A VPN Concentrator can be configured to add routes to its
routing table for remote hardware or software clients. The VPN Concentrator then
advertises these routes to its private network via RIP or OSPF, making the VPN
3002 protected networks known to the main network. This feature is called
reverse route injection (RRI) and it was introduced in version 3.5 of the VPN
3000 Concentrator code.
Figure 15-29 shows the VPN scenario used earlier.
The scenario assumes the main office has reserved the networks 192.168.0.0 to
192.168.127.0 for its internal use. The other private class C addresses were
assigned as needed to branch locations. RRI could be implemented so all main
office routers know about the branch office LAN. This assumes the branch office
is configured for Network Extension mode.
RRI requires no configuration on the VPN 3002.
VPN Client Support
Client RRI can be used on all VPN Clients connecting to the
VPN Concentrator. This option applies to all remote software clients and VPN
3002 Hardware Clients using Client (PAT) Mode. To configure Client RRI on the
VPN Concentrator, go to Configuration | System | IP Routing | Reverse Route
Injection, and then select the check box for Client Reverse Route Injection.
This selection adds host routes for each remote client to the VPN Concentrator
routing table. The VPN Concentrator adds a host route when the client connects
and deletes it when the client disconnects. This box is unchecked by
default.
Network Extension RRI
This option is for VPN 3002 Client in Network Extension mode
(NEM) only. To configure Network Extension RRI on the VPN Concentrator, go to
Configuration | System | IP Routing | Reverse Route Injection and select the
check box for Network Extension Reverse Route Injection. This selection adds a
network route for each network behind a VPN 3002 Hardware Client to the routing
table on the VPN Concentrator. The VPN Concentrator adds the route when the VPN
3002 connects and deletes the route when it disconnects. This box is unchecked
by default.
Figure 15-30 shows the Configuration | System | IP
Routing | Reverse Route Injection screen where both of the RRI features can be
configured. The example shows adding the protected LAN from the scenario
example.
Sections
Comments (0 posted)
Syndication
