VPN - Vanguard Networks

VPN Applications
VPN Applications
Tunneling and
Address
Translation
Figure 1-1 shows a network diagram of a company that has three sites (A, B,
and C) connected to the Internet. The Internet has assigned 15.0.1.2 to Site A,
17.0.1.18 to Site B and 215.1.84.3 to Site C. The company is using 10.0.x.x as its
private IP address space. Each site is given a distinct IP subnet address from
10.0.x.x.
• It is required that any host in any site (example H1) should be able to
communicate with any host (example X1) in the Internet.
• It is required that any host (example H1) should be able to communicate with
any other host (example H2) in any of the company’s sites using the
destination’s private address. i.e. H1 should be able to communicate with H2
using H2’s private address 10.0.3.8.
The above requirements can be met by using following solutions:
• NAT can be enabled on the interfaces which are connected to the Internet.
When the packet from H1 reaches R1 and is destined for X1, R1 translates the
source address 10.0.1.5 to 15.0.1.2 and sends it to X1 and does destination
address translation when a reply comes back from X1.
• Three tunnels can be established between R1 to R2, R2 to R3 and R1 to R3.
When a packet is sent from H1 to H2, the original packet is tunneled by
appending a tunnel header and an IP header. The new IP header uses the
public address 15.0.1.2 as source address and 215.1.84.3 as destination
address. When the tunneled packet reaches R2, the packet is decapsulated and
the original packet is sent to H2.
Site A
10.0.1.0
R1
15.0.1.2
Internet
17.0.1.18
Site B
10.0.2.0
R3
H1
180.1.50.2 X1
H3
10.0.1.5 10.0.2.6
Site C
10.0.3.0
215.1.84.3
R2
H2
10.0.3.8
Figure 1-1. Tunneling and Address Translation
Virtual Private Network 1-3
T0103-10, Revision L Release 7.3