Web: Example for Configuring DSVPN in a Shortcut Scenario (OSPF)

Procedure

1. Set IP addresses for FW interfaces and assign the interfaces to security zones.

   In this example, IP addresses are configured for Hub interfaces, and assign the interfaces to security zones. The public interface IP addresses of Spoke1 and Spoke2 are dynamically obtained using DHCP. In this example, the public interface IP addresses of Spoke1 and Spoke2 are 1.1.2.10/24 and 1.1.3.10/24 respectively.

   1. Choose Network > Interface. Click of GE 1/0/0. Set parameters as follows and click OK.

      Zone	untrust
      IPv4
      IP Address	1.1.1.10/24

   2. Click Add. Set parameters as follows and click OK.

      Interface Name	LoopBack0
      Type	Loopback Interface
      IPv4
      IP Address	192.168.0.1/24

2. Configure a public route on each device.

   Choose Network > Route > Static Route. Click Add. Set parameters as follows and click OK.

   Destination Address/Mask	0.0.0.0/0.0.0.0
   Interface	GE0/0/0

3. Configure a security policy on each device.
   1. Choose Policy > Security Policy > Security Policy.
   2. Click Add. Select Add Security Policy. Configure interzone policies between user subnets based on parameters in the following table and click OK.

      In this example, loopback interfaces in the Local zone are used to simulate subnet users. Therefore, the interzone policy between the Local zone and security zone where the tunnel interface resides needs to be configured. Actually, the interzone policy between the security zones where subnets reside needs to be configured. For example, if the subnet of the enterprise resides in the Trust zone, configure the interzone policy between the Trust zone and security zone where the tunnel interface resides.

      Name	rule1
      Source Zone	untrust local
      Destination Zone	untrust local
      Source Address/Region	192.168.0.0/16
      Action	Permit

   3. Click Add. Select Add Security Policy. Configure interzone policies for public interfaces based on parameters in the following table and click OK.

      Name	rule2
      Source Zone	untrust local
      Destination Zone	untrust local
      Service	gre
      Action	Allow

4. Set DSVPN parameters for the Spokes.

   Spoke1 is used as an example.

   Choose Network > DSVPN > DSVPN. Click Add. Set parameters as follows and click OK.

   

   Basic Configuration
   Deployed At	Branch
   Policy Name	Spoke1
   Zone	untrust
   Private IP Address	172.16.1.2/24
   Private IP Address*Public Address Configuration	Interface
   Public Interface	GE0/0/0
   Authentication Key	Planned by the network administrator. Ensure that the two ends of the tunnel have the same authentication key. In this example, the authentication key is Test!123.
   Headquarters Information
   Private IP Address	172.16.1.1
   Public IP Address	1.1.1.10
   Route Configurations
   Route Advertisement Mode	OSPF
   Network Address	192.168.1.0/24
   Route Learning Method	Route Aggregation to HQ

5. Set DSVPN parameters for the Hub.

   Choose Network > DSVPN > DSVPN. Click Add. Set parameters as follows and click OK.

   

   Basic Configuration
   Deployed At	Headquarters
   Policy Name	Hub
   Zone	untrust
   Private IP Address	172.16.1.1/24
   Private IP Address*Public Address Configuration	Interface
   Public Interface	GE0/0/0
   Authentication Key	Planned by the network administrator. Ensure that the two ends of the tunnel have the same authentication key. In this example, the authentication key is Test!123.
   Route Configurations
   Route Advertisement Mode	OSPF
   Network Address	192.168.0.0/24
   Route Learning Method	Route Aggregation to HQ