Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

DMVPN, Zone based FIREWALL, NAT, Dynamic routing protocol, design and implementation

Posted on 2011-09-30
4
Medium Priority
?
955 Views
Last Modified: 2012-05-12
Hello:

I have been asked to design and implement a mid scale VPN solution. I plan to use a hub and spoke design where:
   
some spokes are corporate sites and others are connected via the inet.
   
WAN speeds vary between 5-20 Mb/s.
   
Not all spoke sites will be "on and connected" 24/7.
   
Some spokea that are far from the hub we need to communicate direcetly with one or more other spokes
.
   iNet acces will be limited to the hub.
   
Split tunnel wan connections will not be permnitted on the spokes, but will be used on the hub for inet access
   
spokes will either have a hard router or some soft VPN client depneding on their size, uptime and number of users
My planned architecture is based on DMVPN phase 3  . This will allow
   
dynamic spoke creation
    control over spoke to spoke communications
    ability to limit iNet access through a main controlled gateway
    simplification of the HUB as the number of spokes increases over time
I also need to use
   
NAT so that we can isolate spokes and deploy a well planned LAN side address space
    ZFW- Zone based firewall is planned to be implemented as various spokes and the hub will have services running
    EIGRP is planned for the LAN side
    BGP or static is planned for the WAN side
I am old school and tend to do all my configs with CLI and not use a gui or some wizards. Maybe this will be easier?

My question relates to the order of implementation. Specifically what should be coded first and how do they interact. Can people please recommend a  deployment order for the following.
   
DMVPN
    NAT
    ZBF
    LAN -EIGRP
    WAN-BGP
For my non-router based spokes, are there any preferred VPN clients that work well with DMVPN, easy VPN, Get VPN, NCP VPN client etc.


Tips, suggestions and comments are welcome from users in this excellent forum.
0
Comment
Question by:sectel
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 22

Expert Comment

by:eeRoot
ID: 36898584
There isn't a specific order to set things up, the important thing is that you fully test it before deploying it.  Once you have the hardware and network connection types selected, you can start planning the configs.  Do you have a IP address/VLAN schema worked out?
0
 

Accepted Solution

by:
sectel earned 0 total points
ID: 36899379
i do have a structured LAN and tuneel ip schema.the WAn side addre are dicated by the host locations.

IMHO, there needs to be an order to the config. i was thinking that i would do
lan int with eigrp
wan int with bgp
nat
zbf
dmvpn

any thoughts?
0
 
LVL 22

Expert Comment

by:eeRoot
ID: 36899973
that looks good
0
 

Author Closing Comment

by:sectel
ID: 37010603
Good answer
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Cisco RV042 router is a popular small network interfacing device that is often used as an internet gateway. Network administrators need to get at the management interface to make settings, change passwords, etc. This access is generally done usi…
Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question