NETGEAR SRX5308 - ProSafe® Quad WAN Gigabit SSL VPN Firewall Reference Manual page 326

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual
These various types of traffic and auto-rollover or load balancing all interact to make the planning
process more challenging:
• Inbound traffic. Unrequested incoming traffic can be directed to a PC on your LAN rather
than being discarded. The mechanism for making the IP address public depends on whether
the dual WAN ports are configured for auto-rollover or load balancing.
• Virtual private networks. A virtual private network (VPN) tunnel provides a secure
communication channel either between two gateway VPN firewalls or between a remote PC
client and gateway VPN firewall. As a result, the IP address of at least one of the tunnel
endpoints must be known in advance in order for the other tunnel end point to establish (or
reestablish) the VPN tunnel.
Note: When the VPN firewall's WAN port rolls over, the VPN tunnel collapses and
must be reestablished using the new WAN IP address. However, you can
configure automatic IPsec VPN rollover to ensure that an IPsec VPN tunnel is
reestablished.
• Dual WAN ports in auto-rollover mode. Rollover for a VPN firewall with dual WAN ports is
different from a single WAN port gateway configuration when you specify the IP address.
Only one WAN port is active at a time, and when it rolls over, the IP address of the active
WAN port always changes. Therefore, the use of a fully qualified domain name (FQDN) is
always required, even when the IP address of each WAN port is fixed.
Figure B-2
Features such as multiple exposed hosts are not supported in auto-rollover mode because the
IP addresses of each WAN port must be in the identical range of fixed addresses.
B-6 Network Planning for Multiple WAN Ports
v1.0, April 2010