Hub And Spoke; Full Mesh - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Copyright © 2010, Juniper Networks, Inc.
Advantages—Simple, easy to configure.
Disadvantages—The central security device is a single point of failure.
Use a site-to-site VPN to connect remote networks to a single, central network
inexpensively.

Hub and Spoke

In a hub and spoke VPN, multiple security devices (spokes) communicate through a
central device (the hub).
Advantages—Can connect several devices and users. Hub and spoke VPNs are easy
to maintain because you only need to reconfigure the spoke and the hub device, which
save you administration and resource costs. If you have smaller security devices with
limited tunnel capacity, you can use hub and spoke VPNs to increase the number of
available tunnels.
Disadvantages—The hub is a single point of failure; however, you can use NSRP for
redundancy.
A hub acts as a concentrator for the other VPN members, but does not necessarily have
resources that are available to other members. In fact, you can specify a security device
that is not a VPN member to act as the hub: If you include the hub in the VPN, the hub
device can send and receive traffic from all spokes; if you do not include the hub, the hub
device routes traffic between spokes.
Use a hub and spoke topology when you want to route VPN traffic through a VPN member
that does not contain protected resources.
Dual Hubs and Spokes
In VPNs running ScreenOS 6.3 and later, you can use Next Hop Resolution Protocol
(NHRP) combined with IPSEC, to establish secure tunnels dynamically between spokes,
achieving a scalable and easy-to-use VPN solution for distributed enterprises. You can
configure a permanent static tunnel between dual hubs, while dynamic tunnels are set
up and configured between spokes through the NHRP protocol, whenever the need arises.
In order to set up this system, the hub can be a device running ScreenOS 6.3 or earlier,
but the spokes must be ScreenOS 6.3 or later devices.

Full Mesh

In a full mesh VPN, all VPN member can communicate with all other VPN members.
Advantages—Because a full mesh configuration uses redundant IPSec tunnels, traffic
continues to flow even if a node fails.
Disadvantages—When you add a member to the VPN, you must reconfigure all devices.
Use a full mesh VPN when you need to ensure that every VPN member can communicate
with every other VPN member.
Chapter 12: Configuring VPNs
555