Hub-and-spoke IPSEC VPN Configuration

Source: Internet
Author: User
Tags firewall

The 1,ipsec VPN application is more and more extensive, the following configuration instance is to the single headquarters multiple branch organization actual application

According to the configuration of this article, we can achieve the maximum VPN connectivity through the minimum number of VPN tunnels, the network topology is as follows:

As shown above, the Headquarters firewall machine hub firewall name is fortigate_1, its external network port IP address is: 172.16.10.1, the Headquarters intranet has 2 different department subnets respectively is the finance subnet (Finance network), The address is: 192.168.12.0/24 Human resource subnet (HR network), address is: 192.168.22.0/24;

There are 2 branches, one of the branches of the firewall name is called Spoke_1, its external network port IP address is: 172.16.20.1, intranet address is: 192.168.33.0/24; another branch office firewall name is Spoke_ 2, its external network port IP address is: 172.16.30.1, intranet address is: 192.168.44.0/24.

As this article is configured, we can eventually use a total of 2 VPN implementations with 2 different VPN schemes to achieve the mutual access requirements of 3 to 4 protected subnets.

2, policy-based VPN (channel mode)

Typically, the IPSec VPN gateway implements patterns that are based on a protected and protected subnet, which is a model of VPN policy, also known as policy-based VPN mode, described in detail below.

2. 1 Configuration Fortigate_1

2. 1. 1 Configuring IPSec VPN Phase One

Login to Fortigate_1 Web interface, enter virtual private network----IPSEC----automatically exchange key (IKE), new stage One,

Name: Spoke_1

Remote gateway: Static IP Address

IP Address: 172.16.20.1

Local interface: Wan1

Mode: Main Mode

Authentication mode: Pre-shared key

Pre-shared secret key: 123456

Click the Advanced option, remove the "Start IPSec interface mode" Before the tick, the other configuration using the default settings, the specific configuration as shown in the following figure:

Use the same method to configure another VPN to spoke_2, as follows:

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.