WSM User Guide - WatchGuard Technologies

Tunneling Methodsbe configured to send and receive data to a different remote VPN location (tunnel switching). The intensityof traffic in hub-and-spoke can be high if the primary Firebox sends packets from one remote locationto a different remote location. The traffic intensity also can be low in a simple hub-and-spoke,where the remote locations can only send data through a VPN tunnel to the primary hub location.The primary Firebox is the one point where all VPN tunnels can fail, so it can be a problem. If it goesdown, you cannot connect any VPN tunnels to the remote locations.The flow through a simple hub-and-spoke system is far more clear than through a meshed system. Youcan control the number of tunnels better. Refer to the sum that follows:[(number of devices) – 1 = number of tunnels]If it is necessary to have more spoke capacity, you expand the hub location. But, because all traffic goesthrough the hub, it is necessary to have more bandwidth for this installation.Hub and Spoke NetworkTunneling MethodsSplit tunneling is when a remote user or endpoint has access to the Internet on the same computer asthe VPN connection. But, this user does not put the Internet traffic through the tunnel. The remote userbrowses directly through the ISP. This makes the system vulnerable, because Internet traffic is not filteredor encrypted.This dangerous configuration is less vulnerable when all of the Internet traffic of the remote user goesthrough a VPN tunnel to the Firebox®. From the Firebox, the traffic is then sent back out to the Internet(tunnel switching). With this configuration the Firebox examines all traffic and gives better security.When you use tunnel switching, a Dynamic NAT policy must include the outgoing traffic from theremote network. This allows the remote users to browse the Internet when they send all traffic to theFirebox.User Guide 231