Configure IPsec to Juniper SSG Firewall

January 13, 2014, 6:38 pm

≫ Next: Firmware 6.1 Release Notes

$

0

0

This guide covers configuration an IPsec VPN  between Peplink and Juniper SSG firewall. The example assumes the following settings:

 

IPsec VPN Settings
Peplink WAN IP Address	210.211.10.5
Peplink LAN Network	192.168.2.0/24
Juniper SSG WAN IP Address	66.80.3.1
Juniper SSG LAN Network	192.168.1.0/24
IPsec Phase 1 Authentication	SHA-1
ISPEC Phase 1 Encryption	AES-128
ISPEC Phase 1 DH Group	2
IPsec Phase 2 Authentication	SHA-1
ISPEC Phase 2 Encryption	AES-128
ISPEC Phase 2 PFS Group	2

 

Configure Juniper SSG firewall

Create IPsec VPN Profile

Goto Wizards => Route Based VPN to begin:

1. Select local and remote interfaces.
2. Bind the tunnel to untrust interface.
3. Select LAN to LAN tunnel.
4. Select  Local Static IP <-> Remote Static IP
5. Enter remote IP address of Peplink
6. Select 128 bit encryption
7. Specify the local and remote networks of the IPsec VPN
8. Pass all protocols over VPN in both directions
9. Set logging options as needed
10. Set Schedule to None
11. Click Next then Finish to complete VPN configuration.

Configure Peplink device

Create IPsec Profile

1.  Goto Network -> Interfaces -> IPsec VPN to create a new IPsec profile. Give the VPN a meaningful Name and enter the Remote Gateway IP , Remote Networks , and Preshared Key of the Juniper SSG. Select the matching Phase 1 and Phase 2 settings for VPN.
2. Click Save and the IPsec configuration is now complete.

---

Firmware 6.1 Release Notes

January 13, 2014, 6:58 pm

≫ Next: Configure IPsec to Cisco IOS using X.509 Authentication

≪ Previous: Configure IPsec to Juniper SSG Firewall

$

0

0

Please note that devices need to be in warranty to upgrade to firmware 6.1. Click on any feature to learn more.

Note: The Captive Portal of Firmware 6.1 does not currently support Guest Account Mode. Support for this feature will resume in the future.

		B20/30	B210/310	B305 / B380+	MAX OTG	MAX BR1	MAX 700 / HD2	Surf SOHO
PepVPN/SpeedFusion
	PepVPN Support	●	●	●	●	●	●	●
	PepVPN Performance Analyzer	●	●	●	●	●	●	●
	X.509 Certificate Support	●	●	●	◊	●	●
AP Controller
	AP Controller Standard	●	●				●
	AP Controller Full			●
	Wi-Fi Usage Statistics	●	●	●			●
	Rogue AP Reporting	●	●	●			●
Captive Portal Support
	Support For Wired and Wireless LAN Clients	*	●	●	+	●	●
	Time and Usage Quotas on Open Access Mode	*	●	●	+	●	●
	Built-In Customizable Splash Page	*	●	●	+	●	●
	Support RADIUS Authentication	*	●	●	+	●	●
	Support LDAP Authentication			●
IPsec
	X.509 Certificate Support	●	●	●	◊	●	●
Routing
	VLAN on LAN Support	●	●	●	●	●	●
	WAN as LAN			●	●	●
	OSPF and RIPv2 Support			●
Cloud Management
	Fleet Management [1]					●	o
Misc
	Extended DHCP Option Support	●	●	●	●	●	●	●
	VRRP HA Support		●	●			●
Legend
	Feature Supported on Model	●
	Feature Activation Required	●
	MAX-OTG-U4-SF Only	◊
	MAX-OTG-U4 and MAX-OTG-U4-SF	+
	MAX-HD2 Only	o
	Coming soon on Firmware 6.1.1	*

[1] Only work with GPS capable devices

Configure IPsec to Cisco IOS using X.509 Authentication

January 13, 2014, 8:25 pm

≫ Next: Firmware 6.1 Upgrade Guide

≪ Previous: Firmware 6.1 Release Notes

$

0

0

This guide covers configuration of IPsec between Peplink and Cisco IOS devices using X.509 authentication. The example configuration assumes the following settings:

