334
Figure 142 Hub-group ADVPN
How ADVPN operates
The VAM server must have a static public address. VAM clients have both a public address and a
private address. The public address is the address of the interface connected to the public network.
It can be manually configured or dynamically assigned. The private address is the address of the
ADVPN tunnel interface. It must be manually configured. All the private addresses of clients in an
ADVPN domain must belong to the same network segment.
ADVPN includes the following phases:
• Connection initialization.
• Registration.
• Tunnel establishment.
• Route learning and packet forwarding.
Connection initialization
As shown in Figure 143, a client and a server perform the following operations to initialize a
connection:
1. The client sends encryption and authentication algorithms to the server in a connection request.
2. The server compares the algorithm list of the client to its own algorithm list in priority order.
3. The server sends the matching algorithms to the client.
If no match is found, the negotiation fails.
4. The server and the client generate encryption and authentication keys based on the pre-shared
key.
If authentication and encryption are not needed, they do not generate keys.
Hub3
Hub1
Group 1
Group 2
Group 0
Spoke1
Spoke4
Hub2
Tunnel 1
Tunnel 1
Tunnel 1
Tunnel 1
Tunnel 1
Tunnel 1
Spoke2
Spoke3
Tunnel 1
Tunnel 2
Tunnel 2
Tunnel 2
Site 1
Site 2 Site 3 Site 4
Site 5
Site 6
VAM server
Spoke-to-Spoke dynamic tunnel
between two groups
Hub-to-Hub static tunnel
Hub-to-Spoke static tunnel
Spoke-to-Spoke dynamic
tunnel in one group
To Next Page
Loading...
Need help?
General
