Enterprise Hub or VPN Concentrator for AutoVPN for Hub-And-Spoke IPsec Deployment Use Case
Learn how to deploy the SRX1600, SRX4120, or SRX4300 Firewall as an enterprise hub or VPN concentrator for AutoVPN in hub-and-spoke IPsec deployments, enabling scalable, dynamic tunnel establishment between central hub and multiple branch spokes.
Overview
The SRX1600, SRX4120, and SRX4300 Firewalls are suitable as secure VPN concentrators or hubs, as well as spokes for medium to large branches connecting to a central hub. These firewalls support AutoVPN for automated, scalable hub-and-spoke IPsec VPN topologies with dynamic spoke connections. AutoVPN simplifies deployment through templates in HPE Networking Security Director or through Junos OS CLI.
The SRX4120 and SRX4300 Firewalls distribute IKE and IPsec processing across multiple Services Processing Units (SPUs) to deliver high VPN performance and scalability. The SRX1600 Firewall also provides hardware-accelerated IPsec, including support for Intel AES-NI and Intel QuickAssist Technology (QAT), and for mid-scale VPN aggregation. For more information about Quantum Safe IPsec VPN, see Quantum Safe IPsec VPN.
-
Central SRX1600, SRX4120, and SRX4300 Firewalls terminate tunnels from multiple spoke firewalls and distribute tunnel traffic across data plane SPU threads for efficient load distribution.
-
AutoVPN features—AutoVPN automates Phase 1/Phase 2 proposals, policies, and routing (for example: BGP or OSPF over tunnels). Spoke devices automatically discover the hub through signaling.
Challenges in large hub-and-spoke VPNs and AutoVPN solutions:
-
Configuration complexity—Traditional setups require changes on the hub for each new spoke, increasing the risk of misconfiguration. AutoVPN allows spokes to connect or disconnect dynamically without modifying the hub, using certificates and certificate revocation lists (CRLs) for secure authentication and revocation.
-
Spoke-Spoke Traffic Load—A full mesh of tunnels is impractical at scale. AutoVPN with Auto Discovery VPN (ADVPN) shortcuts offloads spoke-to-spoke traffic to direct tunnels, using hub-suggested paths and multipoint st0 interfaces to optimize performance.
-
Route Distribution—Dynamic routing protocols (OSPF, BGP, IS-IS) propagate routes over IPsec tunnels, enabling efficient scaling and simplified routing management.
In a retail office environment, payment card transactions are securely transferred to headquarters or the data center over IPsec VPN tunnels. Bandwidth for each tunnel is typically low (< 1 Mbps), but the number of tunnels scales for deployments with more than 1000 branches.
The SRX1600, SRX4120, and SRX4300 Firewalls are designed for ideal headquarters or data center hubs for medium-to-large enterprises and support IPsec tunnels with AutoVPN to simplify management.
Deploy your firewall in distributed enterprise segments as an IPsec VPN hub using static routing and BGP to secure traffic, terminate connections across sites, and enable scalable and high-availability routing with reduced complexity.
Benefits
-
Simplifies VPN management by dynamically creating and terminating IPsec tunnels, reducing the need for manual configuration and updates.
-
Enhances network performance and availability by integrating routing protocols, ensuring efficient route sharing and secure data transmission.
-
Supports additional services such as VoIP and SD-WAN, providing a scalable solution for diverse enterprise needs.
-
Reduces device load and optimizes resource utilization by enabling dynamic spoke connections, leading to improved overall system efficiency.
-
Ensures secure and efficient traffic flow across distributed enterprise segments using IPsec VPN hubs, static paths, and BGP, maintaining high availability and reliability.
Topology
Baseline Configurations
The baseline configurations in this topic provide a foundational template that help standardizes deployments, improves operational reliability, and accelerates secure onboarding of the SRX1600, SRX4120, and SRX4300 Firewalls in an enterprise hub or VPN concentrator for AutoVPN in hub-and-spoke architecture.
- Interfaces and Zones
- IKE for AutoVPN Hub
- IPsec for AutoVPN Hub
- AutoVPN Hub Gateway and Dynamic Spoke VPN (Enables Dynamic Spoke Tunnels)
- Security Policies
- Routing
Interfaces and Zones
set interfaces st0 unit 0 family inet address set security zones security-zone hub-vpn interfaces st0.0 set security zones security-zone trust interfaces <lan-if> set security zones security-zone untrust interfaces <wan-if>
IKE for AutoVPN Hub
set security ike proposal ike-prop authentication-method rsa-signatures set security ike proposal ike-prop encryption-algorithm aes-256-gcm set security ike proposal ike-prop dh-group group19 set security ike proposal ike-prop lifetime-seconds 8640 set security ike policy autovpn-pol mode main set security ike policy autovpn-pol proposals ike-prop set security ike policy autovpn-pol certificate local-certificate <local1>
IPsec for AutoVPN Hub
set security ipsec proposal autovpn-ipsec-prop protocol esp set security ipsec proposal autovpn-ipsec-prop encryption-algorithm aes-256-gcm set security ipsec proposal autovpn-ipsec-prop lifetime-seconds 3600
AutoVPN Hub Gateway and Dynamic Spoke VPN (Enables Dynamic Spoke Tunnels)
set security ike gateway autovpn-hub ike-policy autovpn-pol set security ike gateway autovpn-hub dynamic distinguished-name wildcard OU=SLT set security ike gateway autovpn-hub local-identity distinguished-name set security ike gateway autovpn-hub external-interface <wan-if> set security ike gateway autovpn-hub version v2-only set security ipsec vpn autovpn-hub-vpn bind-interface st0.0 set security ipsec vpn autovpn-hub-vpn ike gateway autovpn-hub set security ipsec vpn autovpn-hub-vpn ipsec-policy autovpn-ipsec-pol set security ipsec vpn autovpn-hub-vpn establish-tunnels on-traffic
For complete configuration, see CLI Quick Configuration at Example: Configuring Basic AutoVPN with iBGP.
Security Policies
Configure security policies (Trust to VPN, Bidirectional):
set security policies from-zone trust to-zone hub-vpn policy hub-allow match source-address any set security policies from-zone trust to-zone hub-vpn policy hub-allow match destination-address any set security policies from-zone trust to-zone hub-vpn policy hub-allow match application any set security policies from-zone trust to-zone hub-vpn policy hub-allow then permit set security policies from-zone hub-vpn to-zone trust policy spoke-allow match source-address any set security policies from-zone hub-vpn to-zone trust policy spoke-allow match destination-address any set security policies from-zone hub-vpn to-zone trust policy spoke-allow match application any set security policies from-zone hub-vpn to-zone trust policy spoke-allow then permit
Routing
set protocols bgp group autovpn type internal set protocols bgp group autovpn local-address <hub-loopback> set protocols bgp group autovpn family inet unicast set protocols bgp group autovpn neighbor <spoke-range> # Or dynamic via AutoVPN
Verification and Monitoring
Verify your configurations using the following commands:
show security ipsec tunnel-distribution summary(SPU load balancing)show security ike security-associationsshow security ipsec security-associationsshow security ipsec tunnel-distribution srg-id id(For MNHA)