Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 376 / 861

375 Providing remote access using VPN tunnels
About VPN tunnels
Once a VPN tunnel is established, remote users or groups of users can connect to and safely access the
resources of the private network through the Internet, as if the remote workstations were physically
located inside the protected network (see
Figure 10-2 ).
Figure 10-2 Client VPN tunnel configuration
In this diagram, a client establishes a tunnel remotely and three internal clients establish a tunnel
internally.
For each VPN user or user group, you can define network settings to download to the client during
Phase 1 configuration mode. The settings include the primary and secondary DNS servers, the WINS
servers, and the primary domain controller. By pushing this information to the clients during
configuration mode, each client will not have to configure them individually, saving management time,
and reducing the possibility of error.
Tunnel endpoints
Tunnel endpoints perform encryption, decryption, encapsulation, decapsulation, and authentication
operations on tunnel packets. Tunnel endpoints are typically two security gateways (gateway-to-
gateway VPN tunnel) or a client computer and security gateway (Client VPN tunnel).
Tunnel endpoints do not have to be outside your protected network. You might use a VPN tunnel
completely within the protected network to keep sensitive information safe from casual access by your
inside users. The principle is the same; connections are encrypted between the two endpoints, not
behind them.
Network entities assigned to a tunnel determine the source or destination of packets permitted to use
the tunnel. Tunnels support using user groups, hosts, subnets, and VPN security entities as scope
markers. Tunnels also support users and user groups to define who may use the tunnel. Users and user
groups are most commonly used with Symantec Client VPN tunnels.
Note: You cannot select domain entities to be an endpoint of a secure tunnel. All tunnel endpoints must
have resolvable IP addresses.
Symantec Client VPN
Symantec security gateway