User's Manual

VPN
Configuring the Site-to-Site VPN
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 251
8
Clean: Terminates the IPSec tunnel over the timeout. You must manually
re-initiate the IPSec VPN tunnel . We recommend that you use Clean
when the remote peer uses dynamic IP address.
Restart: Re-initiates the IPSec VPN tunnel for three times over the
timeout.
• Windows Network (NetBios) Broadcasting: Click On to allow access
remote network resources by using its NetBIOS name, for example,
browsing Windows Neighborhood. NetBIOS broadcasting can resolve a
NetBIOS name to a network address. This option allows NetBIOS
broadcasts to travel over the VPN tunnel.
• Access Control: You can control the incoming traffic from a remote VPN
network to the zones. Click Permit to permit the access, or click Deny to
deny the access. By default, the incoming traffic from the remote network to
all zones is permitted.
NOTE The VPN access rules that are automatically generated by the zone
access control settings will be added in the firewall access rule table
with the priority higher than the default firewall access rules, but
lower than the custom firewall access rules.
• Apply NAT Policies: Click On to apply the NAT settings for both the local
network and remote network communicating over the VPN tunnel. This
option is particularly useful in cases where both sides of a tunnel use either
the same or overlapping subnets.
- Translated Local Network: To translate the local network, select the
translated address object of the local network.
- Translated Remote Network: To translate the remote network, select
translated address object of the remote network.
If the IP address object is not in the list, choose Create an IP Address to add
a new address object. To maintain the IP address objects, go to the
Networking -> Address Object Management page. See Address
Management, page 152.
Figure 11 shows a networking example that simulates two merging
companies with the same IP addressing scheme. Two routers are connected
with a VPN tunnel, and the networks behind each router are the same. For