A shared tunnel interface is not recommended when OSPF or BGP is used.

This use case describes how to implement intranet access between one HQ device and two branch devices (namely, Branch1 and Branch2) through IPsec VPN tunnels. The two tunnels on the HQ device share the same VPN tunnel interface, whereas the tunnel on each branch device uses an exclusive VPN tunnel interface.

Steps

Step 1.Create a VPN tunnel interface on each of the HQ device and two branch devices. Specifically, specify the name and IP address of each tunnel interface, and make sure that the IP addresses of these tunnel interfaces created for the HQ and branch devices belong to the same network segment. In this example, the VPN tunnel interfaces created for the two branch devices are named vpntun1, whereas the VPN tunnel interface created for the HQ device is named vpntun2, as shown in the following figures.

• VPN tunnel interface for the HQ device:

• VPN tunnel interface for Branch1:

• VPN tunnel interface for Branch2:

Step 2.Create an IPsec VPN tunnel on each of the two branch devices to connect to the HQ device. Specifically, configure necessary parameters, click the Route Mode tab, and set Local Tunnel Interface to vpntun1, as shown in the following figure.

The VPN tunnel interface created on each branch device is an exclusive tunnel interface. Therefore, when you create an IPsec VPN tunnel on the branch device, you do not need to specify Peer Tunnel Interface IP.

Step 3.Create a static route on each of the two branch devices to access the HQ device. Specifically, set Dst IP/Netmask to the intranet address of the HQ device and Interface to vpntun1.

The IPsec VPN tunnel on each branch device uses an exclusive tunnel interface. Therefore, when you create a static route on the branch device to connect to the HQ device, you only need to specify the destination interface.

Step 4.Create an IPsec VPN tunnel on the HQ device to connect to Branch1. Specifically, configure necessary parameters, click the Route Mode tab, and set Local Tunnel Interface to vpntun2. Then, click Advanced Settings, and set Peer Tunnel Interface IP to the IP address of vpntun1 created on Branch 1.

The two IPsec VPN tunnels on the HQ device share the same tunnel interface. Therefore, you need to specify Peer Tunnel Interface IP for each of the IPsec VPN tunnels.

Step 5.Repeat Step 4 on the HQ device to create an IPsec VPN tunnel to connect to Branch2. In this case, set Peer Tunnel Interface IP to the IP address of vpntun1 created on Branch 2.

Step 6.Configure a static route on the HQ device to access Branch1. Specifically, set Dst IP/Netmask to the intranet address of Branch1, Interface to vpntun2, and Next-Hop IP to the IP address of vpntun1 created on Branch1.

Step 7.Configure a static route on the HQ device to access Branch2. Specifically, set Dst IP/Netmask to the intranet address of Branch2, Interface to vpntun2, and Next-Hop IP to the IP address of vpntun1 created on Branch2.

The IPsec VPN tunnels on the HQ device share the same tunnel interface. Therefore, make sure that Next-Hop IP specified for the static route is the same as Peer Tunnel Interface IP specified for the corresponding IPsec VPN tunnel. This is because if multiple tunnels share a tunnel interface, the traffic entering the tunnel interface needs to determine the specific destination tunnel based on the next-hop IP address.

Step 8.Verify the result. The result shows that two IPsec VPN tunnels are successfully established, and business access through the IPsec VPN tunnels is normal.