WSM User Guide - WatchGuard Technologies

Network TopologyThis topology is the most error resistant. If a VPN unit goes down, only the connection to the trustednetwork of that unit is down. But, this topology is more work to set up. Each VPN unit must have a VPNtunnel configured to each other unit. There can be possible routing problems if it is not done carefully.The largest problem that you get with fully meshed networks is one of control. Because each unit in thenetwork must connect with each other unit, the number of necessary tunnels becomes large quickly.The number of tunnels that are necessary for this configuration is the same as the square of the numberof devices:[(number of devices) x (number of devices)] -1 ÷ 2 = number of tunnels]When all the VPN units are WatchGuard® devices, WatchGuard System Manager can make it easy to setup. The Management Server contains all the information for all the tunnels. With WatchGuard SystemManager, you make a VPN tunnel between two devices in three steps using a drag-and-drop method.You can monitor the security of the full system from more than one location, each with a Firebox®.Larger companies use this configuration with important branch offices, each using a higher capacityFirebox. Smaller offices and remote users connect with MUVPN, RUVPN, Firebox X Edge, or SOHO 6devices.Networks that are not fully meshed have only the necessary inter-spoke VPN tunnels. Refer to the figurebelow. Thus the flow through the network is better than fully meshed networks. The limits in all meshednetworks are:- The number of VPN tunnels that the firewall CPU can operate.- The number of VPN tunnels allowed by the VPN license on the unit.Partially Meshed NetworkHub-and-spoke networksIn a hub-and-spoke configuration, all VPN tunnels stop at one firewall. Smaller companies frequentlyuse this configuration with a primary Firebox. Many distributed remote users connect with MUVPN,RUVPN, Firebox X Edge, or SOHO 6 devices to this configuration. Each remote device or remote usermakes a VPN tunnel only to the primary Firebox.In a simple hub-and-spoke configuration, each remote location can send and receive data only througha VPN tunnel to the network behind the primary Firebox. A VPN tunnel to the primary Firebox can also230 WatchGuard System Manager