NETGEAR ProSafe FVX538 - Manual (Page 19)

Network Planning Guide for ProSafe VPN Firewall Router FVX538
Network Planning 2-9
October 2004
Figure 2-11: Dual gateway WAN ports, before failover, for VPN road warrior
The IP addresses of the gateway WAN ports can be either fixed or dynamic, but a fully-qualified
domain name must always be used because the active WAN port could be either WAN1 or WAN2
(i.e., the IP address of the active WAN port is not known in advance).
After a failover of the gateway WAN port ( Figure 2-12 ), the previously inactive gateway WAN
port becomes the active port (port WAN2 in this example) and the remote PC client must
re-establish the VPN tunnel. The gateway WAN port must act as the responder.
Figure 2-12: Dual gateway WAN ports, after failover, for VPN road warrior
The purpose of the fully-qualified domain name is this case is to toggle the domain name of the
gateway router between the IP addresses of the active WAN port (i.e., WAN1 and WAN2) so that
the remote PC client can determine the gateway IP address to establish or re-establish a VPN
tunnel.
Gateway A
bzrouter.dyndns.org
10.5.6.0/24
10.5.6.1
WAN1 IP
WAN IP
LAN IP
Client B
0.0.0.0
VPN Router
(at employer's
main office)
Road Warrior Example
(Dual WAN Ports, Before Failover)
Remote PC
(running NETGEAR
ProSafe VPN Client) Fully-Qualified Domain Names (FQDN)
- required for Fixed IP addresses
- required for Dynamic IP addresses
WAN2 port inactive
WAN2 IP (N/A)
X X
Gateway A
WAN1 port inactive
10.5.6.0/24
10.5.6.1
WAN1 IP (N/A)
WAN IP
LAN IP
Client B
0.0.0.0
VPN Router
(at employer's
main office)
Road Warrior Example
(Dual WAN Ports, After Failover)
Remote PC
(running NETGEAR
ProSafe VPN Client) Fully-Qualified Domain Names (FQDN)
- required for Fixed IP addresses
- required for Dynamic IP addresses
bzrouter.dyndns.org
WAN2 IP
Remote PC must re-establish VPN tunnel after a failover
X X