HP Sa3110 - VPN Server Appliance User manual

Hewlett-Packard Company
HP: 5971-0873
P/N: A55307-001
March 2001
hewlett-packard vpn server
appliance sa3110/sa3150/
sa3400/sa3450
network layout reference guide

ii

iii
Disclaimer
DisclaimerDisclaimer
Disclaimer
Information in this document is provided in connection with
Hewlett-Packard Company products. No license, express or
implied, by estoppel or otherwise, to any intellectual property
rights is granted by this document. Except as provided in
Hewlett-Packard Company’s Terms and Conditions of Sale for
such products, Hewlett-Packard Company assumesno liability
whatsoever,and Hewlett-Packard Company disclaims any
express or implied warranty, relating to sale and/or use of
Hewlett-Packard Company products including liability or
warranties relating to fitness for a particular purpose,
merchantability, or infringement of any patent, copyright or
other intellectual property right. Hewlett-Packard Company
products are not intended for use in medical, life saving, or life
sustaining applications.
Hewlett-Packard Companymay make changes to specifications
and product descriptions at any time, without notice.
This
Hewlett-Packard VPN Server Appliance SA3110/SA3150/
SA3400/SA3450 Network Layout Reference Guide
, as well as
the software described in it is furnished underlicense and may
only be used or copied in accordance with the terms of the
license. The information in this manual is furnished for
informationaluse only, is subject to change without notice, and
should not be construed as a commitmentby Hewlett-Packard
Company.Hewlett-PackardCompanyassumesnoresponsibility
or liability for any errors or inaccuracies that may appear in this
document or any software that may be provided inassociation
with this document.
Except as permitted by such license, no part of this document
may be reproduced, stored in a retrieval system, or transmitted
inanyformorbyanymeanswithouttheexpresswrittenconsent
of Hewlett-Packard Company.
Copyright © Hewlett-Packard Company 2001.

iv

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide i
Contents
ContentsContents
Contents
HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network
HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 NetworkHP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network
HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network
Layout Reference Guide
Layout Reference GuideLayout Reference Guide
Layout Reference Guide
Network Layout Reference Guide . . .. . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Client Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Client Scenarios . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
One-Armed Router Configuration With No Firewall. . . . . . . . . . . . . . . . . . . . . . . . . 2
Inline Router Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
In Parallel With Firewall (Extranet or Intranet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Bridge Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Edge Router Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Behind a Firewall With or Without NAT (One-Armed) . . . . . . . . . . . . . . . . . . . . . 11
Behind a Firewall With or Without NAT (Inline) . . . . . . . . . . . . . . . . . . . . . . . . . . 13
The VPN Device as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
LAN-to-LAN Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
In Parallel With a Firewall (Without NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
In Parallel With a Firewall (With NAT). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Behind a Firewall (One-Armed) With or Without NAT . . . . . . . . . . . . . . . . . . . . . 21
Behind a Firewall That May or May Not Use NAT (Inline) . . . . . . . . . . . . . . . . . . 24
The VPN Device as a Firewall (With or Without NAT) . . . . . . . . . . . . . . . . . . . . . 27

Hewlett-Packard VPNServer Appliance SA3110/SA3150/SA3400/SA3450 Network LayoutReference Guide 1
HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
1Network Layout Reference Guide
Network Layout Reference GuideNetwork Layout Reference Guide
Network Layout Reference Guide
The purpose of this Network Layout Reference Guide is to help
you install the HP VPN ServerAppliance SA3110/SA3150/
SA3400/SA3450in your network.The termVPN device isused in
this document to refer to all of these devices.
Here are some real-world examples of how the VPN device can
be incorporated into your network infrastructure. Skim through
the following scenarios and find the ones most similar to your
network configuration. Then, note the corresponding
configuration options to help you quickly install the VPN device
into your network.
Scenarios are divided into client and LAN-to-LAN.
Client Scenarios
Client ScenariosClient Scenarios
Client Scenarios • One-armed router configuration (VPN server) with no
firewall
• Inline router configuration
• In parallel with firewall (for extranet or intranet)
• Bridge configuration
• Edge router configuration
• Behind a firewall (one-armed) that may or may not use
network address translation (NAT)
• Behind a firewall (inline) that may or may not use NAT
• VPN device as a firewall
LAN-to-LAN
LAN-to-LANLAN-to-LAN
LAN-to-LAN
Scenarios
ScenariosScenarios
Scenarios • In parallel with a firewall and no NAT
• In parallel with a firewall with NAT
• Behind afirewall (one-armed) that mayor may not use NAT
• Behind a firewall (inline) that may or may not use NAT
• VPN device as a firewall (may or may notuse NAT)

