SonicWALL TELE3 SP, Руководство администратора

Страница: 118 / 210

SonicWALL VPN Page 117
Apply NAT and firewall rules
This feature allows a remote site’s LAN subnet to be hidden from the corporate site, and is most
useful when a remote office’s network traffic is initiated to the corporate office. The IPSec
tunnel is located between the SonicWALL WAN interface and the LAN segment of the
corporation. To protect the traffic, NAT (Network Address Translation) is performed on the
outbound packet before it is sent through the tunnel, and in turn, NAT is performed on inbound
packets when they are received. By using NAT for a VPN connection, computers on the remote
LAN are viewed as one address (the SonicWALL public address) from the corporate LAN.
If the SonicWALL uses the Standard network configuration, using this check box applies the
firewall access rules and checks for attacks, but not NAT.
Note : You cannot use this feature if you have Route all internet traffic through this SA
enabled.
Note : Offices can have overlapping LAN IP ranges if this feature is selected.
Forward Packets to Remote VPNs
Selecting the Forward Packets to Remote VPNs check box for a Security Association
allows the remote VPN tunnel to participate in the SonicWALL routing table. Inbound traffic is
decrypted and can now be forwarded to a remote site via another VPN tunnel. Normally,
inbound traffic is decrypted and only forwarded to the SonicWALL LAN or a specific route on
the LAN specified on the
Routes tab located under the Advanced section.
Enabling this feature allows a network administrator to create a “hub and spoke” network
configuration by forwarding inbound traffic to a remote site via a VPN security association. To
create a “hub and spoke” network, enable the
Forward Packets to Remote VPNs check box
for each Security Association in your SonicWALL. Traffic can travel from a branch office to a
branch office via the corporate office.
Route all internet traffic through this SA
Selecting this box allows a network administrator to force all WAN-destined traffic to go through
a VPN tunnel to a central site. Outgoing packets are checked against the remote network
definitions for all Security Associations (SA). If a match is detected, the packet is then routed
to the appropriate destination. If no match is detected, the SonicWALL checks for the presence
of a SA using this configuration. If an SA is detected, the packet is sent using that SA. If there
is no SA with this option enabled, and if the destination does not match any other SA, the
packet goes unencrypted to the WAN.
Note: Only one SA can have this check box enabled.