Secure Remote Connectivity; Important - Colubris Networks CN3000 Administrator's Manual

Chapter 2 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - How it works - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Chapter 2

Secure remote connectivity

The CN3000 features VPN software which enables it to create a secure connection to a
remote site via a non-secure infrastructure like the Internet.
• PPTP client: PPTP works by creating a secure tunnel between two devices. Traffic in
• IPSec: IPSec provides the ability for two hosts (called peers in IPSec terminology) to
Note: Traffic in the VPN tunnel bypasses the CN3000's firewall.

Important

The VPN tunnel cannot be used to transport customer traffic. The tunnel should
be used to carry management traffic only (RADIUS, SNMP, management
sessions)
To prevent customer traffic from entering the tunnel, you must define access list
definitions to DENY access to all subnets on the other side of the tunnel.
Example
Consider the following scenario:
To protect the VPN, add the following definitions to the access list:
access-list=vpn,DENY,all,192.168.30.0/24,all
use-access-list=vpn
This definition applies to all customers, whether they are authenticated or not. It blocks
access to the VPN subnet for all traffic. For more information on the access list, see
"Creating a profile for the CN3000 on the RADIUS server" on page 150.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 49 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
RADIUS server
VPN server
Management station
the tunnel is protected against eavesdropping by means of encryption.
To configure the PPTP client, see page 256.
communicate in complete security over any IP-based network.
IPSec achieves this security though the use of sophisticated encryption that makes it
impossible for an eavesdropper to decode the packets of data being exchanged
between two IPSec peers.
To configure IPSec, see page
VPN server
Physical address
24.10.135.55
Address in VPN tunnel
192.168.30.1
VPN tunnel
258 and 259.
VPN tunnel
CN3000
CN3000
Physical address
35.210.15.155
Address in VPN tunnel
192.168.30.2