Configuring Dsvpn; Establishing The Configuration Task - Huawei AR1200 series Configuration Manual

Huawei AR1200 Series Enterprise Routers
Configuration Guide - VPN

6.3 Configuring DSVPN

When Dynamic Smart VPN (DSVPN) is configured, IPSec does not need to be configured. If
IPSec is configured to protect GRE traffic, the remote IP address in an NHRP mapping entry
needs to be advertised to the local device to establish an IPSec tunnel.

6.3.1 Establishing the Configuration Task

Before configuring DSVPN, familiarize yourself with the applicable environment, complete the
pre-configuration tasks, and obtain the data required for configuration. This will help you
complete the configuration task quickly and accurately.
Applicable Environment
In the traditional hub-spoke model, data traffic concentrates at branches and the central office.
If data traffic is transmitted between two branches, to implement IPSec, the central office needs
to decrypt data on the tunnel of the sending branch and encrypt the data on the tunnel of the
receiving branch. Traffic between the two branches needs to pass through the central office,
wasting resources of the central office and causing a delay in traffic forwarding. To solve this
problem, the DSVPN technology is used to enable the two branches to dynamically establish a
data forwarding tunnel.
Pre-configuration Tasks
Before configuring DSVPN, complete the following task:
l
Data Preparation
To configure DSVPN, you need the following data.
No.
1
2
3
Issue 01 (2012-04-20)
NOTE
The DSVPN function is used with a license. To use the DSVPN function, apply for and purchase the
following license from the Huawei local office:
l AR1200 Value-Added Security Package
l AR1200 DSVPN (Dynamic Smart VPN) Function
Setting link layer parameters and IP addresses for interfaces so that the network layer
protocol of the interfaces is Up
Data
Numbers, IP addresses, source IP addresses (or source interfaces) of tunnel
interfaces
NHRP authentication string, NHRP registration interval, and NHRP entry holding
time
(Optional) IPSec profile, IKE peer, and IKE proposal
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
6 DSVPN Configuration
346