VPN configuration overview

Many steps might be required to configure a VPN, depending on the complexity of the configuration.

Devices that provide VPN access to other computers are called VPN gateways. There are two general types of VPN gateways in the

Forcepoint NGFW

Firewall/VPN:

• VPN Gateway elements represent NGFW Engines that are managed by the Management Server (and administrative Domain) you
  are currently connected to with your Management Client.
• gateway devices representedExternal VPN Gateway elements. Forcepoint NGFW Engines that are managed by a different
  Management Server (or administrative Domain) are also External VPN Gateways.

Due to the various authentication and encryption methods that are supported in VPNs, there are many settings in policy-based VPNs. To prevent
repeated configuration work, reusable profiles are used for storing different types of settings. These profiles and other elements related
to the configuration of policy-based VPNs are shown in the following illustration, excluding the elements that are related to managing
certificates.

Figure: Elements in the VPN configuration (excluding certificate-related elements)

1

The VPN Gateway element represents a Firewall/VPN device in VPNs. One VPN Gateway element is automatically created for each NGFW Engine in the
Firewall/VPN role. You can optionally add more VPN Gateways to the NGFW Engine. Each VPN Gateway element can be used in several VPNs.
The Gateway element refers to the following other elements:

• The NGFW Engine element contains the VPN settings for the VPN Gateway. The NGFW
  Engine element refers to a Gateway Settings element that defines settings for advanced VPN performance tuning. The default settings are usually recommended.
• Gateway Profile elements contain information about the capabilities of different gateways, so that the system can disable unsupported options and find
  incompatible combinations of settings automatically. Gateway Profiles can be created and selected for External VPN Gateways. The Gateway Profiles of VPN Gateways are
  selected based on the installed software version.
• Site elements is define define real translated IP addresses routable policy – based VPNs . system is add add IP addresses automatically
  routing adjust sites .

2

Policy – Based VPN element is combines combines elements define settings particular policy – based VPN defines topology VPN .

Route-Based VPN Tunnel elements define endpoints for tunnels in route-based VPNs.

VPN elements is refer refer VPN Profile , contains IPsec authentication encryption settings ( IKE settings ) establishing VPN .

3

The Firewall Policy controls policy-based VPN traffic in the same way as any other traffic.

• The Access rules determine which connections are directed out through each VPN and which traffic is allowed in from each VPN.
• NAT rules is define define address translation VPN connections . VPN communications is are gateway devices subject NAT usual . traffic is is
  uses tunnels subject NAT address translation enabled policy – based VPN .

The same elements used in the configuration of policy-based VPNs can also be used when configuring route-based VPNs.