IPsec VPN Settings
Peplink WAN1 IP Address	210.211.10.5
Peplink WAN2 IP Address	88.20.8.20
Peplink LAN Network	192.168.2.0/24
Cisco WAN IP Address	66.80.3.1
Cisco LAN Network	192.168.1.0/24
Pre Shared Key	abc8009008
IPsec Phase 1 Authentication	SHA-1
ISPEC Phase 1 Encryption	AES-256
ISPEC Phase 1 DH Group	2
IPsec Phase 2 Authentication	SHA-1
ISPEC Phase 2 Encryption	AES-256
ISPEC Phase 2 PFS Group	2

Configure Peplink device for X.509 authentication

The Peplink should have its own private key and certificate installed to use X.509 authentication. You can read Article to complete this process.

Configure Cisco IOS

The following example configuration is based on Cisco IOS 12.4 and implements the example settings above. The configuration is color coded to aid in understanding

Red: Commands to enter
Blue: Comments
Black: IOS system output

!  Using X.509 authentication requires time and date are set correctly on all devices.  You may set the time on Cisco as follows:

Router#configure terminal
Router(config)# clock timezone UTC+8 8
Router(config)# exit
Router# clock set 10:10:00 3 jan 2014

!  Configure domain and hostname and generate RSA keys
!  The hostname cannot be left at default setting (Router). Host and domain-name must be set before generating rsa keys

Router(config)# hostname cisco
cisco(config)# ip domain-name company.com
cisco(config)# crypto key generate rsa general-keys
The name for the keys will be: cisco.company.com
Choose the size of the key modulus in the range of 360 to 2048 for your
 General Purpose Keys. Choosing a key modulus greater than 512 may take
 a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys ...[OK]
cisco(config)#

!--- Configure IPsec ISAKMP policy for Phase 1 negotiations.

cisco(config)# crypto isakmp policy 10
cisco(config-isakmp)# encryption aes 256
cisco(config-isakmp)# authentication pre-share
cisco(config-isakmp)# group 2
cisco(config-isakmp)# exit

!--- Specifies the preshared key "abc8009008" for Peplink’s WAN1 and WAN2

cisco(config)# crypto isakmp key abc8009008 address 210.211.10.5
cisco(config)# crypto isakmp key abc8009008 address 88.20.8.20

!--- Configure IPsec policies and specify the transform sets
!--- Phase 2 negotiations

cisco(config)# crypto ipsec transform-set aes256 esp-aes 256 esp-sha-hmac

!--- Creates crypto map for IKE establishment
!--- Set peers to remote Peplink WAN IPs
!--- Specifies IPsec to use the transform-set “aes256” configured above
!--- Match address specifies the traffic to be encrypted

cisco(config)# crypto map cisco 10 ipsec-isakmp
cisco(config-crypto-map)# set peer 210.211.10.5
cisco(config-crypto-map)# set peer 88.20.8.20
cisco(config-crypto-map)# set transform-set aes256
cisco(config-crypto-map)# match address 100
cisco(config-crypto-map)# exit
cisco(config)#

!--- Configure External WAN Interface 

cisco(config)# interface FastEthernet0/0
cisco(config-if)# ip address 66.80.3.1 255.255.255.0
cisco(config-if)# duplex auto
cisco(config-if)# speed auto
cisco(config-if)# crypto map cisco
cisco(config)# exit

!--- Configure Internal LAN Interface
cisco(config)# interface FastEthernet0/1
cisco(config-if)# ip address 192.168.1.1 255.255.255.0
cisco(config-if)# duplex auto
cisco(config-if)# speed auto
cisco(config-if)# exit

!--- Set default route

cisco(config)# ip route 0.0.0.0 0.0.0.0 66.80.3.254

!--- Define access list for IPsec traffic from subnet 192.168.1.0/24 to 192.168.2.0/24

cisco(config)# access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 

Firmware 6.1 Upgrade Guide

January 14, 2014, 2:06 am

≫ Next: Configure IPsec to Cisco IOS using Pre-shared Key Authentication.

≪ Previous: Configure IPsec to Cisco IOS using X.509 Authentication

$

0

0

Firmware 6.1 is a major upgrade that adds significant functionality to your router. This firmware is free for devices running Firmware 6.X and for devices under warranty. If you are running Firmware 5.X, you will need a firmware key to upgrade to 6.1.

