Symantec 360R - Security Gateway SGS Administration Manual page 90

90 Establishing secure VPN connections
Configuring Gateway-to-Gateway tunnels
If you have another (additional) subnet on the LAN side of the Symantec
Gateway Security 300 Series security gateway, VPN client tunnels to the LAN
side of the security gateway are not supported for computers on this separate
subnet. Only computers residing on the appliance subnet (found on the LAN IP
screen) are supported for LAN/WLAN-side VPN tunnels.
Note: Gateway-to-Gateway VPN tunnels are supported on the appliance's WAN
ports; you cannot define Gateway-to-Gateway VPN tunnels on the appliance's
LAN or WLAN ports.
Supported Gateway-to-Gateway VPN tunnels
The Symantec Gateway Security 300 Series appliance lets you configure two
types of Gateway-to-Gateway VPN tunnels:
Dynamic The security gateway comes with a predefined global IKE policy that
automatically applies to your IKE Phase 1 negotiations. You can change the
setting of the SA Lifetime parameter in the Global IKE Policy. SA Lifetime
specifies the amount of time that the tunnel rekeys (in minutes). This
parameter is located in VPN > Advanced > Global IKE Settings (Phase 1
Rekey).
Static Static Gateway-to-Gateway configurations require you to manually enter
tunnel parameters at each security gateway. Both ends must have the same
parameters, including secret keys, security parameter indexes (SPIs),
authentication schemes, encryption methods.
See "Configuring Gateway-to-Gateway tunnels"
static Gateway-to-Gateway tunnels"
Gateway-to-gateway VPN tunnel persistence and high-
availability
After the security gateway restarts, dynamic Gateway-to-Gateway VPN tunnels
are re-established. Dynamic Gateway-to-Gateway VPN tunnels are also re-
established if the WAN port status changes from disconnected to connected.
This feature reduces management overhead by providing automatic
reconnection of tunnels.
If the VPN tunnel fails to establish after three times, the security gateway waits
between one and five minutes before attempting to reconnect. This process
continues until the VPN tunnel is re-established.
If there is a network failure, the security gateway automatically re-establishes
the VPN tunnel through a backup port (WAN port or serial port). If the IP
on page 88. See
on page 93.
"Configuring