Hub-and-Spoke Support

This version extends OCVPN to support hub-and-spoke topology in addition to full mesh support.

This feature includes support for the following:

• OCVPN portal with FortiCare SSO.
• Enforce limits for OCVPN free service.
• Define multiple overlay network using OCVPN hub-and-spoke.
• ADVPN for hub-and-spoke. The ADVPN shortcut is enabled by default.

Sample topology

OCVPN portal with FortiCare SSO

The OCVPN portal can display customer and portal information including:

• The customer OCVPN license type: free or full.
• Registered device information including:
  • Device serial number.
  • OCVPN role.
  • Hostname.
  • WAN IP address.
  • Configured overlays.

You can display the OCVPN network topology in a diagram.

You can unregister OCVPN devices on the portal.

OCVPN free license limit

The current OCVPN free license limit is three devices and full mesh only.

There is currently no limit to the free licenses on the OCVPN cloud side.

Warning messages appear when the free license limit is reached. For example:

"Primary-Hub role is not supported with OCVPN free license.  Please upgrade to
full OCVPN license to use hub and spoke topology.
object check operator error, -9999, discard the setting
Command fail. Return code -9999"

"OCVPN free license limit (3) has been reached. Please upgrade to
full OCVPN license to register additional devices.
object check operator error, -9999, discard the setting
Command fail. Return code -9999"

To check the OCVPN license type, see Diagnostic commands.

OCVPN hub-and-spoke with multiple overlays with ADVPN shortcut

To configure the Spoke in the GUI:

1. Go to VPN > Overlay Controller VPN and create or edit an overlay.
2. For Role, select Spoke.

   

To configure Spoke1 OCVPN in the CLI:

 config vpn ocvpn
     set status enable
     config overlays
         edit 1
             set name "QA"
             config subnets
                 edit 1
                     set subnet 10.1.100.0 255.255.255.0
                 next
             end
         next
         edit 2
             set name "PM"
             config subnets
                 edit 1
                     set subnet 10.2.100.0 255.255.255.0
                 next
             end
         next
     end
 end

To configure Spoke2 OCVPN in the CLI:

 config vpn ocvpn
     set status enable
     config overlays
         edit 1
             set name "QA"
             config subnets
                 edit 1
                     set subnet 192.168.4.0 255.255.255.0
                 next
             end
         next
         edit 2
             set name "PM"
             config subnets
                 edit 1
                     set subnet 192.168.5.0 255.255.255.0
                 next
             end
         next
     end
  end

To configure the Primary Hub in the GUI:

1. Go to VPN > Overlay Controller VPN and create or edit an overlay.
2. For Role, select Primary Hub.

   

To configure the Primary Hub in the CLI:

 config vpn ocvpn
     set status enable
     set role primary-hub
     config overlays
         edit 1
             set name "QA"
             config subnets
                 edit 1
                     set subnet 172.16.101.0 255.255.255.0
                 next
             end
         next
         edit 2
             set name "PM"
             config subnets
                 edit 1
                     set subnet 172.16.102.0 255.255.255.0
                 next
             end
         next
     end
 end

To configure the Secondary Hub in the GUI:

1. Go to VPN > Overlay Controller VPN and create or edit an overlay.
2. For Role, select Secondary Hub.

   

To configure the Secondary Hub in the CLI:

 config vpn ocvpn
     set status enable
     set role secondary-hub
 end

Diagnostic commands

To check the OCVPN license type:

# diagnose vpn ocvpn show-meta
Topology :: auto
License  :: full
Members  :: 4
Max-free :: 3

To check the OCVPN status:

# diagnose vpn ocvpn status
Current State        : Registered
Topology             : Dual-Hub-Spoke
Role                 : Spoke
Server Status        : Up
Registration time    : Mon Mar 11 16:42:31 2019
Poll time            : Mon Mar 11 16:55:53 2019

# diagnose vpn ocvpn status
Current State        : Registered
Topology             : Dual-Hub-Spoke
Role                 : Primary-Hub
Server Status        : Up
Registration time    : Mon Mar 11 16:42:25 2019
Update time          : Mon Mar 11 15:10:28 2019
Poll time            : Mon Mar 11 16:55:35 2019