Vpn Telecommuter (Client-To-Gateway Through A Nat Router) - NETGEAR ProSafe SRX5308 Reference Manual

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308

VPN Telecommuter (Client-to-Gateway through a NAT Router)

Note: The telecommuter case presumes the home office has a dynamic IP
address and NAT router.
The following situations exemplify the requirements for a remote PC client connected to the
Internet with a dynamic IP address through a NAT router to establish a VPN tunnel with a
gateway VPN firewall such as an VPN firewall at the company office:
• Single-gateway WAN port
• Redundant-dual gateway WAN ports for increased reliability (before and after rollover)
• Dual-gateway WAN ports for load balancing
VPN Telecommuter: Single Gateway WAN Port (Reference Case)
In a single WAN port gateway configuration, the remote PC client at the NAT router initiates
the VPN tunnel because the IP address of the remote NAT router is not known in advance.
The gateway WAN port needs to act as the responder.
Figure 198.
The IP address of the gateway WAN port can be either fixed or dynamic. If the IP address is
dynamic, you need to use an FQDN. If the IP address is fixed, an FQDN is optional.
VPN Telecommuter: Dual Gateway WAN Ports for Improved Reliability
In a dual WAN port auto-rollover gateway configuration, the remote PC client initiates the
VPN tunnel with the active gateway WAN port (port WAN1 in the following figure) because
the IP address of the remote NAT router is not known in advance. The gateway WAN port
needs to act as the responder.
Network Planning for Multiple WAN Ports
319