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
2 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
Client Scenarios
Client ScenariosClient Scenarios
Client Scenarios
If you are using the VPN device with the HP SA3000 Series VPN
Client, skim the following scenarios and find the ones most
similar to your network configuration. Then, use the
corresponding table of configuration parameters as a guideline
when configuring your VPN device and VPN Client.
If you are using the VPN device in LAN-to-LAN configurations,
skip to the next section “LAN-to-LAN Scenarios.”
One-Armed
One-ArmedOne-Armed
One-Armed
Router
RouterRouter
Router
Configuration
ConfigurationConfiguration
Configuration
With No
With NoWith No
With No
Firewall
FirewallFirewall
Firewall
This scenario shows the following:
• One-armed configuration uses only one of the VPN device’s
two interfaces.
• Firewall is not enabled.
• The VPN device (VPND) acts as a VPN server.
Figure: One-Armed Configuration With No Firewall
Figure: One-Armed Configuration With No FirewallFigure: One-Armed Configuration With No Firewall
Figure: One-Armed Configuration With No Firewall
Configuring a One-Armed Router Configuration
Configuring a One-Armed Router ConfigurationConfiguring a One-Armed Router Configuration
Configuring a One-Armed Router Configuration
When setting up a VPN device, you must configure many global
configuration settings. You configure the VPN device through
the HP SA3000 Series VPN Manager or command shell.
Desktop
System
Desktop
System
Internal
Network
Internet Router
VPND
Internet
Connection
Direct
Dial
Laser Printer
PSTN
Router or Remote
Access Server
No Firewall
Functions
Router Mode
E0
VPN Client

Client Scenarios
Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 3
To set up a one-armed router configuration, use the
configuration parameters in the following table. Note that the
values of these parametersare examples only; you must enter
values specific to your network.
Table:
Table:Table:
Table: O
OO
One-Armed Router Configuration Parameters
ne-Armed Router Configuration Parametersne-Armed Router Configuration Parameters
ne-Armed Router Configuration Parameters
Inline Router
Inline RouterInline Router
Inline Router
Configuration
ConfigurationConfiguration
Configuration In this scenario, VPN Client traffic is handled either through a
router (inline) or by directly dialing into the public-switched
telephone network (PSTN).
• For inline router configurations:
— The router accepts all incoming client traffic then trans-
fers the traffic to the VPN device.
NAT by Router
NAT by RouterNAT by Router
NAT by Router No NAT
No NATNo NAT
No NAT
Interface E0:
IP: 10.250.128.2 255.255.255.0
Mode: Red
Interface E0:
IP: 205.25.128.2 255.255.255.0
Mode: Red
Interface E1: (not used for
one-armed)
IP: NA
Mode: NA
Interface E1: (not used for one-
armed)
IP: NA
Mode: NA
Configuration file entries/
routing info:
security profile remote user
remote tunnel johndoe
security-profile remote
user
client-ip 10.250.128.2
255.255.255.255
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
ip route 209.29.128.50
255.255.255.255 john doe
HP SA3000 Series VPN Client
IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no client IP)
Subnet: 10.250.128.0 (net-
include) Subnet: 205.25.128.0 (net-include)
ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
4 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
— The VPN device then transfers the traffic on to the local
network to which it is attached. The VPN device may or
may not perform firewall functions on the traffic.
• For direct dial into the PSTN:
— Traffic may go through a router or remote access server,
which may or may not perform NAT.
— The traffic then goes through the VPN device,which
may or may not perform firewall functions on the
traffic.
Figure: Inline Router Configuration
Figure: Inline Router ConfigurationFigure: Inline Router Configuration
Figure: Inline Router Configuration
Configuring an Inline Router Configuration
Configuring an Inline Router ConfigurationConfiguring an Inline Router Configuration
Configuring an Inline Router Configuration
When setting up a VPN device, you must configure many global
configuration settings. You configure the VPN device through
the VPN Manager or command shell.
To set up an inline router configuration, use the configuration
parameters in the following table. Note that the values of these
parameters are examples only; you must entervaluesspecific to
your network.
With/Without
Firewall
Functions
Internet Router
Internet Connection
Direct Dial
VPND
Desktop
System
File Server
Laser Printer
PSTN
May/May Not NAT
Router Mode
Internal
Network
E0
E1
Router or
Remote Access Server
VPN Client

