Concept Guide
Dell Networking W-Series Instant 6.4.3.1-4.2.0.0 | User Guide IAP-VPN Deployment | 239
Chapter 16
IAP-VPN Deployment
This section provides the following information:
l Understanding IAP-VPN Architecture on page 239
l Configuring W-IAP and Controller for IAP-VPN Operations on page 242
Understanding IAP-VPN Architecture
The IAP-VPN architecture includes the following two components:
l W-IAPs at branch sites
l Controller at the datacenter
The master W-IAP at the branch acts as the VPN endpoint and the controller at the datacenter acts as the VPN
concentrator. When a W-IAP is set up for VPN, it forms an IPsec tunnel to the controller to secure sensitive
corporate data. IPsec authentication and authorization between the controller and the W-IAPs is based on the
RAP whitelist configured on the controller.
Only the master AP in a W-IAP cluster forms the VPN tunnel.
From the controller perspective, the master W-IAPs that form the VPN tunnel are considered as VPN clients.
The controller terminates VPNtunnels and routes or switches VPN traffic. The W-IAP cluster creates an IPSec or
GRE VPNtunnel from the VC to a mobility controller in a branch office. The controller only acts an IPSec or GRE
VPN end-point and it does not configure the W-IAP.
IAP-VPN Scalability Limits
The controller scalability in IAP-VPN architecture depends on factors such as IPsec tunnel limit, Branch ID limit
and datapath route table limit. The following table provides the IAP-VPN scalability information for various
controller platforms:
Platforms Branches Routes L3 Mode Users NATUsers Total L2 Users
W-3200 1000 1000
N/A N/A
64000
W-3400 2000 2000 64000
W-3600 8000 8000 64000
W-6000M3 8000 8000 64000
W-7210 8000 8000 64000
W-7220 16000 16000 128000
W-7240 32000 32000 128000
Table 45: IAP-VPN Scalability