How to Configure Dynamic Mesh VPN

Create a Dynamic Mesh network for three or more stand-alone Barracuda CloudGen Firewalls with the central firewall acting as the VPN hub. Every firewall in the VPN Network must be configured to use Dynamic Mesh, and the VPN hub must be the SD-WAN primary and use a Dynamic Mesh-enabled connection object for the access rule matching the VPN relay traffic. Dynamic Mesh can only be used in combination with TINA Site-to-Site tunnels. IPv6 envelope for the VPN tunnels is not supported.

Open

• Create IPv4 TINA VPN tunnels between all firewalls. For more information, see How to Create a TINA VPN Tunnel between CloudGen Firewalls.

• Create access rules for the VPN tunnels. For more information, see How to Create Access Rules for Site-to-Site VPN Access.

• Configure the CloudGen Firewall F acting as a VPN hub to forward VPN traffic from one remote firewall to the others.

Repeat this step on every firewall in the Dynamic Mesh VPN network.

1. Open the VPN Settings page (CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service).

2. Click Lock. 

3. In the TINA section, verify that Allow Dynamic Mesh is selected.

4. Click OK.

5. Click Send Changes and Activate.

For each TINA tunnel, edit the TINA VPN tunnel configuration on the VPN hub and the remote firewalls to use Dynamic Mesh.

1. Open the Site to Site page (CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service).

2. Click Lock. 

3. Double-click the Site-to-Site TINA tunnel. The TINA Tunnel window opens.

4. Click on the Advanced tab.

5. Enable Use Dynamic Mesh.

6. (optional) Enter the Dynamic Mesh Timeout (s) in seconds. The timeout must be between 5 and 600 seconds.
   

7. Click OK.

8. Click Send Changes and Activate.

You must create three custom connection objects on the VPN hub: one that triggers a dynamic tunnel and resets the tunnel timeout, one for traffic going through the dynamic tunnel while not resetting the tunnel timeout, and one for the traffic that should always be relayed through the VPN hub.

Only connections matching an access rule with the Dynamic Mesh and SD-WAN primary options enabled in the SD-WAN settings of the custom connection object on the VPN hub will trigger a new dynamic VPN tunnel. All other traffic will continue to go through the VPN hub. The connection objects on the remote units (SD-WAN secondaries) do not need to be enabled because they are learned automatically from the VPN hub acting as the SD-WAN primary. For traffic matching access rules using this connection object to keep the dynamic tunnel open, Prevent tunnel timeout must be enabled.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > Firewall > Forwarding Rules.

2. In the left menu, click Connections.

3. Right-click in the Connections and click New > Connection.

4. Enter a Name. E.g., DynMeshNoSNAT

5. Select Original Source IP.

6. In the SD-WAN VPN Settings section, click Edit/Show. The SD-WAN Settings window opens.
   

7. Set the SD-WAN Learning Policy to Primary (propagate SD-WAN settings to partner).
   

8. In the Dynamic Mesh section, enable Allow Dynamic Mesh and Trigger Dynamic Mesh.

9. Enable Prevent tunnel timeout.
   

10. Click OK.

11. Click OK.

12. Click Send Changes and Activate.

Only connections matching an access rule with the Dynamic Mesh and SD-WAN primary options enabled in the SD-WAN settings of the custom connection object on the VPN hub will trigger a new dynamic VPN tunnel. All other traffic will continue to go through the VPN hub. The connection objects on the remote units (SD-WAN secondaries) do not need to be enabled because they are learned automatically from the VPN hub acting as the SD-WAN primary.

1. Go to  CONFIGURATION > Configuration Tree > Box > Assigned Services > Firewall > Forwarding Rules.

2. In the left menu, click Connections.

3. Right-click in the Connections and click New > Connection.

4. Enter a Name. E.g., DynMeshNoTimeout

5. Select Original Source IP.

6. In the SD-WAN VPN Settings section, click Edit/Show. The SD-WAN Settings window opens.
   

7. Set the SD-WAN Learning Policy to Primary (propagate SD-WAN settings to partner).
    

8. In the Dynamic Mesh section, enable Allow Dynamic Mesh.

9. Disable Prevent tunnel timeout.
   

10. Click OK.

11. Click OK.

12. Click Send Changes and Activate.

For all services that should not go through the VPN tunnel, use a custom connection object with the SD-WAN Learning Policy set to Primary. Traffic matching an access rule that uses this connection object will not trigger a dynamic tunnel. Instead, it continues to go through the VPN hub.

1. Go to  CONFIGURATION > Configuration Tree > Box > Assigned Services > Firewall > Forwarding Rules.

2. In the left menu, click Connections.

3. Right-click in the Connections and click New > Connection.

4. Enter a Name. E.g., TIPrimaryNoSNAT

5. Select Original Source IP.

6. In the SD-WAN VPN Settings section, click Edit/Show. The SD-WAN Settings window opens.
   

7. Set the SD-WAN Learning Policy to Primary (propagate SD-WAN settings to partner).
   

8. Verify that all check boxes in the Dynamic Mesh section are cleared.
   

9. Click OK.

10. Click OK.

11. Click Send Changes and Activate.