Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I thought hubs were layer 1 devices, and so would have no active role in IPSec. I am reading to understand crypto maps,

Dynamic crypto map policies are used in site-to-site VPNs when an unknown remote peer tries to initiate an IPsec security association with the local hub. The hub cannot be the initiator of the security association negotiation. Dynamic crypto policies allow remote peers to exchange IPsec traffic with a local hub even if the hub does not know the remote peer's identity.

and apparently a hub may know the identity of a peer. If a hub is layer 1 only, how is this possible?

share|improve this question
    
The word hub is being used in an architectural design sense rather than referring to the layer 1/2 hub device that network cables are plugged into. –  Jeff Ferland May 7 '13 at 23:28

1 Answer 1

up vote 6 down vote accepted

I think it's referring to "hub" as the center of a hub-and-spoke VPN architecture, as shown in this diagram.

Later on in the document you linked to, it says:

Dynamic—Dynamic crypto maps can only be used in a hub-and-spoke VPN topology. Dynamic crypto map policies allow remote peers to exchange IPsec traffic with a local hub, even if the hub does not know the remote peer's identity.

share|improve this answer
1  
Exactly that! Systems connect to other systems/locations by initiating connections via the hub. The 'hub' referred to is likely the main offices. Sites can connect to each other by connecting VPNs via the hub so it's like a hub and spoke combination on a wheel. –  AndyMac May 7 '13 at 21:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.