NetEngine AR600, AR6100, AR6200, and AR6300 V300R019 CLI-based Configuration Guide - VPN
Using IPSec VPN to Implement Secure Interconnection Between LANs
The headquarters and branches of an enterprise are interconnected in various ways.
Site-to-Site VPN — IPSec
A site-to-site VPN, also called a LAN-to-LAN VPN or a gateway-to-gateway VPN, is used to set up an IPSec tunnel between two gateways, implementing secure access of LANs. Figure 5-21 shows a typical site-to-site IPSec VPN network.
This network requires that two gateways on both ends of the tunnel have fixed IP addresses or fixed domain names, and both parties be able to initiate a connection.
A Router can serve as both an IPSec gateway and a NAT gateway.
When a NAT device exists between two IPSec gateways, Routers support IPSec NAT traversal.
Site-to-Site VPN — L2TP over IPSec
L2TP over IPSec encapsulates packets using L2TP before transmitting them using IPSec. L2TP and IPSec are used together to allow branches to securely access VPNs by dialing the LAC. Branches use L2TP to dial the LAC and obtain private IP addresses on the headquarters network. IPSec is used to ensure communication security during this process.
Figure 5-22 shows a network for the branch to access the headquarters through an L2TP over IPSec tunnel. The outbound interfaces of the LAC (Router_A) and L2TP network server (LNS) (Router_B) have fixed IP addresses. A user in the branch dials Router_A through PPPoE. Router_A then initiates a tunnel setup request to Router_B over the Internet. An L2TP over IPSec is set up between Router_A and Router_B. Then Router_A authenticates the user, and Router_B can also authenticate the user again after the user is successfully authenticated by Router_A. After the user is successfully authenticated by Router_B, Router_B assigns a private IP address to the user.
Site-to-Site VPN — GRE over IPSec
Generic Routing Encapsulation (GRE) is a generic tunneling protocol that encapsulates multicast, broadcast, and non-IP packets. GRE, however, provides only simple password authentication but not data encryption, and therefore cannot ensure data transmission security. IPSec provides high data transmission security but cannot encapsulate multicast, broadcast, or non-IP packets. Leveraging advantages of GRE and IPSec, GRE over IPSec encapsulates multicast, broadcast, and non-IP packets into common IP packets. For example, to hold a video conference between a branch and the headquarters, use GRE over IPSec to transmit service traffic on an IPSec VPN.
Figure 5-23 shows a typical GRE over IPSec VPN network.
GRE over IPSec supports the transport and tunnel encapsulation modes. Compared to the transport mode, the tunnel mode adds an extra IPSec header, which makes the packet longer and more likely to be fragmented. Therefore, GRE over IPSec in transport mode is recommended.
Site-to-Multisite (Hub-Spoke VPN)
In most cases, the headquarters of an enterprise are connected to multiple branches through IPSec VPN tunnels. Figure 5-24 shows a typical hub-spoke IPSec VPN network.
Branches do not need to communicate with each other.
Deploy IPSec VPN between the headquarters and branches.
Branches need to communicate with each other.
If branches access the Internet using dynamic public IP addresses, traditional IPSec VPN will cause branches to fail to directly communicate with each other. Communication data between branches has to be forwarded through the headquarters. This consumes the CPU and memory resources of the hub (Router_C). In addition, the headquarters must encapsulate and decapsulate traffic between branches, causing additional network delay.
To resolve this problem, deploy Dynamic Smart VPN (DSVPN) to set up VPN tunnels between branches using dynamic IP addresses. However, multipoint GRE (mGRE) tunnels do not have the encryption function and cannot ensure communication security. To achieve communication security, bind DSVPN with the IPSec security framework, that is, deploy DSVPN over IPSec. For details about DSVPN over IPSec, see DSVPN Protected by IPSec.