Quick Reference Guide

5-1
v1.0, January 2010
Chapter 5
Virtual Private Networking Using IPsec
This chapter describes how to use the IPsec virtual private networking (VPN) features of the
ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G to provide secure,
encrypted communications between your local network and a remote network or computer.
This chapter contains the following sections:
• “Considerations for Dual WAN Port Systems” on this page
• “Using the VPN Wizard for Client and Gateway Configurations” on page 5-3
• “Testing the Connections and Viewing Status Information” on page 5-12
• “Managing VPN Policies” on page 5-15
• “Configuring Extended Authentication (XAUTH)” on page 5-19
• “Assigning IP Addresses to Remote Users (ModeConfig)” on page 5-24
• “Configuring Keepalives and Dead Peer Detection” on page 5-32
• “Configuring NetBIOS Bridging with VPN” on page 5-34
Considerations for Dual WAN Port Systems
If both of the WAN ports of the VPN firewall are configured, you can enable either Auto-Rollover
mode for increased system reliability or Load Balancing mode for optimum bandwidth efficiency.
This WAN mode choice impacts how the VPN features must be configured.
The use of fully qualified domain names in VPN policies is mandatory when the WAN ports are in
load balancing or rollover mode; and is also required for the VPN tunnels to fail over. FQDN is
optional when the WAN ports are in load balancing mode if the IP addresses are static but
mandatory if the WAN IP addresses are dynamic.
Refer to “Virtual Private Networks (VPNs)” on page B-9 for more on the IP addressing
requirements for VPN in the dual WAN modes. For instructions on how to select and configure a
dynamic DNS service for resolving FQDNs, see “Configuring Dynamic DNS (Optional)” on
page 2-16. For instructions on WAN mode configuration, see “Configuring the WAN Mode
(Required for Dual WAN)” on page 2-11.