Configuring Ospf Over Site-To-Central Site In Network Extension Mode - Enterasys Security Router X-PeditionTM User Manual

VPN Applications
Client
• Fast/GigabitEthernet 1 interface: This is private, non-routable segment, usually 192.168.1.0/24.
OSPF must be disabled on F1. If OSPF is enabled on this interface it will be advertised to the
server. The server's IP routing table will learn a route to this segment via the VPN interface
connected to the client. But it is unreachable because NAT is enabled. Be aware that if two
clients advertise the same private segment, e.g., 192.168.1.0/24, the server will learn two
routes, which seem to be the same destination, but in fact are not.
• Fast/GigabitEthernet 2 interface: OSPF should be disabled here for the same reason it is disabled
on the server.
• VPN 1 interface: OSPF must be enabled on this interface to receive updates from the server.
If other clients connecting to the VPN 1 interface on the server do not have OSPF coverage (i.e.,
Windows remote access clients), OSPF ignores them and continues exchanging information with
those clients that support OSPF.
On the client, a tunnel associated with interface VPN 1 is created by means of the XSR's EZ-IPsec
functionality. EZ-IPsec automatically inserts SPDs on Fast/GigabitEthernet interface 2 which
specify that only traffic from and to the IP address assigned by the server should be encrypted.
There is no conflict between SPDs and OSPF routing on this connection.
The commands to configure this scenario are illustrated on

Configuring OSPF over Site-to-Central Site in Network Extension Mode

Compared to Client Mode, Network Extension Mode is more flexible at the cost of a more
sophisticated configuration. As shown in
client site. The trusted network behind the client is a fully routable segment and may be reached
from the corporate network.
Segment is extension of corporate net
14-16 Configuring the Virtual Private Network
Figure 14-9
VPN tunnel
F2
VPN 1
Client
F1
Figure 14-9, NAT is not used on the VPN interface at the
Site-to-Site Network Mode Topology
Corporate network
INTERNET
Point-to-point interface.
This endpoint's IP address
is assigned by the server.
The other tunnel endpoint's
IP address is configured on
the server's VPN interface.
(page 14-36).
F1
VPN 1
Server
F2
Point-to-multipoint interface.
Terminates tunnels
To another client