Client Scenarios
Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 5
Table:
Table:Table:
Table:
Inline Router Configuration Parameters
Inline Router Configuration ParametersInline Router Configuration Parameters
Inline Router Configuration Parameters
In Parallel With
In Parallel WithIn Parallel With
In Parallel With
Firewall
FirewallFirewall
Firewall
(Extranet or
(Extranet or(Extranet or
(Extranet or
Intranet)
Intranet)Intranet)
Intranet)
In this scenario, VPN Client traffic is handled either through a
router(inline) or by directly dialing in to the PSTN. In addition,
there is a third-party firewall on the network handling firewall
functionality.
• For inline router configurations:
— The router accepts all incoming client traffic, then trans-
fers the traffic to the VPN device.
— The VPN device then transfers the traffic to the local
network to which it is attached.
— The VPN device is in router mode and doesnot perform
firewall functions.
NAT by Router
NAT by RouterNAT by Router
NAT by Router No NAT
No NATNo NAT
No NAT
Interface E0:
IP: 10.250.128.2 255.255.255.0
Mode: Red
Interface E0:
IP: 205.25.128.2 255.255.255.0
Mode: Red
Interface E1:
IP: 192.168.10.2 255.255.255.0
Mode: Red
Interface E1:
IP: 210.35.129.2 255.255.255.0
Mode: Red
Configuration file entries/
routing info:
security profile remote user
remote tunnel johndoe
security-profile remote
user
client-ip 10.250.128.3
255.255.255.255
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
ip route 209.29.128.50
255.255.255.255 john doe
VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no
client IP)
Subnet: 10.250.128.0 (net-
include) Subnet: 205.25.128.0 (net-include)
ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
6 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
— Traffic is then handed to the third-party firewall, which
performs firewall functions before handing the traffic
onto the local network.
• For direct dial into the PSTN:
— Traffic may go through a router or remote access server,
which may or may not perform NAT.
— The traffic then goes through the VPN device (VPND),
which passes the traffic to the local network.
— The third-party firewall then performs firewall functions
on the traffic before passing it to the local network.
Figure: In Parallel With Firewall
Figure: In Parallel With FirewallFigure: In Parallel With Firewall
Figure: In Parallel With Firewall
Configuring an In Parallel With Firewall Configuration
Configuring an In Parallel With Firewall ConfigurationConfiguring an In Parallel With Firewall Configuration
Configuring an In Parallel With Firewall Configuration
When setting up a VPN device, you must configure many global
configuration settings. You configure the VPN device through
the VPN Manager or command shell.
To set up an in parallel with firewall configuration, use the
configuration parameters in the following table. Note that the
values of these parametersareexamples only; you must enter
values specific to your network.
May/May Not NAT
Router
Mode
Internet Router
VPND
Internet
Connection
Direct Dial
Firewall Desktop System
File Server
Laser Printer
PSTN
Remote Access Server
Internal
Network A
Internal
Network B
(directly
connected
to Internet)
E1 E0
VPN Client
Router

