EMAIL SUPPORT

dclessons@dclessons.com

LOCATION

NZ

Configure Strict Hub and Spoke Topology

Configure Strict Hub and Spoke Topology

Posted on Jan 27, 2020 (0)

Configure Strict Hub and Spoke Topology

Task: Configure the Topology to work like Strict Hub and Spoke based network where there are three Subnet for each VPN.

  • VPN 10: Corp-VPN
  • VPN 20: Sec-PCIVPN
  • VPN 40: Guest-VPN

Topology should work like follows:

  • For all VPN 10 : All Branch VPN 10 traffic must go to DC and then to Branch and VPN 10 traffic must not go Branch to Branch , All DC must send a default route to each branch for outside traffic.
  • For VPN 20: Each Branch must have VPN 20 routes for other branch having Next HOP: DC-TLOC
  • For VPN 40: No direct communication between branch to branch to any VPN, This VPN should have default route to access Internet only

Topology:

Solution:

For VPN 10 : Advertise branches routes to DC and not to another branch , DC will advertise default route to each branch so that if branch wants to talk to another branch , branch will send the traffic to DC by default route and DC will then route traffic back to remote branch 

For VPN 20 : Branch will advertise VPN 20 routes to vSmart and in return vSmart will advertise those VPN 20 routes by setting Next hop as DC-TLOC , so in branch to branch communication via VPN 20 , Branch will send traffic to DC and DC will route it to branch. 

For VPN 40 : No communication between branch , so restrict routes exchange between them ,and advertise only default routes in VPN 40 for direct internet access.

Before configuring Hub and spoke topology, let’s verify that all the branches are able to reach to other branches directly over VPN 10 and VPN 20 over IPSEC tunnel.

vManage | Monitor | Network | Select BR2-VEDGE1 | Tunnel

This will show that the BR2-VEDGE has full Mesh IPSEC tunnel to all other branches and DC sites.

Select Troubleshooting | PING | under connectivity Section

Select destination IP: 10.3.0.21 (Branch 1), VPN 10 and Source Interface in VPN 10 | Start



So same activity for VPN 20

For VPN 10 Select | trace Route | destination IP 10.4.0.21 | VPN 10 | Select Source Interface | Start

Now Create Application or Groups of interest for all components like DC, Sites, DC-TLOC, Data-Prefix Group.

vManage | Configuration | Policies | centralized Policy | Add Policy


Comment

    You are will be the first.

LEAVE A COMMENT

Please login here to comment.