Symantec™ Security Gateways Reference Guide - Sawmill

90 Understanding VPN tunnelsTunnels■■■Take advantage of NATRestrict traffic by time of dayRestrict specific commands within connections (like FTP gets or puts)Whenever possible, choose VPN with proxies over VPN with filters, for a higher degree of security. PassingVPN traffic through the proxies has the following advantages:■■The proxies log connections. By default, VPN tunnel traffic with no proxy interaction is not logged.Proxies provide fine control over services, like restricting URLs or CIFS services.Types of tunnelsIn additional to supporting tunnels between two endpoints, the security gateway also supports twoadditional types of tunnels: nested and cascaded.Nested tunnelsA nested tunnel configuration has one secure tunnel passing through another. A nested tunnelconfiguration normally occurs when a second security gateway encrypts and encapsulates VPN tunneltraffic. When the packets arrive at the first destination security gateway, they are decrypted anddecapsulated from the most recent encryption and encapsulation. Because the packets are still encryptedand encapsulated from the original source security gateway, at the final security gateway, they are onceagain decrypted and decapsulated.You might use a nested tunnel configuration, shown in Figure 7-2, if you have an existing VPN between twocompartmentalized sites and wish to use a second tunnel to protect the transfer of sensitive informationbetween sites. For example, you may have two distinct branch offices connected by a primary VPN tunnel,with each internal department further segmented with their own network and security gateway. Thistopology lets a department in each location establish a second tunnel between the two offices to protectsensitive data from other departments.Figure 7-2Nested VPN tunnels