Client Scenarios
Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 7
Table:
Table:Table:
Table: In Parallel With Firewall Configuration Parameters
In Parallel With Firewall Configuration ParametersIn Parallel With Firewall Configuration Parameters
In Parallel With Firewall Configuration Parameters
Bridge
BridgeBridge
Bridge
Configuration
ConfigurationConfiguration
Configuration In this scenario, VPN Client traffic is handled either through a
router/bridge or by directly dialing into the PSTN.
• For router/bridge configurations:
— The router/bridge accepts all incomingclient traffic then
transfers the traffic to the VPN device.
— The VPN device is set tobridge mode and transfers the
traffic to the local network to which it is attached.
— The VPN device may or may not perform firewall
functions on the traffic.
— The bridge is installed on the internal side of the net-
work with minimal changes to the network topology.
VPN Device (NAT by Router)
VPN Device (NAT by Router)VPN Device (NAT by Router)
VPN Device (NAT by Router) VPN Device (No NAT)
VPN Device (No NAT)VPN Device (No NAT)
VPN Device (No NAT)
Interface E0:
IP: 10.250.128.2 255.255.255.0
Mode: Red
Interface E0:
IP: 205.25.128.2 255.255.255.0
Mode: Red
Interface E1:
IP: 192.168.10.2 255.255.255.0
Mode: Red
Interface E1:
IP: 210.35.129.2 255.255.255.0
Mode: Red
Configuration file entries/
routing info:
security profile remote user
remote tunnel johndoe
security-profile remote
user
client-ip 10.250.128.3
255.255.255.255
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
ip route 209.29.128.50
255.255.255.255 johndoe
VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no
client IP)
Subnet: 10.250.128.0 (net-
include) Subnet: 205.25.128.0 (net-include)
ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
8 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
• For direct dial into the PSTN:
— Traffic may go through a router or remote access server,
which may or may not perform network address transla-
tion.
— The traffic then goes through the VPN device, which is
set to bridge mode. TheVPN device may or may not
perform firewall functions on the traffic.
Figure: Bridge Configuration
Figure: Bridge ConfigurationFigure: Bridge Configuration
Figure: Bridge Configuration
Configuring a Bridge Configuration
Configuring a Bridge ConfigurationConfiguring a Bridge Configuration
Configuring a Bridge Configuration
When setting up a VPN device, you must configure many global
configuration You configure the VPN device through the VPN
Manager or command shell.
To set up a bridge configuration, use the configuration
parameters in the following table. Note that the valuesof these
parametersareexamplesonly; youmustentervaluesspecificto
your network.
With/Without
Firewall Functions
Internet Router VPND
Internet Connection
Direct Dial
Desktop System
Desktop System
File Server
Laser Printer
PSTN
Router or
Remote Access Server
Bridge
Mode
Desktop System
Desktop System
E1 E0
Internal
Network B
(directly
connected
to Internet)
Internal
Network A
VPN Client

Client Scenarios
Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 9
Table:
Table:Table:
Table: Bridge Configuration Parameters
Bridge Configuration ParametersBridge Configuration Parameters
Bridge Configuration Parameters
Edge Router
Edge RouterEdge Router
Edge Router
Configuration
ConfigurationConfiguration
Configuration In this scenario, theVPN deviceacts as an“edge” router;it is the
only device between the Internet and the local network.
• The VPN Client makes a secure VPNconnection throughthe
Internet to the VPN device.
• The VPN device is configured to router mode.
• The VPN device may or may not perform firewall functions
on the traffic.
• The VPN Client has no means to perform direct dial to the
local network; it must go through a VPN tunnel.
NAT by Router
NAT by RouterNAT by Router
NAT by Router Inline No NAT
Inline No NATInline No NAT
Inline No NAT
Interface E0:
Mode: Red Interface E0: Mode: Red
Interface E1:
Mode: Red Interface E1: Mode: Red
Bridge IP: 10.250.128.2 Bridge IP: 205.25.128.2
255.255.255.0
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP (no
client IP)
Subnet: 10.250.128.0 (net-include) Subnet: 205.25.128.0
ISP IP: 209.29.128.50 ISP IP: 209.29.128.50

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
10 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
Figure: Edge Router Configuration
Figure: Edge Router ConfigurationFigure: Edge Router Configuration
Figure: Edge Router Configuration
Configuring an Edge Router Configuration
Configuring an Edge Router ConfigurationConfiguring an Edge Router Configuration
Configuring an Edge Router Configuration
When setting up a VPN device, you must configure many global
configuration settings. You configure the VPN device through
the VPN Manager or command shell.
To set up an edge router configuration, use the configuration
parameters in the following table. Note that the values of these
parametersareexamplesonly; youmustentervaluesspecificto
your network.
Table:
Table:Table:
Table: Edge Router Configuration Parameters
Edge Router Configuration ParametersEdge Router Configuration Parameters
Edge Router Configuration Parameters
Internet VPND
Internet
Connection Desktop System
File Server
Laser Printer
Router or Remote
Access Server
Router Mode
E0
E1
With/Without Firewall
Functions
Internal
Network
No Direct
Dial
VPN Client
VPN Device (NAT by Router)
VPN Device (NAT by Router)VPN Device (NAT by Router)
VPN Device (NAT by Router) VPN Device (No NAT)
VPN Device (No NAT)VPN Device (No NAT)
VPN Device (No NAT)
Interface E0:
IP: 10.250.128.2 255.255.255.0
Mode: Red
Interface E0:
IP: 205.25.128.2 255.255.255.0
Mode: Red
Interface E1:
IP: 210.35.129.2 255.255.255.0
Mode: Black
Interface E1:
IP: 210.35.129.2 255.255.255.0
Mode: Red

