[FW-1] Hub and Spoke VPN

[JP]

Does anyone have experience with a hub and spoke architecture for VPN's using 4.1. I have numerous sites that all need connectivity to each other and do not want to fully mesh them.   In other words:   In order for A to send packets to C the following needs to happen:   A sends packet through tunnel to B which decrypts it and re-encrypts into a new tunnel to C.   So that when site D is added all that is needed is a VPN to B for connectivity to A and C.   Specifically.   1. Is it possible? 2. If so, how do you make the packet enter the second tunnel after being decrypted by the first at the hub (site B)?   -Jeff Pecchio