ZyXEL 2WG Guida Utente

Chapter 15 IPSec VPN Screens

ZyWALL 2WG User’s Guide

Hub-and-spoke VPN reduces the number of VPN connections that you have to set up and 
maintain in the network. Small office or telecommuter IPSec routers that support a limited 
number of VPN tunnels are also able to use VPN to connect to more networks. Hub-and-spoke 
VPN makes it easier for the hub router to manage the traffic between the spoke routers. If you 
have the spoke routers access the Internet through the hub-and-spoke VPN tunnel, the hub 
router can also provide content filtering, IDP, anti-spam and anti-virus protection for the spoke 
routers.
You should not use a hub-and-spoke VPN in every situation, however. The hub router is a 
single point of failure, so a hub-and-spoke VPN may not be appropriate if the connection 
between the spoke routers cannot be down occasionally (for maintenance, for example). In 
addition, there is a significant burden on the hub router. It receives VPN traffic from one 
spoke, decrypts it, inspects it to find out where to send it, encrypts it, and sends it to the 
appropriate spoke. Therefore, a hub-and-spoke VPN is more suitable when there is a minimum 
amount of traffic between spoke routers.

The following figure shows a basic hub-and-spoke VPN. Branch office A uses one VPN rule 
to access both the headquarters (HQ) network and branch office B’s network. Branch office B 
uses one VPN rule to access both the headquarters and branch office A’s networks. 

Figure 210   Hub-and-spoke VPN Example

The VPN rules for this hub-and-spoke example would use the following address settings.
Branch Office A:

• Remote Gateway: 10.0.0.1
• Local IP address: 192.168.167.0/255.255.255.0
• Remote IP address: 192.168.168.0~192.168.169.255

Headquarters: