Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual page 625

Copyright © 2010, Juniper Networks, Inc.
If do not select a VPN member as the VPN hub, the hub routes VPN traffic from one
branch to another.
If you do select a VPN member as the VPN hub, the hub routes VPN traffic from itself
and all connected branches.
Each spoke can send and receive VPN traffic to and from the hub, but cannot
communicate directly with other spokes.
Dual Hub and Spoke—You can select a device to act as a backup hub, and enable the
spokes to communicate with each other by making the following settings.
Assign a VPN and gateway. Edit the Topology settings from
>AutoKey IKE VPN >, New or Edit >Topology.
can assign the device to be used as backup, from the drop-down list in the
field. After selection, the backup hub is added to the General Configuration list.
Hub
Edit the vrouter on the spoke device, and assign the ACVPN-Dynamic and NHS IP
Address. You can set these parameters from
VPN > VPN >Device Tunnel Summary >Edit Router >Dynamic Routing Protocol> NHRP
>Parameters . You cannot make this setting on a hub device. The ACVPN-Dynamic
and the ACVPN-Profile settings are mutually exclusive, so if a device is already set
as a Hub, then you cannot set it as a Spoke or vice versa.
Assign NHRP redistribution rules. You can make this setting from the
>VPNs >AutoKey IKE VPN >VPN >Device Tunnel Summary >Edit Router >Dynamic
Routing Protocol >NHRP >Redistribution Rules.
Add the NHRP option to the OSPF, BGP, and RIP redistribution rules. You can make
these settings from:
VPN Manager > VPNs > AutoKey IKE VPN > VPN > Device Tunnel Summary > Edit
Router > Dynamic Routing Protocol > OSPF > Redistribution Rules.
VPN Manager > VPNs > AutoKey IKE VPN > VPN > Device Tunnel Summary > Edit
Router > Dynamic Routing Protocol >BGP > Redistribution Rules.
VPN Manager > VPNs > AutoKey IKE VPN > VPN > Device Tunnel Summary > Edit
Router > Dynamic Routing Protocol > RIP > Redistribution Rules.
Set the routing on the tunnel interface from "
>VPN > Device Tunnel Summary > Edit Interface > General Properties.
to ACVPN-Dynamic.
NOTE: You can enable the dual hub feature only if the Spoke device runs
ScreenOS 6.3 or later. The Hub device could run ScreenOS 6.3 or an older
version.
Main and Branch—Main and branch topologies combine the flexibility of hub and spoke
with the redundancy of full mesh. Because you can select multiple mains, each branch
has an alternate tunnel to use if one main fails. To create a main and branch:
Chapter 12: Configuring VPNs
VPN Manager >VPNs
Select Enable Auto-Connect VPN
VPN Manager > VPNs > AutoKey IKE
VPN Manager
VPN Manager >VPNs >AutoKey IKE VPN
Select
You
Backup
Routing
575