Siemens SCALANCE W1750D UI, Configuration Manual

Page: 329 / 570

AP-VPN Deployment
20.1 Understanding AP-VPN Architecture
SCALANCE W1750D UI
Configuration Manual, 02/2018, C79000-G8976-C451-02
329
Local, L3 Mode
In this mode, the network address for traffic destined to the corporate network is translated at
the source with the inner IP of the IPsec tunnel and is forwarded through the IPsec tunnel.
The traffic destined to the non- corporate network is routed.
Distributed, L2 Mode
In this mode, the AP assigns an IP address from the configured subnet and forwards traffic
to both corporate and non-corporate destinations. Clients receive the corporate IP with VC
as the DHCP server. The default gateway for the client still resides in the datacenter and
hence this mode is an L2 extension of corporate VLAN to remote site. Either the controller or
an upstream router can be the gateway for the clients. Client traffic destined to datacenter
resources is forwarded by the master AP (through the IPsec tunnel) to the client's default
gateway in the datacenter.
When an AP registers with the controller, the controller automatically adds the VPN tunnel
associated to this AP into the VLAN multicast table. This allows the clients connecting to the
L2 mode VLAN to be part of the same L2 broadcast domain on the controller.
Distributed, L3 Mode
The Distributed, L3 mode contains all broadcast and multicast traffic to a branch. The
Distributed, L3 mode reduces the cost and eliminates the complexity associated with the
classic site-to-site VPN. However, this mode is very similar to a classic site-to-site IPsec
VPN where two VPN endpoints connect individual networks together over a public network.
In Distributed, L3 mode, each branch location is assigned a dedicated subnet. The master
AP in the branch manages the dedicated subnet and acts as the DHCP server and gateway
for clients. Client traffic destined to datacenter resources is routed to the controller through
the IPsec tunnel, which then routes the traffic to the appropriate corporate destinations.
When an AP registers with the controller, the controller adds a route to enable the routing of
traffic from the corporate network to clients on this subnet in the branch.
Centralized, L2 Mode
The Centralized, L2 mode extends the corporate VLAN or broadcast domain to remote
branches. The DHCP server and the gateway for the clients reside in the datacenter. Either
the controller or an upstream router can be the gateway for the clients. For DHCP services in
Centralized, L2 mode, Siemens recommends using an external DHCP server and not the
DHCP server on the controller. Client traffic destined to datacenter resources is forwarded by
the master AP (through the IPsec tunnel) to the client's default gateway in the datacenter.
Centralized, L3 Mode
For Centralized, L3 clients, the VC acts as a DHCP relay agent that forwards the DHCP
traffic to the DHCP server located behind the controller in the corporate network and
reachable through the IPsec tunnel. The Centralized, L3 VLAN IP is used as the source IP.
The IP address is obtained from the DHCP server.