password admin and press the

Yes, the HPRO200 supports multiple IPSec connections.

This example will demonstrate how to create a Virtual private Network (VPN) between two remote locations through the Internet. The VPN policy will use 3DES IPSec to securely send/receive encrypted data over the Internet. When the VPN tunnel is enabled, the two offices will virtually appear to be on the same local network. This example will consist of two DI-804V VPN Routers with a simple setup. The two remote offices in this example will be known as Office A and Office B. Both VPN Routers must already be set up and able to access each other. This is only an example, your setup will vary using the WAN IP address provided by your ISP. Please note the differences in the IP addresses for each office. We will begin by configuring the DI-804V at Office A. Start by going into VPN Settings under the Basic Setup menu. Step 1. In the Connection Name field, type in OfficeA. Click ADD. Step 2. A properties screen will appear for the new connection you have made. Fill in the appropriate information for Office A: Connection Name: OfficeA Local IPSEC Identifier: Local Remote IPSEC Identifier: Remote Remote IP Network: 192.168.1.0 Remote IP Netmask: 255.255.255.0 Remote Gateway IP: 192.170.0.2 Network Interface: WAN ETHERNET Secure Association: IKE Perfect Forward Secure: Enabled PreShared Key: 123456 Key Life: 28800 IKE Life Time: 3600 Step 3 Click SAVE. There should now be a VPN policy created for Office A. Now you will want to Save & Restart the DI-804V. Note: 123456 is an example of a preshared key, please fill in any secret preshared key you desire. Keep in mind that both sites require the same preshared key. Office A setup is now complete, we will now configure Office B with the other DI-804V, Follow the same steps previously with Ofice A to create a VPN policy. Step 1 Please change the appropriate information. Connection Name: OfficeB Local IPSEC Identifier: Local Remote IPSEC Identifier: Remote Remote IP Network: 192.168.0.0 Remote IP Netmask: 255.255.255.0 Remote Gateway IP: 192.170.0.1 Network Interface: WAN ETHERNET Secure Association: IKE Perfect Forward Secure: Enabled PreShared Key: 123456 Key Life: 28800 IKE Life Time: 3600 Step 2 Click SAVE. There should now be a VPN policy created for Office B. Now you will want to Save & Restart the DI-804V. After the VPN policies have been created for the two Offices, the two remote locations should authenticate and connect. To view the status of the VPN connection, go to the Device Status menu. On the bottom-left side of the menu, click on the VPN Status icon. A VPN Status pop-up screen will appear showing VPN connection status. If a VPN tunnel is active, the State should indicate Q-Estab. Go to a DOS prompt and ping the internal IP address of the remote network.

Step 1 Go into the web-based configuration on the router (enter 192.168.0.1 in your web brower). Enter username (admin) and password (blank). Step 2 Click on Advanced at the top and then click on Applications on the left side. Step 3 Check Enable Step 4 Enter a name (i.e. Nortel). Step 5 Enter 500 for Trigger Port (500 - 500). Step 6 Select Both for Trigger Type. Step 7 Enter 500 for Public Port. Step 8 Select Both for Public Type. Step 9 Click Apply and then click on Continue when prompted.