Lan To Lan Tunnels With Pre-Shared Keys; Roaming Clients - D-Link NetDefend DFL-210 User Manual

9.4.2. LAN to LAN Tunnels with
Pre-shared Keys
IPsec Tunnel Quick Start
This section covers IPsec tunnels in some detail. A quick start checklist of setup steps for these
protocols in typical scenarios can be found in the following sections:
• Section 9.2.1, "IPsec LAN to LAN with Pre-shared Keys".
• Section 9.2.2, "IPsec LAN to LAN with Certificates".
• Section 9.2.3, "IPsec Roaming Clients with Pre-shared Keys".
• Section 9.2.4, "IPsec Roaming Clients with Certificates".
In addition to the quick start section, more explanation of tunnel setup is given below.

9.4.2. LAN to LAN Tunnels with Pre-shared Keys

A VPN can allow geographically distributed Local Area Networks (LANs) to communicate securely
over the public Internet. In a corporate context this means LANs at geographically separate sites can
communicate with a level of security comparable to that existing if they communicated through a
dedicated, private link.
Secure communication is achieved through the use of IPsec tunneling, with the tunnel extending
from the VPN gateway at one location to the VPN gateway at another location. The NetDefend
Firewall is therefore the implementer of the VPN, while at the same time applying normal security
surveillance of traffic passing through the tunnel. This section deals specifically with setting up
LAN to LAN tunnels created with a Pre-shared Key (PSK).
A number of steps are required to set up LAN to LAN tunnels with PSK:
• Set up the VPN tunnel properties and include the Pre-Shared key.
• Set up the VPN tunnel properties.
• Set up the Route in the main routing table (or another table if an alternate is being used).
• Set up the Rules (a 2-way tunnel requires 2 rules).

9.4.3. Roaming Clients

An employee who is on the move who needs to access a central corporate server from a notebook
computer from different locations is a typical example of a roaming client. Apart from the need for
secure VPN access, the other major issue with roaming clients is that the mobile user's IP address is
often not known beforehand. To handle the unknown IP address the NetDefendOS can dynamically
add routes to the routing table as tunnels are established.
Dealing with Unknown IP addresses
If the IP address of the client is not known before hand then the NetDefend Firewall needs to create
a route in its routing table dynamically as each client connects. In the example below this is the case
and the IPsec tunnel is configured to dynamically add routes.
If clients are to be allowed to roam in from everywhere, irrespective of their IP address, then the
Remote Network needs to be set to all-nets (IP address: 0.0.0.0/0) which will allow all existing
IPv4-addresses to connect through the tunnel.
When configuring VPN tunnels for roaming clients it is usually not necessary to add to or modify
366
Chapter 9. VPN