USER MANUAL – Z-PASS1/Z-PASS2
42
Two “VPN modes“ are available, named “OpenVPN” and “VPN Box”, respectively.
The “OpenVPN” mode can be used when the Z-PASS shall be installed in an already existing VPN. In this
case, an OpenVPN server shall be available and the configuration, certificate and key files for the Z-PASS
client shall be provided by the VPN administrator; the files can be uploaded to the Z-PASS using the “VPN
configuration” page of Z-PASS Web Server.
If the VPN infrastructure does not exist yet, the advisable choice is to adopt the “VPN Box” solution,
developed by Seneca. The “VPN Box” is an hardware appliance (or a virtual machine) which lets the user
easily setup two alternative kinds of VPN:
-
“Single LAN” VPN
-
“Point-to-Point” VPN
In the “Single LAN” VPN, all devices and PCs (and associated local subnets) configured into VPN are always
connected in the same network. In this scenario any PC Client can connect to any device (Z-PASS) and to
other machines which lie in the Z-PASS LAN, but also any device/machine can connect to any other remote
device/machine which belongs to the same VPN network. This VPN architecture puts some constraints on
the device sub-networks definition, in fact all VPN clients must have a different IP address and different
local LAN, to avoid conflicts. The software named “VPN BOX Manager” configures VPN BOX and will help
you to avoid errors defining local subnet.
In the “Point-to-Point” VPN, a client PC, in a given moment, can perform a single connection, on demand,
to only one device (Z-PASS) (and to machines which lie in the Z-PASS LAN) at time. Furthermore, devices
can’t communicate each other also if they belong to the same VPN. The advantage of this architecture is
that the same sub-network can be used in all sites. Point to point mode makes it possible to define user
groups and manage them. This VPN modality must be configured on “VPN Box” by VPN BOX Manager.
There are two kinds of “Point-to-Point” VPN:
routing Layer 3 VPN
bridging Layer 2 VPN
In “Routing Layer 3 VPN”, only IP (Layer 3) packets are transported over the VPN tunnel and a new virtual
LAN is created with a network subnet which must be different from the LAN subnets of the server and
clients.
Conversely, in “Bridging Layer 2 VPN”, all Ethernet frames are transported over the VPN tunnel and the
clients are inserted in the server LAN.
Each of the two kinds has benefits and drawbacks:
Layer 2 benefits/drawbacks:
can transport any network protocol
broadcast traffic (e.g.: DHCP) is transported
causes much more traffic overhead on the VPN tunnel
Layer 3 benefits/drawbacks:
can transport only IP traffic
broadcast traffic (e.g.: DHCP) is not transported
lower traffic overhead, transports only traffic which is destined for the VPN clients
The “VPN Box” is supplied with two Windows applications:
