VPN - Vanguard Networks

Vanguard VPN Tunneling
Traffic Types
Fragmentation and
Reassembly
Network Address
Translation (NAT)
Tunnel Source
Address
Access Control
Policy Based
Routing
Quality of Service
Grouped LCON
Vanguard Networks Routers support tunneling for following traffic types:
• IP
• IPX
• Routing protocols: RIP-v1, RIP-v2, OSPF and BGP
• Broadcast packets such as local, directed and all subnet broadcasts
• Bridge
Fragmentation and Reassembly of the packet is done by the tunnel. If the packet size
after adding the GRE header and Encryption header (if configured) exceeds the
link’s MTU, then IP level fragmentation is done by the tunnel.
On the remote side, when a fragmented packet is received by the tunnel, it waits for
all the fragments before performing other tunnel operations like GRE header
removal and Decryption.
NAT static, external address can be used as a tunnel source address. NAT does not
work on a tunnel/virtual interface. Do not configure tunnel/virtual interface as NAT
internal or external interfaces. If Network Address Translation (NAT) is enabled and
the LCON interface is external, then the tunnel source address should be configured
as one of the external addresses configured for that LCON interface.
The tunnel source address should be configured by the user. It is usually one of the
numbered LCON physical interface addresses.
Vanguard Networks routers do not support access control for tunneled packets. On
the sending side, access control (if enabled) is performed before tunneling. On the
receiving end, the tunnel is identified first (decapsulate tunnel header) and then
access control is applied on the decapsulated packet.
Policy Based Routing, along with tunneling, achieves flow based tunneling. In the
Policy Based Routing configuration, you can choose the next hop address as the
tunnel’s interface address. When a packet matches the flow, it is forwarded to the
corresponding tunnel.
Currently, Quality of Service (QoS) can be configured on LCONs. QoS cannot be
configured on individual tunnels. The policy of the connected LCON is applied to
the tunnel packets that travel over that LCON. Since QoS is not supported for LAN
links/interfaces, Qos is not supported for LAN tunnels.
The tunnel does not make any distinction between a Grouped or Point-to-Point
LCON. Since only one LCON can be configured per tunnel, the tunnel simply
forwards the packet to the configured LCON which can either be Grouped or
Point-to-Point.
Tunneling 2-7
T0103-10, Revision L Release 7.3