Client Scenarios
Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 11
Behind a
Behind aBehind a
Behind a
Firewall With or
Firewall With orFirewall With or
Firewall With or
Without NAT
Without NATWithout NAT
Without NAT
(One-Armed)
(One-Armed)(One-Armed)
(One-Armed)
In this scenario, VPN Client traffic is handled either through a
router (inline) or by directly dialing in to the PSTN. The traffic
passes through a third-party firewall beforepassing through the
VPN device.
• For inline router configurations:
— The router accepts all incoming client traffic, then trans-
fers the traffic to the third-party firewall.
— The third-party firewall performs firewall functionality
on the traffic before passing it to the VPN device.
— The VPN device takesthe encrypted traffic and decrypts
it before passing it to the local network.
• For direct dial into the PSTN:
— Traffic may go through a router or remote access server,
which may or may not perform NAT.
— The traffic then goes through a third-party firewall. The
third- party firewall performs firewall functionality on
the traffic before passing it to the VPN device.
— The VPN device then decrypts the encrypted VPN traffic
and passes it to the local network.
Configuration file entries/
routing info:
security profile remote user
remote tunnel johndoe
security-profile remote
user
client-ip 10.250.128.3
255.255.255.255
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
ip route 209.29.128.50
255.255.255.255 johndoe
VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no
client IP)
Subnet: 10.250.128.0 (net-
include) Subnet: 205.25.128.0 (net-include)
ISP IP: 209.29.128.50 ISP IP: 209.29.128.50
VPN Device (NAT by Router)
VPN Device (NAT by Router)VPN Device (NAT by Router)
VPN Device (NAT by Router) VPN Device (No NAT)
VPN Device (No NAT)VPN Device (No NAT)
VPN Device (No NAT)

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
12 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
Figure: Behind a Firewall (One-Armed)
Figure: Behind a Firewall (One-Armed)Figure: Behind a Firewall (One-Armed)
Figure: Behind a Firewall (One-Armed)
Configuring a Behind a Firewall (One-Armed)
Configuring a Behind a Firewall (One-Armed)Configuring a Behind a Firewall (One-Armed)
Configuring a Behind a Firewall (One-Armed)
Network Layout
Network LayoutNetwork Layout
Network Layout
When setting up a VPN device, you must configure many global
configuration settings. You configure the VPN device through
the VPN Manager or command shell.
To set up a behind a firewall (one-armed) configuration, use the
configuration parameters in the following table. Note that the
values of these parametersareexamples only; you must enter
values specific to your network.
Table:
Table:Table:
Table: Behind a Firewall (One-Armed) Configuration
Behind a Firewall (One-Armed) ConfigurationBehind a Firewall (One-Armed) Configuration
Behind a Firewall (One-Armed) Configuration
Parameters
ParametersParameters
Parameters
Internet
Router
VPND
Internet Connection
Direct Dial
Desktop System
File Server
Laser Printer
PSTN
Router or Remote
Access Server
May/May Not NAT
Firewall
Router Mode
May/May Not NAT
Desktop System
E0
VPN Client
Internal Network A
Internal Network B
(directly connected
to Internet)
VPN Device
VPN DeviceVPN Device
VPN Device
(NAT by Router)
(NAT by Router)(NAT by Router)
(NAT by Router) VPN Device (No NAT)
VPN Device (No NAT)VPN Device (No NAT)
VPN Device (No NAT)
Interface E0:
IP: 10.250.128.2 255.255.255.0
Mode: Red
Interface E0:
IP: 205.25.128.2 255.255.255.0
Mode: Red

