Networking Requirements
A large-sized enterprise has the headquarters (Hub) and multiple branches (Spoke1, Spoke2, and other Spokes) located in different areas, and the branches connect to public networks using dynamic IP addresses. This example uses two branches. The Hub is a Cisco router, and Spoke1 and Spoke2 are AR routers.
The enterprise requires that VPN connections between branches should be achieved and data transmitted between the headquarters and a branch, and between branches should be encrypted.
Figure1 Networking for establishing DSVPN over IPSec tunnels between AR routers and Cisco router
Data Plan
Before the configuration, plan data according to Table Data plan for interconnection between the AR and Cisco router. The data in Table Data plan for interconnection between the AR and Cisco router is used for reference only.
Spoke1 Public Network Address | 1.1.2.10 |
Spoke1 Tunnel Interface Address | 10.2.1.2 |
Spoke1 Private Network Address | 10.1.1.1 |
Spoke2 Public Network Address | 1.1.3.10 |
Spoke2 Tunnel Interface Address | 10.2.1.3 |
Spoke2 Private Network Address | 10.1.2.1 |
Cisco Public Network Address | 1.1.1.10 |
Cisco Tunnel Interface Address | 10.2.1.1 |
Cisco Private Network Address | 10.1.0.1 |
NHRP Parameters | DSVPN domain: 1000 NHRP authentication key: huawei12 NHRP branch registration interval: 1800s NHRP headquarters hold time: 3600s |
Parameters for IPSec Phase 1 (IKE Negotiation Phase) | IKE version: v1 Negotiation mode: main Authentication method: pre-shared key Pre-shared key: huawei@123 Encryption algorithm: aes-cbc-128 Authentication algorithm: sha1 DH group: group5 Lifetime: 28800s DPD detection: enabled |
Parameters for IPSec Phase 2 (IPSec Negotiation Phase) | Security protocol: ESP Encapsulation mode: transport Encryption algorithm: aes-128 Authentication algorithm:sha1 Lifetime: 3600s (default value) PFS: enabled |
