Symantec™ Security Gateways Reference Guide - Sawmill

Understanding VPN tunnelsGroups91Cascaded tunnelsIn a cascaded tunnel configuration, an intermediate security gateway acts as a bridge between two distincttunnels. A cascaded configuration is used if you have an existing VPN between two sites and you want toforward traffic that is already part of a VPN to the other site. When a packet reaches the end of one tunnel,it is decrypted and decapsulated and then encrypted and encapsulated for the second tunnel. The decisionto make two VPNs cascaded may reflect different levels of security on your private network and theInternet.Figure 7-3Cascaded VPN tunnelsGroupsWhen granting VPN access, you usually create a separate tunnel for each remote user, especially if there isonly a handful of users to be created. For large numbers of users, however, this can get quite cumbersome.Maintaining a large list of users with their corresponding tunnels is time consuming, especially ifmaintenance frequently requires additions and deletions.User groups let you create a layer of abstraction that simplifies the tunnel creation process. Instead ofcreating a tunnel for each user, you create a user group and define a single tunnel for that user group withthe appropriate access level. Users only need to be added to the group to have the access that all othermembers of the group share; no additional tunnels are necessary. Denying access is as simple as removingthe user from the User Group. Additionally, user groups also let you define DNS, WINS, and the primaryPDC for Windows-based networks, and this information is downloaded to Symantec Client VPNconnections.User groups should be created based on access level. Remember that all users in a user group share thesame access privileges.IPsec standardIPsec, the IETF IP security standard created to address the security limitations of IP packets, is a set of IPpacket security protocols that work at the network layer providing authentication, integrity, privacy, andreplay protection. The overall architecture for IPsec is described in RFC 2401, with additional informationprovided in RFC 2402 and 2406.The functional areas of IPsec include the following:■■■■■Encapsulation modesData integrity protocolData integrity preferenceData privacy preferenceData compression preference