WatchGuard Firebox System 4.6 User Guide

Branch office VPN with IPSecbe accepted. Policies are defined by their endpoints. These are not the same as tunnelor gateway endpoints–they are the specific hosts or networks attached to thetunnel’s Fireboxes (or other IPSec-compliant device) that communicate through thetunnel.From the IPSec Configuration dialog box:1 Click Add.2 Use the Local drop list to select the tunnel type of the IP address behind the localFirebox.The tunnel type can be an entire network or a single host.3 Enter the IP or network address in slash notation for the local host or network.4 Use the Remote drop list to select the tunnel type of the IP address of the remoteFirebox or IPSec-compliant device.5 Enter the IP address or network address in slash notation for the remote host ornetwork.6 Use the Disposition drop list to select a bypass rule for the tunnel:SecureIPSec will encrypt all traffic that matches the rule in associated tunnel policies.BlockIPSec will not allow traffic that matches the rule in associated tunnel policies.BypassIPSec will not allow traffic that matches the rule in associated tunnel policies. Youcannot bypass a policy that has a network at either endpoint.For every tunnel created to a dropped-in device, you must create a host policyfor both sides’ external IP addresses with protection set to Bypass. Otherwise,traffic to and from the dropped-in device’s external IP address will conflictwith any network policy associated with the VPN.7 If you chose Secure as your disposition, use the Tunnel drop list to select aconfigured tunnel.To configure a new tunnel, see “Configuring a tunnel with manual security” on page 125 or“Configuring a tunnel with dynamic security” on page 127. To display additional informationabout the selected tunnel, click More.8 In the Dst Port field, enter the remote host port.The remote host port number is optional and is the port to which WatchGuard sendscommunication for the policy. To enable communications to all ports, enter 0.9 Use the Protocol drop list to limit the protocol used by the policy.Options include: * (specify ports but not protocol), TCP, and UDP.10 In the Src Port field, enter the local host port.The local host port number is optional and is the port from which WatchGuard sends allcommunication for the policy. To enable communication from all ports, enter 0.11 Click OK.The IPSec Configuration dialog box appears listing the newly created policy. Policies are initiallylisted in the order in which they were created.Changing IPSec policy orderWatchGuard handles policies in the order listed, from top to bottom, on the IPSecconfiguration dialog box. Initially, the policies are listed in the order created. You128