NETGEAR ProSafe FVS124G User Manual
Page 43
Reference Manual for the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports
Network Planning
3-13
202-10085-01, March 2005
VPN Telecommuter: Dual Gateway WAN Ports for Improved Reliability
In the case of the dual WAN ports on the gateway VPN firewall (
), the remote PC
client initiates the VPN tunnel with the active gateway WAN port (port WAN1 in this example)
because the IP address of the remote NAT router is not known in advance. The gateway WAN port
must act as the responder.
Figure 3-17: Dual gateway WAN ports, before rollover, for VPN telecommuter
The IP addresses of the gateway WAN ports can be either fixed or dynamic, but a fully-qualified
domain name must always be used because the active WAN port could be either WAN1 or WAN2
(i.e., the IP address of the active WAN port is not known in advance).
After a rollover of the gateway WAN port (
), the previously inactive gateway WAN
port becomes the active port (port WAN2 in this example) and the remote PC must re-establish the
VPN tunnel. The gateway WAN port must act as the responder.
Figure 3-18: Dual gateway WAN ports, after rollover, for VPN telecommuter
Gateway A
WAN2 port inactive
10.5.6.0/24
10.5.6.1
WAN1 IP
WAN IP
LAN IP
Client B
0.0.0.0
VPN Router
(at employer's
main office)
Telecommuter Example
(Dual WAN Ports, Before Rollover)
NAT Router B
NAT Router
(at telecommuter's
home office)
Remote PC
(running NETGEAR
ProSafe VPN Client)
Fully-Qualified Domain Names (FQDN)
- required for Fixed IP addresses
- required for Dynamic IP addresses
WAN2 IP (N/A)
bzrouter1.dyndns.org
X
X
Gateway A
bzrouter2.dyndns.org
10.5.6.0/24
10.5.6.1
WAN1 IP (N/A)
WAN IP
LAN IP
Client B
0.0.0.0
VPN Router
(at employer's
main office)
Telecommuter Example
(Dual WAN Ports, After Rollover)
NAT Router B
NAT Router
(at telecommuter's
home office)
Remote PC
(running NETGEAR
ProSafe VPN Client)
Fully-Qualified Domain Names (FQDN)
- required for Fixed IP addresses
- required for Dynamic IP addresses
WAN2 IP
WAN1 port inactive
Remote PC must re-establish VPN tunnel after a rollover
X
X