Typical Configuration of DVPN on AR Series Routers

Typical Configuration of DVPN on AR Series Routers

 

[Requirements]

Configure the DVPN to implement intercommunications between Client 1/2 and the Server and between Client 1 and Client 2.

[Networking diagram]

 

[Configuration script]

Configuration script on Server

# sysname Server # radius scheme system # domain system # local-user admin password cipher .]@USE=B,53Q=^Q`MAF4<1!! service-type telnet terminal level 3 service-type ftp # dvpn policy 1                                     /Create dvpn-policy view 1/ # interface Aux0 async mode flow # interface Ethernet0/0 ip address 202.1.1.1 255.255.255.0 # interface Ethernet0/1 ip address dhcp-alloc # interface Serial1/0 clock DTECLK1 link-protocol ppp ip address ppp-negotiate # interface Serial1/1 clock DTECLK1 link-protocol ppp ip address ppp-negotiate # interface Tunnel0                                    /Create Tunnel 0/ ip address 10.0.0.1 255.255.255.0 tunnel-protocol udp dvpn                             /Encapsulation format of Tunnel interface/ source Ethernet0/0 dvpn interface-type server                           /Set the type of Tunnel interface to server/ dvpn dvpn-id 1                                       /Configure DVPN domain 1 for Tunnel interface/ dvpn policy 1                                        /Quote dvpn-policy view 1/ # interface NULL0 # interface LoopBack0 ip address 172.16.1.1 255.255.255.0 # FTP server enable # dvpn service enable                                   /Enable the DVPN/ dvpn server pre-shared-key 12345                      /Configure pre-shared-key for the Server/ # ip route-static 172.16.2.0 255.255.255.0 10.0.0.2 preference 60    /Configure routing information/ ip route-static 172.16.3.0 255.255.255.0 10.0.0.3 preference 60 # user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return

Configuration script on Client 1

# sysname Client1 # radius scheme system # domain system # local-user admin password cipher .]@USE=B,53Q=^Q`MAF4<1!! service-type telnet terminal level 3 service-type ftp # dvpn class test                              /Configure DVPN class for Tunnel interface/ public-ip 202.1.1.1 authentication-server method pre-share pre-shared-key 12345 # interface Aux0 async mode flow # interface Ethernet0/0 ip address 202.1.1.2 255.255.255.0 # interface Tunnel0                             /Create Tunnel 0/ ip address 10.0.0.2 255.255.255.0 tunnel-protocol udp dvpn                      /Encapsulation format of Tunnel interface/ source Ethernet0/0 dvpn interface-type client                    /Set the type of Tunnel interface to client/ dvpn dvpn-id 1                                /Configure DVPN domain 1 for Tunnel interface/ dvpn server test                              /Quote the configured DVPN class/ # interface NULL0 # interface LoopBack0 ip address 172.16.2.1 255.255.255.0 # FTP server enable # dvpn service enable                           /Enable the DVPN/ # ip route-static 172.16.1.0 255.255.255.0 10.0.0.1 preference 60  /Configure routing information/ ip route-static 172.16.3.0 255.255.255.0 10.0.0.3 preference 60 # user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return

Configuration script on Client 2

# sysname Client2 # radius scheme system # domain system # local-user admin password cipher .]@USE=B,53Q=^Q`MAF4<1!! service-type telnet terminal level 3 service-type ftp # dvpn class test                                /Configure DVPN class for Tunnel interface/ public-ip 202.1.1.1 authentication-server method pre-share pre-shared-key 12345 # interface Aux0 async mode flow # interface Ethernet0/0 ip address 202.1.1.3 255.255.255.0 # interface Ethernet0/1 ip address dhcp-alloc # interface Tunnel0                                /Create Tunnel 0/ ip address 10.0.0.3 255.255.255.0 tunnel-protocol udp dvpn                         /Encapsulation format of Tunnel interface/ source Ethernet0/0 dvpn interface-type client                       /Set the type of Tunnel interface to client/ dvpn dvpn-id 1                                   /Configure DVPN domain 1 for Tunnel interface/ dvpn server test                                 /Quote the configured DVPN class/ # interface NULL0 # interface LoopBack0 ip address 172.16.3.1 255.255.255.0 # FTP server enable # dvpn service enable                               /Enable the DVPN/ # ip route-static 172.16.1.0 255.255.255.0 10.0.0.1 preference 60   /Configure routing information/ ip route-static 172.16.2.0 255.255.255.0 10.0.0.2 preference 60 # user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return

 

[Verification]

Any two of the Server, Client 1 and Client 2 can implement intercommunications.

Map information and session information on the Server:

[Server]dis dvpn map all

vpn-id   private-ip       public-ip   port    state    type   client-id

------------------------------------------------------------------------------

1         10.0.0.3        202.1.1.3   40959  FINISHED  S->C     88383300

1         10.0.0.2        202.1.1.2   40959  FINISHED  S->C     91175268

 

[Server]display dvpn session all

vpn-id   private-ip       public-ip    port     state  type

-----------------------------------------------------------------

1         10.0.0.2        202.1.1.2   40959   SUCCESS  S->C

1         10.0.0.3        202.1.1.3   40959   SUCCESS  S->C

 

Map information and session information on Client 1:

[Client1]dis dvpn map all

vpn-id    private-ip      public-ip    port     state  type   client-id

------------------------------------------------------------------------------

1         10.0.0.1        202.1.1.1   40959   SUCCESS  C->S     91175268

 

[Client1]dis dvpn se all

vpn-id    private-ip      public-ip    port     state  type

-----------------------------------------------------------------

1         10.0.0.1        202.1.1.1   40959   SUCCESS  C->S

1         10.0.0.3        202.1.1.3   40959   SUCCESS  C->C

 

Map information and session information on Client 2:

[Client2]dis dvpn map all

vpn-id    private-ip      public-ip    port     state  type   client-id

------------------------------------------------------------------------------

1         10.0.0.1        202.1.1.1   40959   SUCCESS  C->S     88383300

 

[Client2]dis dvpn se all

vpn-id    private-ip      public-ip    port     state  type

-----------------------------------------------------------------

1         10.0.0.1        202.1.1.1   40959   SUCCESS  C->S

1         10.0.0.2        202.1.1.2   40959   SUCCESS  C->C

 

[Tip]

1.        During the DVPN data transmission, the system performs IPSec encryption for all data by default. Therefore, you do not need to configure it.

2.        For ID authentication through the pre-shared-key, the Client needs to specify an identical pre-shared-key with that of the Server to be accessed.

3.        Up to one dvpn-policy can be applied to an interface. To apply a new dvpn-policy, delete the existing dvpn-policy first. One dvpn-policy can be used by several interfaces at the same time.

4.        Encapsulate the UDP DVPN on the Tunnel interface before configuring other DVPN parameters.