Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 14: Configuring Virtual Private Networks
Understanding virtual burbs
406
Figure 174: Virtual burb
vs. a non-virtual burb VPN
implementation
that allow you to control precisely what your VPN users can or cannot do.
Figure 174 illustrates this concept.
VPN without a virtual burb
Sidewinder G2
Internal
network
Trusted Internet
burb burb
Proxies
VPN with a virtual burb
Sidewinder G2
Internal
network
Trusted
burb
Proxies
Proxies
Virtual
burb
= VPN tunnel
= Data
Internet
burb
Internet
Internet
Non-VPN
Client
VPN
Client
Non-VPN
Client
VPN
Client
Note: Both VPN implementations depicted in Figure 174 represent “proxied” VPNs
because proxies must be used to move VPN data between burbs. The use of
proxies enables you to control the resources that a VPN client has access to on
your internal network.
A virtual burb can support all the same services as a normal burb. If traffic
coming from the virtual burb is destined to the Sidewinder G2 itself (for
example, DNS or SSH) the rule that allows traffic across that burb must specify
a NAT address of localhost. If localhost is not specified, the Sidewinder G2 will
not be able to route traffic back to the originator.
You can define up to 64 physical and virtual burbs. For example, if you have
two distinct types of VPN associations and you want to apply a different set of
rules to each type, create two virtual burbs, then configure the required proxies
and rules for each virtual burb.
One question that might come to mind when using a virtual burb is: “How does
VPN traffic get to the virtual burb if it doesn’t have a network card?” All VPN
traffic originating from the Internet initially arrives via the network interface card
in the Internet burb. A VPN security association, however, can internally route
and logically terminate VPN traffic in any burb on the Sidewinder G2. By
defining a security association to terminate the VPN in a virtual burb, the VPN
traffic is automatically routed to that virtual burb within the Sidewinder G2.
Thus, the trusted network now recognizes the virtual burb as the source burb
for your VPN traffic. From the virtual burb, a proxy and rule are needed to move
the traffic to a trusted burb with network access.