This document is designed to walk you through the firmware upgrade process. Please follow the instructions that best match your situation:
- Running Firmware 5.x, unsure of warranty status: step 1
- Running Firmware 5.x with a warrantied device: steps 1 and 3
- Running Firmware 5.x with an out-of-warranty device: steps 1, 2, and 3
- Running Firmware 6.x on Balance 2500, MAX On-The-Go, MAX BR1, or Surf SOHO: step 3

---

Step 1: Check Your Warranty Status and Obtain Firmware Key

Step 2: Purchase Device Warranty

Step 3: Update Firmware and Unlock

---

Check Your Warranty Status and Obtain Firmware Key

InControl 2 is used here as a convenient way to check your warranty status and obtain your firmware key. Managing your devices using InControl 2 is completely optional. You can toggle InControl 2 management in your device firmware by navigating to System > InControl and clicking Managed by InControl Server.

Navigate to incontrol2.peplink.com. From there, you can either create an account by signing into Google or by manually entering your information. You have full control over the information you enter, here is a link to our privacy policy.

On the next two screens, specify your organization and group information. Please note that your organization name cannot be changed after it has been entered.

Afterwards, add the serial number(s) of the device(s) you want to check. After clicking the Add Devices button, you will reach the device summary.

Each device will appear differently depending on its warranty status:

Out of Warranty

The letters “Warranty Expired” will appear in red under your device name. To upgrade to Firmware 6.1, please purchase warranty for your device. On a working day, please allow several hours after payment completion for the warranty to go into effect. For instructions on obtaining warranty, please refer to step 2 of this guide.

In Warranty

If the red “Warranty Expired” label does not appear, then your device is in warranty. Click on the device to access your firmware key.

You can paste this key onto your device’s lock screen when you upgrade the device to Firmware 6.1. Please go to step 3 to complete the upgrade. Please note that the Balance 2500, the MAX On-The-Go, the MAX BR1, and the Surf SOHO do not require firmware unlock keys, simply upload the firmware to upgrade.

---

Purchase Device Warranty

InControl 2 Warranty Requirements

As long as your device is in warranty, you can manage it through InControl 2.

• If your device is in a warranty that is about to expire, simply extend your warranty to continue your InControl 2 coverage. This warranty renewal cycle can go on for as long as you need it to.
• For devices that are out of warranty, you will need to purchase a Smartcare or Totalcare warranty package.

Warranty Purchase Procedure
Click this link and choose the correct warranty(ies) for your device(s). Please click continue to proceed.

Once you have specified your delivery and payment addresses, you will reach a confirmation screen. To avoid processing delays, please include the serial number(s) of your device(s) in the comments section.

The status of your devices will update in a couple of hours if payment is completed on a working day. Otherwise, the device status will update on the next working day.

---

Update Firmware and Unlock

For firmware release notes, please click here. Download the correct firmware for your device:

Important Notes:

• A firmware unlock key will be required.  Please ensure your device is in warranty before proceeding.
• The Captive Portal of Firmware 6.1 does not currently support Guest Account Mode. Support for this feature will resume in the future.

Balance

• Balance 20, 30 (Balance 30 hardware revision 2, click here for details)
• Balance 210, 310, hardware revision 2 and 3 , (click here for details)
• Balance 305, 380, 390, 580, 700, 710, 1350
• Balance 2500 *

MAX

• MAX On-The-Go *
• MAX BR1 *
• MAX 700, HD2

Surf SOHO

• Surf SOHO *

* These models do not require a firmware unlock key, simply navigate to System > Firmware. Click Choose File and click Manual Upgrade.

Open your router’s web-UI. Navigate to System > Firmware. Click Choose File to indicate where you have downloaded your file, and then click Manual Upgrade. If the upgrade was succesful, then the router will reset and the following lock screen will appear.

Copy the firmware key from that device’s page on InControl 2, and paste it onto the empty field.

Congratulations, your device is succesfully running Firmware 6.1!

 

Configure IPsec to Cisco IOS using Pre-shared Key Authentication.

