WatchGuard Firebox System 4.6 User Guide

Branch office VPN with IPSecmust manually reorder the policies from more specific to less specific to ensure thatsensitive connections are routed along the higher-security tunnels. In general,WatchGuard recommends the following policy order:• Host to host• Host to network• Network to host• Network to networkPolicies must be set to the same order at both ends of the tunnel. For moreinformation about IPSec policy order, see the Network Security Handbook.From the IPSec Configuration dialog box:• To move a policy up in the list, click the policy. Click Move Up.• To move a policy down in the list, click the policy. Click Move Down.Configuring services for branch office VPN with IPSecUsers on the remote Firebox are technically outside the trusted network; you musttherefore configure the Firebox to allow traffic through the VPN connection. A quickmethod is to create a host alias corresponding to the VPN remote networks and hosts.Then, use either the host alias or individually enter the remote VPN networks andhosts when configuring the following service properties:Incoming• Enabled and Allowed• From: Remote VPN network, hosts, or host alias• To: trusted or selected hostsOutgoing• Enabled and Allowed• From: trusted network or selected hosts• To: Remote VPN network, hosts, or host aliasFor more information, see “Defining service properties” on page 49, and “Adding ahost alias” on page 86.Allow VPN access to any servicesTo allow all traffic from VPN connections, add the Any service to the Services Arenaand configure it as described above.Allow VPN access to selective servicesTo allow traffic from VPN connections only for specific services, add each service tothe Services Arena and configure each as described above.Access control is a critical part of configuring a secure VPN environment. Ifmachines on the branch office VPN network are compromised, attackersobtain a secure tunnel to the trusted network.User Guide 129