WatchGuard Technologies FireboxTM System 4.6 - Manual (Page 131)

User Guide 121
CHAPTER 17
Configuring Branch Office Virtual
Private Networking
Branch office virtual private networking (VPN) creates a secure tunnel, over an
unsecure network, between two networks protected by the WatchGuard Firebox
System or between a WatchGuard Firebox and an IPSec-compliant device. Using
branch office VPN, you can connect two or more locations over the Internet while still
protecting the resources of your trusted and optional networks.
WatchGuard offers three branch office VPN methods:
• DVCP VPN
This method defines a Firebox as a DVCP server at the center of a distributed
array of WatchGuard Firebox and SOHO clients.
• IPSec (Internet Protocol Security)
This method uses IPSec to tunnel between a WatchGuard Firebox and an IPSec-
compliant device from another vendor or between two Fireboxes.
• WatchGuard VPN
This method uses the WatchGuard proprietary secure connection, called
WatchGuard VPN, to create a tunnel between two WatchGuard Fireboxes.
Configuration checklist
Before implementing branch office VPN, gather the following information:
• IP address of both ends of the tunnel.
A given pair of Fireboxes can establish only one VPN connection between
them. However, a single Firebox can tunnel to multiple branch locations.
Incoming connections from branch office VPN networks can access machines
on the Trusted interface regardless of whether the local machines are using
NAT.
Connections made through a branch office VPN are exempt from Simple
NAT.
Addresses used for VPN must not be on the Blocked Sites list.