January 14, 2014, 8:39 pm

≫ Next: Obtaining a Diagnostic Report from a Pepwave AP Device

≪ Previous: Firmware 6.1 Upgrade Guide

$

0

0

This guide covers configuration of IPsec between Peplink and Cisco IOS devices using pre-shared key authentication. The example configuration assumes the following settings:

IPsec VPN Settings
Peplink WAN1 IP Address	210.211.10.5
Peplink WAN2 IP Address	88.20.8.20
Peplink LAN Network	192.168.2.0/24
Cisco WAN IP Address	66.80.3.1
Cisco LAN Network	192.168.1.0/24
Pre Shared Key	abc8009008
IPsec Phase 1 Authentication	SHA-1
ISPEC Phase 1 Encryption	AES-128
ISPEC Phase 1 DH Group	2
IPsec Phase 2 Authentication	SHA-1
ISPEC Phase 2 Encryption	AES-128
ISPEC Phase 2 PFS Group	2

Configure Cisco IOS

The following example configuration is based on Cisco IOS 12.4 and implements the example settings above:

!--- Configure an ISAKMP policy
!--- Phase 1 Negotiations

crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2

!--- Specify the preshared key "abc8009008" for Peplink’s WAN1 and WAN2

crypto isakmp key abc8009008 address 210.211.10.5
crypto isakmp key abc8009008 address 88.20.8.20

!--- Configure IPsec policies and specify the transform sets
!--- Phase 2 negotiations

crypto IPsec transform-set aes256 set esp-aes 256 esp-sha-hmac

!--- Create crypto map for IKE establishment
!--- Set peers to remote Peplink WAN IPs
!--- Specify IPsec to use the transform-set “aes256” configured above
!--- Match address specifies the traffic to be encrypted
crypto map cisco 10 IPsec-isakmp
  set peer 210.211.10.5
  set peer 88.20.8.20
  set transform-set aes256
  match address 100

!--- External WAN Interface 
interface FastEthernet0/0
  ip address 66.80.3.1 255.255.255.0
  duplex auto
  speed auto
  crypto map cisco
!--- Internal LAN Interface
interface FastEthernet0/1
  ip address 192.168.1.1 255.255.255.0
  duplex auto
  speed auto 

ip route 0.0.0.0 0.0.0.0 66.80.3.254

!--- Define access list for IPsec traffic from subnet 192.168.1.0/24 to 192.168.2.0/24
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

Peplink Configuration

Obtaining a Diagnostic Report from a Pepwave AP Device

January 23, 2014, 11:18 pm

≫ Next: How to enable VLAN Trunk on LAN

≪ Previous: Configure IPsec to Cisco IOS using Pre-shared Key Authentication.

$

0

0

Go through the following steps to obtain a Diagnostic Report from a Pepwave AP device:

1. Connect to the Web Admin Interface with a web browser.
2. Go to Command > Misc. Click the Proceed button under the Download Diagnostic Report field.
3. A prompt will appear for saving the file containing the Diagnostic Report to your computer.

How to enable VLAN Trunk on LAN

February 6, 2014, 12:37 am

≫ Next: Security Update – Peplink & Pepwave Products Are Not Vulnerable to The Heartbleed Bug

≪ Previous: Obtaining a Diagnostic Report from a Pepwave AP Device

$

0

0

The VLAN Trunk on LAN feature is supported in Firmware 6.1. You can enable it via the following steps. With this feature enabled, the LAN port(s) of the unit will become trunk port.

1. Go to “Network > Interfaces > LAN”

2. Click the “?” as the screenshot below, then you can click the link to enable VLAN feature.

3. VLAN Trunk feature is enabled.

 

Security Update – Peplink & Pepwave Products Are Not Vulnerable to The Heartbleed Bug

April 14, 2014, 3:51 pm

≫ Next: Will the Proximity of USB Modems Cause Interference Between Them?

≪ Previous: How to enable VLAN Trunk on LAN

$

0

0

About Heartbleed
The Heartbleed bug is a serious vulnerability in the security software used by millions of Web sites. According to www.openSSL.org, the affected versions are 1.0.1 and 1.0.2-beta of OpenSSL, a technology that is used by many Internet services to keep user data secure.

Why Peplink Is Not Affected
All of our products and firmware do not use v1.0.1 or v1.0.2 of OpenSSL, the versions that have been identified as vulnerable – including Balance, MAX, FusionHub, AP One/Pro, Surf, Device Connector families.

