Aruba Instant 6.5.0.0-4.3.0.0 | User Guide IAP-VPN Deployment | 242
Chapter 19
IAP-VPN Deployment
This section provides the following information:
l Understanding IAP-VPN Architecture on page 242
l Configuring IAP and Controller for IAP-VPN Operations on page 245
Understanding IAP-VPN Architecture
The IAP-VPN architecture includes the following two components:
l IAPs at branch sites
l Controller at the datacenter
The master IAP at the branch site acts as the VPN endpoint and the controller at the datacenter acts as the VPN
concentrator. When an IAP is set up for VPN, it forms an IPsec tunnel to the controller to secure sensitive
corporate data. IPsec authentication and authorization between the controller and the IAPs are based on the
RAP whitelist configured on the controller.
Only the master IAP in an IAP cluster forms the VPN tunnel.
From the controller perspective, the master IAPs that form the VPN tunnel are considered as VPN clients. The
controller terminates VPNtunnels and routes or switches the VPN traffic. The IAP cluster creates an IPsec or
GRE VPNtunnel from the VC to a Mobility Controller in a branch office. The controller only acts as an IPsec or
GRE VPN endpoint and it does not configure the IAP.
IAP-VPN Scalability Limits
The controller scalability in IAP-VPN architecture depends on factors such as IPsec tunnel limit, Branch ID limit,
and datapath route table limit. The following table provides the IAP-VPN scalability information for various
controller platforms:
Platforms Branches Routes L3 Mode Users NATUsers Total L2 Users
3200 1000 1000
N/A N/A
64,000
3400 2000 2000 64,000
3600 8000 8000 64,000
M3 8000 8000 64,000
7210 8000 8000 64,000
7220 16,000 16,000 128,000
7240 32,000 32,000 128,000
Table 50: IAP-VPN Scalability
To Next Page
Loading...
Need help?
General
