User Guide

Page 120 SonicWALL Internet Security Appliance User’s Guide
Enable Keep Alive
Selecting the Enable Keep Alive check box allows the VPN tunnel to remain active or
maintain its current connection by listening for traffic on the network segment between the
two connections. Interruption of the signal forces the tunnel to renegotiate the connection.
Require XAUTH/RADIUS (only allows VPN Clients)
An IKE Security Association can be configured to require RADIUS authentication before
allowing VPN clients to access LAN resources. XAUTH/RADIUS authentication provides an
additional layer of VPN security while simplifying and centralizing management. RADIUS
authentication allows many VPN clients to share the same VPN configuration, but requires
each client to authenticate with a unique user name and password.
Enable Windows Networking (NetBIOS) broadcast
Computers running Microsoft Windows
®
communicate with one another through NetBIOS
broadcast packets. Select the Enable Windows Networking (NetBIOS) broadcast
check box to access remote network resources by browsing the Windows
®
Network
Neighborhood.
Apply NAT and firewall rules
This feature allows a remote site’s LAN subnet to be hidden from the corporate site, and is
most useful when a remote office’s network traffic is initiated to the corporate office. The
IPSec tunnel is located between the SonicWALL WAN interface and the LAN segment of the
corporation. To protect the traffic, NAT (Network Address Translation) is performed on the
outbound packet before it is sent through the tunnel, and in turn, NAT is performed on
inbound packets when they are received. By using NAT for a VPN connection, computers
on the remote LAN are viewed as one address (the SonicWALL public address) from the
corporate LAN.
If the SonicWALL uses the Standard network configuration, using this check box applies
the firewall access rules and checks for attacks, but not NAT.
Note: You cannot use this feature if you have Route all internet traffic through this
SA enabled.
Note: Offices can have overlapping LAN IP ranges if this feature is selected.
Forward Packets to Remote VPNs
Selecting the Forward Packets to Remote VPNs check box for a Security Association
allows the remote VPN tunnel to participate in the SonicWALL routing table. Inbound traffic
is decrypted and can now be forwarded to a remote site via another VPN tunnel. Normally,
inbound traffic is decrypted and only forwarded to the SonicWALL LAN or a specific route
on the LAN specified on the Routes tab located under the Advanced section.
Enabling this feature allows a network administrator to create a “hub and spoke” network
configuration by forwarding inbound traffic to a remote site via a VPN security association.
To create a “hub and spoke” network, enable the Forward Packets to Remote VPNs
integrated_manual.book Page 120 Friday, October 12, 2001 2:56 PM