3Com 3C8S5007 - SuperStack II PathBuilder S500 Switch, User Manual

Page: 68 / 190

68 C
HAPTER
5: C
ONFIGURING AND
M
ONITORING
V
IRTUAL
P
RIVATE
N
ETWORKS
ISP to Central Site Tunneling
The ISP must have tunnel-enabled access servers, like the Total Control
™
hub, if the remote clients cannot support the tunneling protocol.
In this configuration, the tunnel set up proceeds as follows:
■
First the remote user dials into the ISP’s access server.
■
The access server recognizes (based on a user ID, for instance, or on
the user's choice from a menu) that this connection should be
tunneled to the central site.
■
The access server establishes the tunnel with the central site.
■
The remote user then establishes a session directly with the central site
via the tunnel, just as if the two were directly attached.
While this configuration has the advantage that no special software is
required on the remote user, the remote user can dial only into
properly equipped access servers.
Remote User to Central Site Tunneling
In this configuration, the remote user (the client), such as an
OfficeConnect
®
NETBuilder
®
bridge/router or an appropriately configured
personal computer, supports the tunneling protocol. The ISP does not
have to support tunneling in any way.
The remote user dials the ISP, but once the connection is set up, the
remote user and the central site establish the tunnel, using authentication
based on a user ID and password and perhaps on a digital certificate.
The remote user and the central site may also negotiate encryption. Once
the tunnel is established, communications proceed as if the ISP were not
mediating the connection.
Creating a VPN for
Individual Remote
Users
In place of setting up multiple remote access servers at the central site,
VPNs allow remote users to dial a local ISP. Using a VPN for remote access is
particularly useful if you have remote users at a great distance from the
central site. For example, users in Europe can call a local number instead of
dialing in to the central site in New York.
The following two examples show remote access VPN configurations.