Objectives
The simulator ticks each one as soon as the network meets it.
Turn on the VPN blade with domains: LAN1 on GW1, LAN2 on GW2, LAN3 on GW3.
Add star community BRANCHES: center GW1, satellites GW2 and GW3.
Add a rule at the top, VPN BRANCHES, Accept, Track Log. Publish, and install on all three.
PC2 and PC3 both reach 192.168.1.10.
PC2 can’t reach 192.168.3.10: no tunnel joins two satellites, so it leaves in the clear and R1 drops it.
Before you start
This model doesn’t route between satellites through the center. show communities lists the tunnels a community makes.
Concept
A VPN community, not a tunnel
Each gateway has a VPN domain, the network behind it. A community says which gateways talk: meshed links every pair, and star links satellites to centers. Traffic between two domains in a community gets encrypted, and a rule with the community in its VPN column allows it. Hide NAT breaks this unless it is disabled inside the community, because a hidden address no longer matches its domain.
