1-4
VPN 3002 Hardware Client Getting Started
OL-2854-01
Chapter 1 Understanding the VPN 3002 Hardware Client
IPSec
Traffic from the VPN 3002 to any destination other than those within the network list on the central-site
VPN Concentrator travels in the clear without applying IPSec. NAT translates the network addresses of
the devices on the VPN 3002 private network to the address of the VPN 3002 public interface. Thus the
network and addresses on the private side of the VPN 3002 are accessible over the tunnel, but are
protected from the Internet, that is, they cannot be accessed directly.
IPSec
IPSec is the set of standards that enables the VPN 3002 to connect to a central-site VPN Concentrator
over a secure VPN tunnel. Its security measures address data privacy, integrity, authentication, and key
management, as well as tunneling.
IPSec over TCP
The VPN 3002 supports IPSec over TCP, which encapsulates encrypted data traffic within TCP packets.
IPSec over TCP enables the VPN 3002 to operate in an environment in which standard Encapsulating
Security Protocol (ESP, Protocol 50) or Internet Key Exchange (IKE, UDP 500) cannot function, or can
function only with modification to existing firewall rules. IPSec over TCP encapsulates both the IKE and
IPSec protocols within a TCP packet, and enables secure tunneling through both NAT and PAT devices
and firewalls.
Note
This feature does not work with proxy-based firewalls.
The VPN 3002 Hardware Client, which supports one tunnel at a time, can connect using standard IPSec,
IPSec over NAT-T, IPSec over TCP, or IPSec over UDP, but only one for the same tunnel.
To use IPSec over TCP, both the VPN 3002 and the VPN Concentrator to which it connects must
•
Be running version 3.5 or later software. A VPN 3002 running software earlier than version 3.5 can
connect to a VPN Concentrator running version 3.5 software and using IPSec over TCP, with the
VPN 3002 using either IPSec or IPSec over UDP.
•
Enable IPSec over TCP.
•
Configure the same port for IPSec over TCP on both the VPN 3002 and the VPN Concentrator.
IPSec over NAT-T
NAT-T (NAT Traversal) lets IPSec peers establish a connection through a NAT device. It does this by
encapsulating IPSec traffic in UDP datagrams, using port 4500, thereby providing NAT devices with port
information. NAT-T auto-detects any NAT devices, and only encapsulates IPSec traffic when necessary.
The VPN 3002 hardware client supports NAT-T in software version 3.6 and later. It uses NAT-T by
default, and requires no configuration. The VPN 3002 first attempts NAT-T, and then IPSec/UDP (if
enabled) if a NAT device is not auto-detected, allowing IPSec traffic to pass through firewalls that
disallow IPSec.
To use NAT-T you must:
•
Open port 4500 on any firewall you have configured in front of a VPN 3002.
•
Reconfigure any previous IPSec/UDP configuration using port 4500 to a different port.
