Firewalls and Tunnels
5-12
Hewlett-Packard Company Virtual Private Networking Concepts Guide
Single-User Tunnels
Single-User Tunnels
Single-User Tunnels
Single-User Tunnels
A single-user tunnel is defined between a fixed device and one
with no fixed IP address, which implies that the device on the
other end of the tunnel is not always present or may change its
address. A single-user tunnel is usually defined on a VPN device
when the other end of the tunnel is an HP VPN Client.
You can assign a known IP address to the remote device using
network address translation (NAT). This address is known as
the Client IP. When a tunnel has been established with the
remote device, all packets coming from the remote device will
have their actual source address replaced with the Client IP
address.
Figure:
Figure:
Figure:
Figure: Network Address Translation
Network Address Translation
Network Address Translation
Network Address Translation
A single-user tunnel is fully defined with the following devices:
•
User name of the opposing HP VPN Client
•
Secure profile to be applied to the communication
•
Color (mode) of the tunnel
•
Client IP if NAT is being used
Identify the opposing HP VPN device by a user name instead of
an IP address. The secure profile defines how the establishment
of the tunnel is authenticated and how the communication is
secured. The mode of the tunnel specifies where the tunnel
terminates. The IP route is no longer required.
Full Access
Full Access
Full Access
Full Access
The following table describes a tunnel that allows a remote user
(called chris) full access to the red (trusted) network available
through VPN device A, while not allowing access to the network
available through VPN device B.
Dest
IP
Src
IP
Dest
Port
Src
Port
Prot
Payload Data
Dest
IP
Client
IP
Dest
Port
Src
Port
Prot
Payload Data
Network Address Translation