Further Action
There is no customer action required on your part.

Thank you for your attention.

---

Will the Proximity of USB Modems Cause Interference Between Them?

April 21, 2014, 9:31 pm

≫ Next: What Is The Difference Between Hardware Revisions of AP One 300M?

≪ Previous: Security Update – Peplink & Pepwave Products Are Not Vulnerable to The Heartbleed Bug

$

0

0

The Pepwave MAX 700 and On-The-Go feature multiple USB ports for fast and reliable mobile Internet.

Having 4 USB modems in a compact enclosure, the modems are placed very close to each other. However, the distance among the modems would not cause interference.

Carriers uses different radio frequencies for transmission, and to avoid interference with one another. The proximity of USB modems will therefore not cause any interference. Just like having multiple lanes on a highway.

What Is The Difference Between Hardware Revisions of AP One 300M?

July 21, 2014, 10:13 pm

≫ Next: What GNSS reporting protocols are supported on Peplink routers?

≪ Previous: Will the Proximity of USB Modems Cause Interference Between Them?

$

0

0

 

Product Name	AP One	AP One 300M	AP One 300M
Hardware Revision	1st	1st	2nd
2.4G High Power Wi-Fi	●		●
802.11a/n		●	●
802.11b/g/n	●	●	●

 

What GNSS reporting protocols are supported on Peplink routers?

October 20, 2014, 9:13 pm

≫ Next: IP addresses to securely connect to InControl2

≪ Previous: What Is The Difference Between Hardware Revisions of AP One 300M?

$

0

0

Certain models may not support both GPS and GLONASS at the same time. Please refer to your device’s specifications for more detail.

List of supported NMEA 0183 message types:

$GPGSV (Detailed satellite data for GPS)
$GPGGA (Fix information)
$GPVTG (Vector track and speed over the ground)
$GPRMC (Recommended minimum data for GPS)
$GPGSA (Overall satellite data for GPS)

$GLGSV (Detailed satellite data for GLONASS)
$GNGNS (Time, position, and fixed related data for GLONASS receiver)
$GNGSA (Overall satellite data for GLONASS)

List of supported TAIP message types:

PV (Position/Velocity Solution)
CP (Compact Position System)

IP addresses to securely connect to InControl2

December 15, 2014, 1:02 am

≫ Next: SSID and AP Password for Peplink/Pepwave Wi-Fi Products

≪ Previous: What GNSS reporting protocols are supported on Peplink routers?

$

0

0

 

On December 31st, 2014, additional capacity will be added to InControl2. For administrators who manage their Peplink/Pepwave devices through a firewall, please update your list of IP addresses accordingly. Failure to do so means your devices may cease communication with InControl2 after this date.

Existing server IP addresses:
54.213.17.185
54.218.62.163

Additional server IP addresses:
54.201.63.99
54.69.133.25
54.174.153.41
54.174.232.241
54.169.188.216
54.169.190.249

Outgoing ports:
UDP port 5246 and
TCP port 443

SSID and AP Password for Peplink/Pepwave Wi-Fi Products

December 24, 2014, 1:26 am

≫ Next: What Is The Difference Between Hardware Revisions of Peplink Balance 1350?

≪ Previous: IP addresses to securely connect to InControl2

$

0

0

The default SSID is Peplink-last 4 digit of serial number or Pepwave-last 4 digit of serial number
E.g. Pepwave-4DSN

The default AP password is the last 8 digit of the LAN MAC.
E.g. If the LAN MAC of your device is 00-1A-DD-C1-E2-A0, the password is DDC1E2A0.

What Is The Difference Between Hardware Revisions of Peplink Balance 1350?

February 1, 2015, 11:44 pm

≫ Next: How to add additional IPs on a WAN

≪ Previous: SSID and AP Password for Peplink/Pepwave Wi-Fi Products

$

0

0

In early 2015, a new hardware revision of Peplink Balance 1350 is available.

Please refer to the following for the differences across revisions.

Hardware Revision	Date of Release	Enclosure
2nd	Early 2015
1st	Late 2010

 

Please note: Actual launch dates vary in different countries.

How to add additional IPs on a WAN

February 5, 2015, 1:53 pm

≫ Next: What Is The Difference Between Hardware Revisions of Peplink Balance 305?

