337
the destination address. If the route to the remote private network is learned by using both methods,
the route with a lower preference is used.
NAT traversal
An ADVPN tunnel can traverse a NAT gateway.
• If only the tunnel initiator resides behind a NAT gateway, a spoke-spoke tunnel can be
established through the NAT gateway.
• If the tunnel receiver resides behind a NAT gateway, packets must be forwarded by a hub
before the receiver originates a tunnel establishment request. If the NAT gateway uses
Endpoint-Independent Mapping, a spoke-spoke tunnel can be established through the NAT
gateway.
• If both ends reside behind a NAT gateway, no tunnel can be established and packets between
them must be forwarded by a hub.
ADVPN configuration task list
Configure ADVPN in the order of VAM servers, hubs, and spokes.
Perform the following tasks to configure ADVPN:
Tasks at a glance
(Optional.) Configuring AAA
(Required.) Configuring the VAM server
(Required.) Configuring the VAM client
(Required.) Configuring an ADVPN tunnel interface
(Required.) Configuring routing
(Optional.) Configuring IPsec for ADVPN tunnels
Configuring AAA
The VAM server can use AAA to authenticate clients. Clients passing AAA authentication can access
the ADVPN domain. For information about AAA configuration, see Security Configuration Guide.
Configuring the VAM server
Task
(Required.) Creating an ADVPN domain
(Required.) Enabling the VAM server
(Required.) Configuring a pre-shared key for the VAM server
(Required.) Configuring hub groups
(Optional.) Configuring the port number of the VAM server
(Optional.) Specifying authentication and encryption algorithms for the VAM server
(Optional.) Configuring an authentication method
To Next Page
Need help?
General