Client Scenarios
Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 13
Behind a
Behind aBehind a
Behind a
Firewall With or
Firewall With orFirewall With or
Firewall With or
Without NAT
Without NATWithout NAT
Without NAT
(Inline)
(Inline)(Inline)
(Inline)
In this scenario, VPN Client traffic is handled either through a
router (inline) or by directly dialing into the PSTN. The traffic
passes through a third-party firewall that may or may not
perform NAT before passing the traffic to the VPN device.
• For inline router configurations:
— The router accepts all incoming client traffic, then trans-
fers the traffic to the third-party firewall.
— The third-party firewall may or may not perform NAT
before passing the traffic to the VPN device.
— The VPN device then decrypts the encrypted VPN traffic
and passes it to the local network.
• For direct dial into the PSTN:
— Traffic may go through a router or remote access server,
which may or may not perform NAT.
Interface E1: (Not used for
one-armed)
IP: NA
Mode: NA
Interface E1: (Not used for one-
armed)
IP: NA
Mode: NA
Configuration file entries/
routing info:
security profile remote user
remote tunnel johndoe
security-profile remote
user
client-ip 10.250.128.3
255.255.255.255
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
ip route 209.29.128.50
255.255.255.255 johndoe
VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no
client IP)
Subnet: 10.250.128.0 (net-
include) Subnet: 205.25.128.0 (net-include)
ISP IP: 209.29.128.50 ISP IP: 209.29.128.50
VPN Device
VPN DeviceVPN Device
VPN Device
(NAT by Router)
(NAT by Router)(NAT by Router)
(NAT by Router) VPN Device (No NAT)
VPN Device (No NAT)VPN Device (No NAT)
VPN Device (No NAT)

HP VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
14 Hewlett-Packard VPN Server Appliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide
— The traffic then goes through the third-party firewall,
which also may or may not perform NAT before being
handed to the VPN device.
— The VPN device then decrypts the encrypted VPN traffic
and passes it to the local network.
Figure: Behind a Firewall (Inline)
Figure: Behind a Firewall (Inline)Figure: Behind a Firewall (Inline)
Figure: Behind a Firewall (Inline)
Configuring a Behind a Firewall (Inline)
Configuring a Behind a Firewall (Inline)Configuring a Behind a Firewall (Inline)
Configuring a Behind a Firewall (Inline)
Network Layout
Network LayoutNetwork Layout
Network Layout
When setting up a VPN device, you must configure many global
configuration settings. You configure the VPN device through
the VPN Manager or command shell.
To set up a behind a firewall (inline) configuration, use the
configuration parameters in the following table. Note that the
values of these parametersareexamples only; you must enter
values specific to your network.
Internet Router
VPND
Internet Connection
Direct Dial
Firewall
VPN Client
Desktop
System
File Server
Laser Printer
PSTN
Router or Remote
Access Server
May/May Not
NAT
Router Mode
May/May Not NAT
VPNG
E0
E1

Client Scenarios
Hewlett-Packard VPN ServerAppliance SA3110/SA3150/SA3400/SA3450 Network Layout Reference Guide 15
Table:
Table:Table:
Table: Behind a Firewall (Inline) Configuration Parameters
Behind a Firewall (Inline) Configuration ParametersBehind a Firewall (Inline) Configuration Parameters
Behind a Firewall (Inline) Configuration Parameters
The VPN Device
The VPN DeviceThe VPN Device
The VPN Device
as a Firewall
as a Firewallas a Firewall
as a Firewall In this scenario, VPN Client traffic is handled either through a
router (inline) or by directly dialing into the PSTN. The traffic
passes through firewall functionality on the VPN device. The
VPN device may or may not perform NAT before passing the
traffic to the local network.
• For inline router configurations:
— The router accepts all incoming client traffic, then trans-
fers the traffic to the VPN device.
— The third-party firewall may or may not perform NAT
before passing the traffic to the VPN device.
VPN Device (NAT by Router)
VPN Device (NAT by Router)VPN Device (NAT by Router)
VPN Device (NAT by Router) VPN Device (No NAT)
VPN Device (No NAT)VPN Device (No NAT)
VPN Device (No NAT)
Interface E0:
IP: 10.250.128.2 255.255.255.0
Mode: Red
Interface E0:
IP: 205.25.128.2 255.255.255.0
Mode: Red
Interface E1:
IP: 192.168.10.2 255.255.255.0
Mode: Red
Interface E1:
IP: 210.35.129.2 255.255.255.0
Mode: Red
Configuration file entries/
routing info:
security profile remote user
remote tunnel johndoe
security-profile remote
user
client-ip 10.250.128.3
255.255.255.255
Configuration file entries/routing
info:
security profile remote user
remote tunnel johndoe
security-profile remote user
ip route 209.29.128.50
255.255.255.255 johndoe
VPN Client IP: 10.250.128.3 VPN Client IP: Uses ISP IP(no
client IP)
Subnet: 10.250.128.0 (net-
include) Subnet: 205.25.128.0 (net-include)
ISP IP: 209.29.128.50 ISP IP: 209.29.128.50