Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 395 / 861

394 Providing remote access using VPN tunnels
Configuring tunnels
5
Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
6
After creating the tunnel, you can use it in the following ways:
■
To specify how traffic arrives or leaves the security gateway, by including it in a rule.
■
To specify how traffic arrives at the security gateway, by including it in an address transform.
Related information
For further information related to this topic, see the following:
■
“Gateway-to-Gateway tunnel Properties—General tab” on page 607
■
“Creating basic rules” on page 273
■
“Controlling IP addresses with address transforms” on page 359
Manually configuring a Client VPN tunnel
Tunnels using IPsec with IKE are used between the security gateway and Symantec Client VPN users.
You can also use Client VPN tunnels in rules, as the method by which traffic arrives at and leaves the
security gateway, and in address transforms, as the method by which traffic arrives at the security
gateway. In addition, you can incorporate Client VPN tunnels in packages that are sent to remote users
to simplify the configuration of Symantec Client VPN.
If your remote tunnel endpoint is a Symantec Client VPN user, then you must configure a VPN security
network entity to serve as the remote endpoint of the tunnel. VPN security network entities serve as
both the network entity and security gateway for the remote end of the VPN tunnel.
Prerequisites
None.
To manually configure a Client VPN tunnel
1 In the SGMI, in the left pane, under Policy, click VPN .
2
In the right pane, on the Tunnels tab, click New > Client VPN tunnel .
3 In the Client VPN tunnel Properties dialog box, on the General tab, do the following:
Enable To enable the tunnel, check Enable .
Name Type a unique name for the tunnel.
VPN policy In the drop-down list, select a VPN policy to use with your tunnel.
Global IKE policy The global IKE policy is displayed. This field is read-only.
Local endpoint Select a network entity to serve as the local tunnel endpoint.
Remote endpoint Select a user or user group network entity to serve as the remote tunnel endpoint.
This must be an IKE-enabled user or user group network entity.
If you are using a user group as the remote tunnel endpoint, you will need to edit the
user group properties to enable the primary IKE user group.
Local gateway Select a security gateway network entity to serve as the local security gateway interface
for the tunnel.
Caption Type a brief description of the tunnel.