Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 616 / 1016

Configuring Topology
In the general configuration area, you can define the topology and/or termination points
of the VPN:
•
The topology of the VPN determines how VPN members logically connect to each
other. The topology is the communication path that VPN traffic must take to reach a
VPN member.
•
The termination points of the VPN determine how VPN members physically connect
to each other. A termination point is the interface on each VPN member that sends
and receives VPN traffic to and from the VPN tunnel.
NOTE: If you change the security device that protects a resource, NSM removes the
previous security device from all affected VPNs and adds the new security device.
However, NSM does not configure the VPN topology for the new security device—you
must reconfigure the topology to include the new device manually.
For AutoKey IKE VPNs, you must define the topology for the VPN. Each VPN member is
a node that has specific connection capabilities, and the topology describes the logical
connections between those nodes.
A node can be:
• Hub—A hub can connect to a branch or main.
• Main—A main can connect to a hub, branch, or another main. When configuring a VPN
that uses multiple mains, you can select to mesh all mains (all mains can communicate
with each other) or disable all main meshing.
• Branch—A branch can connect to a hub or a main. Branches can send and receive VPN
traffic to and from a hub or a main device, but cannot communicate directly with other
branches unless in a dual hub setup.
Additionally, you can use a supernet to reduce the number of rules required for the hub
device in a policy-based VPN. A supernet is an address object group containing the
network address objects that represent the source and destination points of the VPN.
Use a supernet when the hub device supports a small number of rules.
Configuring Common VPN Topologies
You can use VPN Manager to configure the following common VPN topologies:
• Hub and Spoke—Select a device to act as the hub; this device connects VPN members
and enables them to communicate. Next, select the VPN members to be the spokes.
You are not required to use a VPN member as a hub:
•
If do not select a VPN member as the VPN hub, the hub routes VPN traffic from one
branch to another.
• If you do select a VPN member as the VPN hub, the hub routes VPN traffic from itself
and all connected branches.
Copyright © 2010, Juniper Networks, Inc. 566
Network and Security Manager Administration Guide