Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 379 / 861

378 Providing remote access using VPN tunnels
Understanding VPN policies
You might use a nested tunnel configuration, shown in Figure 10-3 , if you have an existing VPN
between two compartmentalized sites and want to use a second tunnel to protect the transfer of
sensitive information between sites. For example, you may have two distinct branch offices connected
by a primary VPN tunnel, with each internal department further segmented with its own network and
security gateway. This topology lets a department in each location establish a second tunnel between
the two offices to protect sensitive data from other departments.
Figure 10-3 Nested VPN tunnels
Cascaded tunnels
In a cascaded tunnel configuration, an intermediate security gateway acts as a bridge between two
distinct tunnels. A cascaded configuration is used if you have an existing VPN between two sites and
you want to forward traffic that is already part of a VPN to the other site. When a packet reaches the
end of one tunnel, it is decrypted and decapsulated and then encrypted and encapsulated for the
second tunnel. The decision to make two VPNs cascaded may reflect different levels of security on your
private network and the Internet.
Figure 10-4 Cascaded VPN tunnels
Note: Figure 10-3 and Figure 10-4 represent gateway-to-gateway VPN tunnels. Client VPN tunnels have
Symantec Client VPN users as one endpoint.
Understanding VPN policies
Before you set up your secure tunnels, to make their configuration faster and easier, you can create
VPN policies that work on a global level. Rather than configuring the components present in these
policies for every tunnel you create, you can configure general policies and then later apply them to
your secure tunnels.
For example, you can create a general Internet Protocol Security (IPsec)/Internet Key Exchange (IKE)
policy and a general IPsec/Static policy and apply these policies to each IKE or IPsec/Static secure
tunnel you create. Support for IPsec means that you can create secure tunnels between the security
gateway and other devices that support the IPsec standard.
IPsec makes use of the following protocols to ensure the integrity and security of data being passed
through a tunnel:
■
Authentication Headers (AH) perform a cryptographic hash function over IP packets, using a
shared secret authentication key to provide authentication and data integrity.