McAfee SG310 Administration Manual page 307

VPN menu features
IPSec VPN offloading
Figure 315 IPsec VPN offloading — Multi-port switch configuration
Offload devices can either be added to an existing switch on the LAN, or live on their own dedicated LAN
segment and switch. If insufficient switch ports are available, it is possible to use the switch ports to chain
offload devices together as they do not communicate with each other, and only require simple single-IP
address visibility to the Central UTM Firewall appliance. The optimal arrangement for conserving switch
ports is a tree layout. The switches should detect and resolve any wiring loops (802.1d) should any be
inadvertently created. The four port switch is present on most UTM Firewall appliances, except for the PCI
SG 640 and SG720 rack mount appliances.
Figure 316 illustrates three daisy-chained SG580s (SG1, SG2, and SG3) that are connected via their An
switch, which represents any port switch A1, A2, A3, or A4.
McAfee UTM Firewall 4.0.4 Administration Guide 307