NETGEAR ProSafe FVS124G User Manual
Page 42
Reference Manual for the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports
3-12
Network Planning
202-10085-01, March 2005
The IP addresses of the gateway WAN ports can be either fixed or dynamic. If an IP address is
dynamic, a fully-qualified domain name must be used. If an IP address is fixed, a fully-qualified
domain name is optional.
VPN Telecommuter (Client-to-Gateway Through a NAT Router)
The following situations exemplify the requirements for a remote PC client connected to the
Internet with a dynamic IP address through a NAT router to establish a VPN tunnel with a gateway
VPN firewall at the company office:
•
Single gateway WAN port
•
Redundant dual gateway WAN ports for increased reliability (before and after rollover)
•
Dual gateway WAN ports used for load balancing
VPN Telecommuter: Single Gateway WAN Port (Reference Case)
In the case of the single WAN port on the gateway VPN firewall (
), the remote PC
client at the NAT router initiates the VPN tunnel because the IP address of the remote NAT router
is not known in advance. The gateway WAN port must act as the responder.
Figure 3-16: Single gateway WAN port case for VPN telecommuter
The IP address of the gateway WAN port can be either fixed or dynamic. If the IP address is
dynamic, a fully-qualified domain name must be used. If the IP address is fixed, a fully-qualified
domain name is optional.
Note:
The telecommuter case presumes the home office has a dynamic IP address and
NAT router.
Gateway A
bzrouter.dyndns.org
10.5.6.0/24
10.5.6.1
WAN IP
WAN IP
LAN IP
Client B
FQDN
0.0.0.0
VPN Router
(at employer's
main office)
Telecommuter Example (Single WAN Port)
NAT Router B
NAT Router
(at telecommuter's
home office)
Remote PC
(running NETGEAR
ProSafe VPN Client)
Fully-Qualified Domain Names (FQDN)
- optional for Fixed IP addresses
- required for Dynamic IP addresses