Virtual Private Networks - NETGEAR SRX5308 - ProSafe® Quad WAN Gigabit SSL VPN Firewall Reference Manual

Note: Load balancing is implemented for outgoing traffic and not for incoming traffic.
Consider making one of the WAN port Internet addresses public and keeping the
other one private in order to maintain better control of WAN port traffic.
Figure B-6

Virtual Private Networks

When implementing virtual private network (VPN) tunnels, you must use a mechanism for
determining the IP addresses of the tunnel endpoints. The addressing of the firewall's WAN ports
in a dual WAN port auto-rollover or load balancing configuration depends on the configuration
being implemented.
Table B-2. IP Addressing Requirements for VPNs in a Dual WAN Port Configuration
Configuration and WAN IP address
"VPN Road Warrior (Client-
to-Gateway)"
"VPN Gateway-to-Gateway" Fixed
"VPN Telecommuter (Client-
to-Gateway through a NAT
Router)"
a. All tunnels must be reestablished after a rollover using the new WAN IP address.
Network Planning for Multiple WAN Ports
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual
Single WAN Port
Configurations
(Reference Cases)
Fixed Allowed
(FQDN optional)
Dynamic FQDN required
Allowed
(FQDN optional)
Dynamic FQDN required
Fixed Allowed
(FQDN optional)
Dynamic FQDN required
v1.0, April 2010
Dual WAN Port Configurations
Rollover Mode a Load Balancing Mode
FQDN required Allowed
(FQDN optional)
FQDN required FQDN required
FQDN required Allowed
(FQDN optional)
FQDN required FQDN required
FQDN required Allowed
(FQDN optional)
FQDN required FQDN required
B-9