WSM User Guide - WatchGuard Technologies

WatchGuard VPN SolutionsBranch Office Virtual Private Network (BOVPN)Many companies have offices in more than one location. Offices frequently use data from other locations,or have access to shared databases.Because branch offices have sensitive company data, information interchanges must be secure. Whenyou use WatchGuard Branch Office VPN, you can connect two or more locations across the Internetwithout decreasing security. WatchGuard BOVPN supplies an encrypted tunnel between two networksor between a Firebox and an IPSec-compliant device. You can use WatchGuard System Manager or PolicyManager to configure BOVPN.WatchGuard allows certificate-based authentication for BOVPN tunnels. When you use certificate-basedauthentication for BOVPN, the two VPN endpoints must be WatchGuard Fireboxes. You cannot use certificate-basedauthentication for BOVPN with SOHO 6 or Firebox X Edge devices. To use this functionality,you must configure a Management Server and a certificate authority. For more information, see“Configuring Managed VPN Tunnels,” on page 237. For instructions on how to use Policy Manager tomanually configure a BOVPN tunnel, see “Configuring BOVPN with Manual IPSec,” on page 243.BOVPN with Policy ManagerWhen you make a tunnel with Policy Manager, the Firebox uses IPSec to make encrypted tunnels with adifferent IPSec-compliant security device. One of the two endpoints must have a public static IP address.Use BOVPN with Policy Manager if:• You make tunnels between a Firebox and a non-WatchGuard, IPSec-compliant unit.• You give different routing policies to different tunnels.• Not all types of traffic go through the tunnel.BOVPN with IPSec is available with the moderate encryption level of DES (56-bit), or the strongerencryption 3DES (168-bit). BOVPN is also available with AES at the 128-bit, 192-bit, and 256-bit encryptionlevels. AES with 256-bit encryption is the most secure.You can create different VPN tunnels for different types of traffic on your network. For example, you canuse a VPN tunnel with DES encryption for traffic from your sales team. At the same time use a VPN tunnelwith stronger, 3DES encryption for all data from your finance department.BOVPN with Manual IPSecBOVPN with WatchGuard System ManagerWith WatchGuard System Manager, you can make fully authenticated and encrypted IPSec tunnels witha drag-and-drop or menu interface. WatchGuard System Manager uses the Management Server tosafely transmit IPSec VPN configuration information between two Firebox devices. When you use theManagement Server, you set each configuration parameter of the VPN. The Management Server keepsthis information.Use BOVPN with WatchGuard System Manager if:User Guide 233