Vpn Telecommuter: Dual Gateway Wan Ports For Improved Reliability - NETGEAR FVX538 - ProSafe VPN Firewall 200 Router Reference Manual

VPN Telecommuter: Dual Gateway WAN Ports for Improved Reliability

In the case of the dual WAN ports on the gateway VPN firewall
client initiates the VPN tunnel with the active gateway WAN port (port WAN1 in this example)
because the IP address of the remote NAT router is not known in advance. The gateway WAN port
must act as the responder.
Telecommuter Example
10.5.6.0/24
(Dual WAN Ports, Before Rollover)
Gateway A
LAN IP
10.5.6.1
VPN Router
(at employer's
main office)
Figure 3-17: Dual gateway WAN ports, before rollover, for VPN telecommuter
The IP addresses of the gateway WAN ports can be either fixed or dynamic, but a fully-qualified
domain name must always be used because the active WAN port could be either WAN1 or WAN2
(i.e., the IP address of the active WAN port is not known in advance).
After a rollover of the gateway WAN port
port becomes the active port (port WAN2 in this example) and the remote PC must re-establish the
VPN tunnel. The gateway WAN port must act as the responder.
Telecommuter Example
10.5.6.0/24
(Dual WAN Ports, After Rollover)
Gateway A
LAN IP
10.5.6.1
VPN Router
(at employer's
main office)
Figure 3-18: Dual gateway WAN ports, after rollover, for VPN telecommuter
Network Planning
Reference Manual for the ProSafe VPN Firewall 200 FVX538
WAN1 IP
bzrouter1.dyndns.org
X X
WAN2 port inactive
WAN2 IP (N/A)
Fully-Qualified Domain Names (FQDN)
- required for Fixed IP addresses
- required for Dynamic IP addresses
(Figure 3-18), the previously inactive gateway WAN
WAN1 IP (N/A)
WAN1 port inactive
X X
bzrouter2.dyndns.org
WAN2 IP
Fully-Qualified Domain Names (FQDN)
- required for Fixed IP addresses
- required for Dynamic IP addresses
Remote PC must re-establish VPN tunnel after a rollover
January 2005
(Figure 3-17), the remote PC
NAT Router B
WAN IP
0.0.0.0
NAT Router
(at telecommuter's
home office)
NAT Router B
WAN IP
0.0.0.0
NAT Router
(at telecommuter's
home office)
Client B
Remote PC
(running NETGEAR
ProSafe VPN Client)
Client B
Remote PC
(running NETGEAR
ProSafe VPN Client)
3-13