OxyGEN
mini
Office
Administrator’s Guide
The OxyGEN broadband devices support both
Server
and
Client
modes for the SSL-VPN Tunnel. This
means that we can use an OxyGEN miniOffice as server at the central site and different remote users
connect to it using their PCs (with software clients) or use another OxyGEN terminal from a remote site.
Configuration of the corresponding parameters is performed using the Web configuration tool, in
the
SSL VPN
sub-menu of the
Advanced
menu category (see page 128). The first task to be performed
once we enter this configuration page, is to enable the service using the appropriate
Status
radio button
and to choose whether the device will operate as a Server or as a Client in the SSL-VPN tunnel using the
Operation mode
drop-down menu (see Figure 11.4 in page 128).
Routed vs Bridged VPN Tunnel
An important selection for the operation of the VPN tunnel, is its type:
Routed
or
Bridged
.
In a Routed VPN tunnel, connection between the server and client is in the IP level. This practically
means that they both have their separate and independent LAN subnets, with non-overlapping ranges
of IP addresses and these subnets are interconnected through the SSL VPN tunnel. Forwarding of the
packets between the different subnets is performed based on the destination IP address.
In a Bridged VPN tunnel, on the other hand, connection between the server and the client is
performed in the Ethernet layer. This results in a simpler network topology, where the LAN subnets behind
the server and the client operate like a single IP network, with the same range of IP addresses. Just as if
they were connected by an Ethernet switch.
The choice between the above two types of tunnels, is not always very easy however. Routed tunnels
are the most common choice, since they are more straightforward to configure and troubleshoot. The
tricky part in configuring Routed tunnels is how to verify, in certain cases, that all hosts in the LANs behind
the server and the client have the proper routing information in order to forward packets through the
VPN tunnel. Additionally, when a Routed tunnel is used, only IP packets traverse it. This means that
applications and services which rely on non-IP protocols or on IP broadcasts (e.g. Windows "Network
Neighborhood"), fail to operate accross the tunnel.
Bridged tunnels, on the other hand, are more difficult to handle. Bridged connections are difficult
to troubleshoot and the corresponding functionality is even absent in some older versions of the PC
Operating Systems. They have the advantage that by bridging the two LANs behind the server and the
client the solve the problem of applications depending on IP broadcasts, however, this can also be the
source of serious network degradation: since the VPN tunnels operate over a, usually, low bandwidth
WAN link, the true capacity of the link can be substabtially reduced by unnecessary broadcast traffic
that should be limited to the high-bandwidth LAN.
Gennet s.a.
200
19216811.live