Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Understanding
virtual burbs
Chapter 14: Configuring Virtual Private Networks
Understanding virtual burbs
c In the LDAP Timeout field, specify the maximum time (in seconds) that
CMD will wait while performing an LDAP search. The valid range is
between 0 and 3600 seconds. The recommend value is between 5 and
300 seconds.
2 In the Maximum Validated Key Cache Size field, specify the maximum
number of validated keys that will be stored in cache memory. Caching
validated keys can increase system performance. Valid ranges are
0–500. A value of 0 indicates that no keys will be cached. For most systems
a value of 100 is sufficient.
3 In the Certificate Key Cache Lifetime field, specify the maximum amount of
time a certificate can remain in the validated key cache before it must be revalidated.
The valid range is 0–168 hours (1 week). A value of 0 indicates
that the certificate keys must be re-validated with each use.
4 Select the Perform CRL Checking check box to enable CRL checking. If
this option is disabled, CRL lists will not be consulted when validating
certificates.
5 In the CRL Retrieval Interval for CAs drop-down list, specify how often a
CA is queried in order to retrieve a new CRL.
6 In the Audit Level drop-down list, select the type of auditing that should be
performed on this server. The options are:
• Error—Logs only major errors.
• Normal—Logs only major errors and informational messages.
• Verbose—Logs all errors and informational messages.
• Debug—Logs all errors and informational messages. Also logs all
debug information.
• Trace—Logs all errors and informational messages. Logs all debug and
function trace information.
7 Click the Save icon in the toolbar.
A virtual burb is a burb that does not contain a network interface card (NIC).
The sole purpose of a virtual burb is to serve as a logical endpoint for a VPN
association. Terminating a VPN association in a virtual burb accomplishes two
important goals:
• It separates VPN traffic from non-VPN traffic.
• It enables you to enforce a security policy that applies strictly to your VPN
users.
Consider a VPN policy that is implemented without the use of a virtual burb.
Not only will VPN traffic mix with non-VPN traffic, but there is no way to enforce
a different set of rules for the VPN traffic. This is because proxies and rules are
applied on burb basis, not to specific traffic within a burb. By terminating the
VPN in a virtual burb you effectively isolate the VPN traffic from non-VPN
traffic. Plus, you are able to configure a unique set of rules for the virtual burb
405