Firebox SSL VPN Gateway Administration Guide - WatchGuard ...

Firebox SSL Overviewthe correct port numbers so that the packets return to the correctapplication.The Firebox SSL tunnel is established using industry standardconnection establishment techniques such as HTTPS, ProxyHTTPS, and SOCKS. This operation makes the Firebox SSL firewallfriendly and thus allows remote computers to access privatenetworks from behind other organization firewalls without creatingany problems.For example, the connection can be made via an intermediateproxy, such as an HTTP proxy, by issuing a CONNECT HTTPScommand to the intermediate proxy. Any credentials requestedby the intermediate proxy, will be in turn obtained from theremote user (by using single signon information or by requestingthe information from the remote user) and presented to theintermediate proxy server. Once the HTTPS session is established,the payload of the session is encrypted and carries securepackets to the Firebox SSL.Terminating the Secure Tunnel and ReturningPackets to the ClientThe Firebox SSL terminates the SSL tunnel and accepts anyincoming packets destined for the private network. If the packetsmeet the authorization and access control criteria, the FireboxSSL regenerates the packet IP headers so that they appearto originate from the Firebox SSL’s private network IP addressrange or the client-assigned private IP address. The Firebox SSLthen injects the packets into the network.NOTEIf you run a packet sniffer such as Ethereal on the PC wherethe Secure Access client is running, you will see unencryptedtraffic that appears to be between the client and the FireboxSSL. That unencrypted traffic, however, is not over the tunnelbetween the client and the Firebox SSL but rather the tunnelto the local applications.The Secure Access client maintains two tunnels: an SSLtunnel over which data is sent to the Firebox SSL (the snifferalso detects this tunnel) and a tunnel between the client andlocal applications. The encrypted data that arrives over theSSL tunnel is then decrypted before being sent to the localapplication over the second tunnel. The packet sniffer sees12 Firebox SSL VPN Gateway Administration Guide