WatchGuard Firebox System 4.6 User Guide

CHAPTER 17Configuring BranchOffice Virtual PrivateNetworkingBranch office virtual private networking (VPN) creates a secure tunnel, over anunsecure network, between two networks protected by the WatchGuard FireboxSystem or between a WatchGuard Firebox and an IPSec-compliant device. Usingbranch office VPN, you can connect two or more locations over the Internet while stillprotecting the resources of your trusted and optional networks.WatchGuard offers three branch office VPN methods:• DVCP VPNThis method defines a Firebox as a DVCP server at the center of a distributed arrayof WatchGuard Firebox and SOHO clients.• IPSec (Internet Protocol Security)This method uses IPSec to tunnel between a WatchGuard Firebox and an IPSeccompliantdevice from another vendor or between two Fireboxes.• WatchGuard VPNThis method uses the WatchGuard proprietary secure connection, calledWatchGuard VPN, to create a tunnel between two WatchGuard Fireboxes.A given pair of Fireboxes can establish only one VPN connection betweenthem. However, a single Firebox can tunnel to multiple branch locations.Incoming connections from branch office VPN networks can access machineson the Trusted interface regardless of whether the local machines are usingNAT.Connections made through a branch office VPN are exempt from SimpleNAT.Addresses used for VPN must not be on the Blocked Sites list.Configuration checklistBefore implementing branch office VPN, gather the following information:• IP address of both ends of the tunnel.User Guide 121