Matrix NAVAN CNX200, System Manual

Page: 172 / 1388

162 Matrix NAVAN CNX200 System Manual
Setting up NAVAN for VPN Connection
NAVAN will always serve as only VPN Client in Site-to-site VPN (as it sends request) and will serve as only VPN
Server in Remote access VPN. Remote access VPN is a connection between a remote computer and the Internet,
whereas; Site-to-site VPN is a connection between two networks (between two routers).
You can make your workstations running with Windows XP or Windows 7 Operating Systems or any devices as a
VPN Client using different VPN protocols.
A VPN in Windows XP and Windows 7 consists of a VPN Server, a VPN Client, a VPN Connection (the portion of
the connection in which the data is encrypted), and the tunnel (the portion of the connection in which the data is
encapsulated).
General Configuration Overview
NAVAN as a VPN Server
When any devices or workstations or application server located in LAN, behind your NAVAN, are required to be
shared or accessed by any remote users using VPN connection, then, in such application, your NAVAN works as a
VPN Server.
After you decide to be a Server, follow the below general steps for set up:
Make sure that the remote LAN network is not in the same subnet as that of your local LAN network.
1.
Confirm the security protocol used by the Client for creating a VPN tunnel/ supported by the Client, which
wants to get connected with you.
NAVAN supports 10 VPN Connections (as a Server) and 10 VPN Connections (as a Client) for PPTP and
SSL protocol.
NAVAN supports 20 VPN Connections for IPSec and L2TP over IPSec. These can be either Servers or
Clients.
2.
For these Clients, create Users and configure a unique User Name and Password for each User (Client).
You must inform the User Name and Password to the respective Client.
3.
Get the details of the existing network of the Client.
4.
Enable the Server mode of the system for the protocol used for tunneling.
5.
For initial (security) negotiation, select the type of authentication or encryption (as applicable on the basis
of the protocol supported by the Client), and inform the same to your Client.
6.
Select the type of authentication protocol which will be used for User authentication, and inform the same
to your Client.
7.
Assign IP Address or a range of IP Address from your LAN network, to the Client which it will use for
sending packets after getting connected through VPN.
8.
Enter the IP Address of the remote LAN network (Client’s network) to which you will send packets through
the created tunnel.
9.
Enter the IP Address of the internal hosts located behind your LAN network which will be allowed to the
remote user (Client). This is applicable for IPSec only.
10.
Configure the advanced parameters for the respective protocols.