Firewalls and Tunnels
5-16
Hewlett-Packard Company Virtual Private Networking Concepts Guide
Multiuser Tunnels
Multiuser Tunnels
Multiuser Tunnels
Multiuser Tunnels
A multiuser tunnel is defined between a fixed device and a group
of remote users, which implies that the devices on the other end
of the tunnel are not always present or may change their
addresses. A multiuser tunnel is usually defined on a VPN device
for the ease of administration, simplification of the overall
configuration, and to limit the number of VPN Client users that
can access the network through the VPN device at any given
time.
Any member of the remote user group that attempts to connect
through the tunnel when the preset number of other users are
already connected is refused. This feature is useful for large
organizations in that it allows them to prioritize access through
the VPN device by groups, thereby avoiding situations where
important tunnel requests are refused because all 1024 available
sessions are in use.
Any remote device that connects successfully is given one of a
preset group of IP addresses with which it appears on the
network, accessible through the Gateway. Hence, all
connections using multiuser tunnels use network address
translation (NAT). A multiuser tunnel is fully defined with the
following devices:
•
Group name
•
Number of users that can establish tunnels at any given time
and associated NAT IP addresses (known as Client IP)
•
Secure profile to be applied to the communication
•
Color (mode) of the tunnel
The group of opposing VPN devices is now identified by a group
name. The secure profile defines how the establishment of the
tunnel should be authenticated and how the communication
should be secured. The mode of the tunnel specifies where the
tunnel terminates. The IP route is no longer required.
Note:
Note:
Note:
Note: If the ahuthentication method specified in the secure
profile associated with a multiuser tunnel is a challenge phrase,
the same challenge phrase must be given out to each member of
the group. This is not recommended.
