No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Configuration Guide - VPN

S1720, S2700, S5700, and S6720 V200R010C00

This document describes the VPN configuration procedures and provides configuration examples.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Basic Networking

Basic Networking

Intranet VPN

In an intranet VPN, all users in the VPN transmit packets to each other, but cannot communicate with users outside the VPN. Sites within an intranet VPN usually belong to the same organization.

In intranet VPN networking, each VPN is allocated a VPN target as the export target and import target. The VPN target of a VPN cannot be used by other VPNs.

Figure 3-9 shows an example of Intranet VPN networking.

Figure 3-9  Intranet VPN networking

In Figure 3-9, PE devices allocate the VPN target 100:1 to VPN1 and the target 200:1 to VPN2. Two sites in the same VPN communicate with each other, but sites in different VPNs do not.

Extranet VPN

Extranet networking can be used if users in a VPN need to access sites of another VPN.

In extranet networking, if a VPN needs to access a shared site, its export target must be included in the import target of the VPN instance covering the shared site, and its import target must be included in the export target of the VPN instance covering the shared site.

Figure 3-10 shows an example of extranet VPN networking.

Figure 3-10  Extranet VPN networking

In Figure 3-10, VPN1 and VPN2 can access Site3 of VPN1.

  • PE3 receives VPN-IPv4 routes advertised by PE1 and PE2.

  • PE1 and PE2 receive VPN-IPv4 routes advertised by PE3.

Site1 and Site3 of VPN1 as well as Site2 of VPN2 and Site3 of VPN1 communicate with each other.

PE3 does not advertise the VPN-IPv4 routes learned from PE1 to PE2 and does not advertise VPN-IPv4 routes learned from PE2 to PE1. Therefore, Site1 of VPN1 and Site2 of VPN2 cannot communicate with each other.

Hub and Spoke

If a central access control device needs to be deployed to control communication between VPN users, the Hub and Spoke networking can be used. The site with the access control device deployed is the Hub site, and other sites are Spoke sites. The following devices are used in Hub and Spoke networking:
  • Hub-CE: is deployed in the Hub site and connected to the VPN backbone network.
  • Spoke-CE: is deployed in a Spoke site and connected to the VPN backbone network.
  • Hub-PE: is deployed on the VPN backbone network and connected to the Hub site.
  • Spoke-PE: is deployed on the VPN backbone network and connected to a Spoke site.

A Spoke site advertises routes to the Hub site, and then the Hub site advertises the routes to other Spoke sites. Spoke sites do not advertise routes to each other. The Hub site controls communication between all Spoke sites.

Figure 3-11 shows an example of Hub and Spoke networking.
Figure 3-11  Hub and Spoke networking

In Figure 3-11, two VPN targets are configured to represent Hub and Spoke networking. The Hub site controls communication between Spoke sites. Arrows show the advertising process of a route from Site2 to Site1:

  • The Hub-PE device receives VPN-IPv4 routes advertised by all the Spoke-PE devices.

  • All the Spoke-PE devices can receive VPN-IPv4 routes advertised by the Hub-PE.

  • The Hub-PE device advertises the routes learned from Spoke-PE devices to the Hub-CE device, and advertises the routes learned from the Hub-CE device to all the Spoke-PE devices. By doing this, the Spoke sites access each other through the Hub site.

  • The import target of any Spoke-PE device differs from the export targets of other Spoke-PE devices. Any two Spoke-PE devices do not directly advertise VPN-IPv4 routes to each other. Spoke sites cannot directly communicate with each other.

The VPN targets of a PE device must comply with the following rules:

  • The export target and import target of a Spoke-PE device are Spoke and Hub respectively. The import target of any Spoke-PE device must be different from the export target of any other Spoke-PE device.

  • A Hub-PE device requires two interfaces or sub-interfaces.

    • One interface or sub-interface receives routes from Spoke-PE devices. The import target of the VPN instance on the interface is Spoke.

    • The other interface or sub-interface advertises routes to Spoke-PE devices. The export target of the VPN instance on the interface is Hub.

Mutual Access Between Local VPNs

Mutual access between local VPNs can be used to implement data communication between different VPN sites connected to the same PE device.

This service requirement is implemented using the VPN targets to control the advertisement of VPN routing information between sites. Each VPN has its own VPN target. On the network shown as follows, the import and export targets of VPNA are 100:1, while the import and export targets of VPNB are 200:1. To enable mutual access between users in VPNA and VPNB, mutual access between local VPNs can be configured by adding import targets 200:1 and 100:1 to VPNA and VPNB, respectively.

NOTE:

If the server function (for example, the FTP or DHCP server) is deployed on the PE device to provide services for VPNA users, the PE device can also provide server services for other mutual access VPN users.

Figure 3-12  Mutual access between local VPNs

Translation
Download
Updated: 2019-08-21

Document ID: EDOC1000141944

Views: 103958

Downloads: 576

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next