SonicWALL VPN Page 151
Apply NAT and firewall rules
This feature allows a remote site’s LAN subnet to be hidden from the corporate site, and is most
useful when a remote office’s network traffic is initiated to the corporate office. The IPSec
tunnel is located between the SonicWALL WAN interface and the LAN segment of the
corporation. To protect the traffic, NAT (Network Address Translation) is performed on the
outbound packet before it is sent through the tunnel, and in turn, NAT is performed on inbound
packets when they are received. By using NAT for a VPN connection, computers on the remote
LAN are viewed as one address (the SonicWALL public address) from the corporate LAN.
If the SonicWALL uses the
Standard
network configuration, using this check box applies the
firewall access rules and checks for attacks, but not apply NAT.
Note
: You cannot use this feature if you have
Route all internet traffic through this SA
enabled.
Note
: Offices can have overlapping LAN IP ranges if this feature is selected.
Forward Packets to Remote VPNs
Selecting the
Forward Packets to Remote VPNs
check box for a
Security
Association
allows the remote VPN tunnel to participate in the SonicWALL routing table. Inbound traffic is
decrypted and can now be forwarded to a remote site via another VPN tunnel. Normally,
inbound traffic is decrypted and only forwarded to the SonicWALL LAN or a specific route on
the LAN specified on the
Routes
tab located under the
Advanced
section.
Enabling this feature allows a network administrator to create a “hub and spoke” network
configuration by forwarding inbound traffic to a remote site via a VPN security association. To
create a “hub and spoke” network, enable the
Forward Packets to Remote VPNs
check box
for each Security Association in your SonicWALL. Traffic can travel from a branch office to a
branch office via the corporate office.
Enable Perfect Forward Secrecy
The
Enable Perfect Forward Secrecy
check box increases the renegotiation time of the VPN
tunnel. By enabling
Perfect Forward Secrecy
, a hacker using brute force to break encryption
keys is not able to obtain other or future IPSec keys. During the phase 2 renegotiation between
two SonicWALL appliances or a Group VPN SA, an additional Diffie-Hellman key exchange is
performed.
Enable
Perfect Forward Secrecy
adds incremental security between gateways.
Phase 2 DH Group
If
Enable Perfect Forward Secrecy
is enabled, select the type of
Diffie-Hellman (DH)
Key Exchange
(a key agreement protocol) to be used during phase 2 of the authentication
process to establish pre-shared keys. You can now select from three well-known DH groups:
•
Group 1
- less secure
•
Group 2
- more secure
•
Group 5
- most secure