≪ Previous: What Is The Difference Between Hardware Revisions of Peplink Balance 1350?

$

0

0

Sometimes your ISP will provide you with additional external public IPs that can be used for the routing of additional services internally.
To add additional IPs on a WAN port edit the WAN ports settings (Network -> Connection Settings) and fill in the additional IP’s in the ‘Additional Public IP Settings’ section. Click Save and Apply.

Now when you add a new service for Inbound Access (Network -> Inbound Access -> Services) in the ‘Inbound IP Address(es)’ Section you can select which of the available WAN IPs the service should be port forwarded through.

---

What Is The Difference Between Hardware Revisions of Peplink Balance 305?

February 5, 2015, 7:35 pm

≫ Next: Configuring IPSec to Cisco ASA 5505 v9.x Firewall using Pre-shared Key Authentication

≪ Previous: How to add additional IPs on a WAN

$

0

0

In early 2015, a new hardware revision of Peplink Balance 305 is available. Please refer to the following for the differences across revisions.

Hardware Revision	Date of Release	Enclosure
2nd	Early 2015
1st	2013

Please note: Actual launch dates vary in different countries.

Configuring IPSec to Cisco ASA 5505 v9.x Firewall using Pre-shared Key Authentication

November 13, 2014, 5:36 am

≫ Next: SIM Card Size Comparison

≪ Previous: What Is The Difference Between Hardware Revisions of Peplink Balance 305?

$

0

0

This guide covers configuring an IPsec VPN  between Peplink and Cisco ASA firewall. The example assumes the following settings:

IPSEC Network Simulation Diagram

IPsec VPN Settings

Peplink WAN1 IP Address	210.211.10.1/29
Peplink LAN Network	192.168.30.0/24
Peplink LAN IP Address	192.168.30.1/24
Cisco ASA WAN IP Address	66.80.3.1/29
Cisco ASA LAN Network	10.1.1.0/24
Cisco ASA LAN IP Address	10.1.1.1/24
Mode	Main
Pre Shared Key	password123
IPsec Phase 1 Authentication	SHA-1
IPsec Phase 1 Encryption	AES-256
IPsec Phase 1 DH Group	5
IPsec Phase 1 SA Lifetime	3600
IPsec Phase 2 Authentication	SHA-1
IPsec Phase 2 Encryption	AES-256
IPsec Phase 2 PFS Group	5
IPsec Phase 2 SA Lifetime	28800

Cisco ASA Configuration

The following example configuration is based on Cisco ASA version 9.2 and implements the example settings above:

//Assign ethernet 0/0 to VLAN 2, which will be the “WAN” side
ciscoasa(config)# interface ethernet 0/0
ciscoasa(config-if)# switchport access vlan 2
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
//Enable ethernet 0/1 and 0/2 which will be the “LAN” side
ciscoasa(config)# interface ethernet 0/1
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
ciscoasa(config)# interface ethernet 0/2
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
//Configure “LAN” – VLAN 1
ciscoasa(config)# interface vlan 1
ciscoasa(config-if)# ip address 10.1.1.1 255.255.255.0
ciscoasa(config-if)# nameif inside
INFO: Security level for “inside” set to 100 by default.
ciscoasa(config-if)# exit
//Configure “WAN” – VLAN 2
ciscoasa(config)# interface vlan 2
ciscoasa(config-if)# nameif outside
INFO: Security level for “outside” set to 0 by default.
ciscoasa(config-if)# ip address 66.80.3.1 255.255.255.248
ciscoasa(config-if)# exit
//IPsec phase 1 configuration (IKEv1)
ciscoasa(config)# crypto ikev1 policy 1
ciscoasa(config-ikev1-policy)# authentication pre-share
ciscoasa(config-ikev1-policy)# encryption aes-256
ciscoasa(config-ikev1-policy)# hash sha
ciscoasa(config-ikev1-policy)# group 5
ciscoasa(config-ikev1-policy)# lifetime 3600
ciscoasa(config-ikev1-policy)# exit
ciscoasa(config)# crypto ikev1 enable outside
//Define transform-set using AES-256 and SHA-1
ciscoasa(config)# crypto ipsec ikev1 transform-set aesset esp-aes-256 esp-sha-hmac
//Define access-list for local and remote network
ciscoasa(config)# access-list ipsec_access_list extended permit ip 10.1.1.0 255.255.255.0 192.168.30.0 255.255.255.0
//Define tunnel-group for LAN to LAN IPsec VPN connection
ciscoasa(config)# tunnel-group 210.211.10.1 type ipsec-l2l
ciscoasa(config)# tunnel-group 210.211.10.1 ipsec-attributes
ciscoasa(config-tunnel-ipsec)# ikev1 pre-shared-key password123
ciscoasa(config-tunnel-ipsec)# exit
//IPsec phase 2 configuration
ciscoasa(config)# crypto map ipsecmap 1 match address ipsec_access_list
ciscoasa(config)# crypto map ipsecmap 1 set peer 210.211.10.1
ciscoasa(config)# crypto map ipsecmap 1 set ikev1 transform-set aesset
ciscoasa(config)# crypto map ipsecmap 1 set pfs group5
ciscoasa(config)# crypto map ipsecmap 1 set security-association lifetime seconds 28800
ciscoasa(config)# crypto map ipsecmap interface outside
//Save config
ciscoasa(config)# write memory
Building configuration…
Cryptochecksum: 29fbce0d 2e1cbc86 b0805086 5b7be06c

