Siemens SCALANCE W1750D UI Configuration Manual page 328

AP-VPN Deployment
20.1 Understanding AP-VPN Architecture
● L3 mode and NAT mode users—The number of trusted users supported on the controller.
There is no scale impact on the controller. They are limited only by the number of clients
supported per AP.
● L2 mode users—The number of L2 mode users are limited to 128,000 for 7220 or 7240
Controllers and 64,000 across all platforms.
AP-VPN Forwarding Modes
The forwarding modes determine whether the DHCP server and default gateway for clients
reside in the branch or at the datacenter. These modes do not determine the firewall
processing or traffic forwarding functionality. The VC enables different DHCP pools (various
assignment modes) in addition to allocating IP subnets for each branch.
The VC allows different modes of forwarding traffic from the clients on a VLAN based on the
DHCP scope configured on the AP.
For the AP-VPN deployments, the following forwarding modes are supported:
● Local mode
● L2 Switching mode
● L3 routing mode
The DHCP scopes associated with these forwarding modes are described in the following
sections.
Note
Ensure that VLAN 1 is not configured for any of the DHCP scopes as it is reserved for a
different purpose.
Local Mode
n this mode, the AP cluster at that branch has a local subnet and the master AP of the
cluster acts as the DHCP server and gateway for clients. The local mode provides access to
the corporate network using the inner IP of the IPsec tunnel. The network address for traffic
destined to the corporate network is translated at the source with the inner IP of the IPsec
tunnel and is forwarded through the IPsec tunnel. The traffic destined to the non-corporate
network is translated using the IP address of the AP and is forwarded through the uplink.
Note
When the local mode is used for forwarding client traffic, hosts on the corporate network
cannot establish connections to the clients on the AP, because the source addresses of the
clients are translated.
Local, L2 Mode
In this mode, the AP cluster at that branch has a local subnet and the master AP of the
cluster acts as the DHCP server. The default gateway is located outside the AP and the
network address for the client traffic is not translated at source. In the Local, L2 mode,
access to the corporate network is supported only in a single AP cluster. The traffic to the
non-corporate network is locally bridged.
328
Configuration Manual, 02/2018, C79000-G8976-C451-02
SCALANCE W1750D UI