NETGEAR ProSafe FVX538 - Manual (Page 18)

Network Planning Guide for ProSafe VPN Firewall Router FVX538
2-8 Network Planning
October 2004
VPN Road Warrior (Client-to-Gateway)
The following situations exemplify the requirements for a remote PC client with no router to
establish a VPN tunnel with a gateway VPN router:
• Single gateway WAN port
• Redundant dual gateway WAN ports for increased system reliability (before and after failover)
• Dual gateway WAN ports used for load balancing
VPN Road Warrior: Single Gateway WAN Port (Reference Case)
In the case of the single WAN port on the gateway VPN router ( Figure 2-10 ), the remote PC client
initiates the VPN tunnel because the IP address of the remote PC client is not known in advance.
The gateway WAN port must act as the responder.
Figure 2-10: Single gateway WAN port case for VPN road warrior
The IP address of the gateway WAN port can be either fixed or dynamic. If the IP address is
dynamic, a fully-qualified domain name must be used. If the IP address is fixed, a fully-qualified
domain name is optional.
VPN Road Warrior: Dual Gateway WAN Ports for Improved System Reliability
In the case of the dual WAN ports on the gateway VPN router ( Figure 2-11 ), the remote PC client
initiates the VPN tunnel with the active gateway WAN port (port WAN1 in this example) because
the IP address of the remote PC client is not known in advance. The gateway WAN port must act
as a responder.
Gateway A
bzrouter.dyndns.org
10.5.6.0/24
10.5.6.1
WAN IP WAN IP
LAN IP
Client B
FQDN 0.0.0.0
VPN Router
(at employer's
main office)
Road Warrior Example (Single WAN Port)
Remote PC
(running NETGEAR
ProSafe VPN Client) Fully-Qualified Domain Names (FQDN)
- optional for Fixed IP addresses
- required for Dynamic IP addresses