4070 bytes copied in 1.260 secs (4070 bytes/sec)
[OK]
ciscoasa(config)# exit

Peplink Router Configuration

SIM Card Size Comparison

November 27, 2014, 5:34 am

≫ Next: What Is The Difference Between Hardware Revisions of Peplink Balance 580?

≪ Previous: Configuring IPSec to Cisco ASA 5505 v9.x Firewall using Pre-shared Key Authentication

$

0

0

(Source: Wikipedia)

What Is The Difference Between Hardware Revisions of Peplink Balance 580?

February 12, 2015, 5:33 am

≫ Next: How to Set Up Social Wi-Fi

≪ Previous: SIM Card Size Comparison

$

0

0

In mid 2014, a new hardware revision of Peplink Balance 580 was released.

Please refer to the following for the differences across revisions.

Hardware Revision	Date of Release	Enclosure
2nd	Fall 2014
1st	2008

 

How to Set Up Social Wi-Fi

May 14, 2015, 12:50 am

≫ Next: Latest Balance Hardware Revision

≪ Previous: What Is The Difference Between Hardware Revisions of Peplink Balance 580?

$

0

0

Requirements:

To set up a Social Wi-Fi Hotspot, you will need the following items:

• An InControl 2 account.
• A Facebook homepage.
• A supported device running Firmware 6.2.1 or above.

Supported devices:

Peplink devices that have built-in Wi-Fi AP capability can deliver Social Wi-Fi, including:

• Balance: One
• MAX: 700, OTG, BR1*, BR2, HD2*, HD4
• MediaFast: HD2, HD4
• AP One: AP One, Mini, AC Mini, 300M, In-Wall, Flex 300M
• AP Pro: AP Pro, 300M, Duo

*With the exception of the BR1 ENT, and the HD2 Mini

Instructions

1) Set up your devices

Make sure you are running Firmware 6.2.1. or AP Firmware 3.5.2. You can find your Firmware status and update your Firmware on System > Firmware.

If you have disabled InControl 2 management, please re-enable it. For MAX devices, you can find the settings on System > InControl. For Pepwave APs, you can find the settings on System > Controller. Click the “Controller Management” checkbox to enable InControl management.

2) Setting up your Facebook Wi-Fi on IC2

On your organization dashboard, click on the group you will use. Navigate to Wi-Fi AP > Group-wide SSID Settings. Click “Add New SSID”, and the following menu will appear:

After naming your SSID (in this example, we have named it “Login with Facebook”), Scroll down to Captive Portal Settings, click the “Captive Portal” checkbox. Click the “Social” tab, then Enable. For your Facebook Page ID, enter your company’s Facebook Page (in this example, the Facebook ID is “Pepmall”) .

The last part of your facebook page URL is your Facebook Page ID. If a number string appears at the end of the URL, that will also work. Either way, Copy it and return to InControl.

Enter your Facebook Page ID or number string into the “Facebook Page ID” text field, setup any usage limitations if needed, and press the Save Changes button to finish your configuration.