A VPN (Virtual Private Network) creates secure connections between computers or networks in different locations. Each connection is known as a tunnel. When a VPN tunnel is created, the two tunnel endpoints authenticate with each other. Data in the tunnel is encrypted. Only the sender and the recipient of the traffic can read it.
Branch Office Virtual Private Networks (BOVPN) enable organizations to deliver secure, encrypted connectivity between geographically separated offices. The networks and hosts on a BOVPN tunnel can be corporate headquarters, branch offices, remote users, or telecommuters. These communications often contain the types of critical data exchanged inside a corporate firewall. In this scenario, a BOVPN provides confidential connections between these offices. This streamlines communication, reduces the cost of dedicated lines, and maintains security at each endpoint.
With WatchGuard System Manager, you can quickly and easily configure IPSec tunnels that use authentication and encryption. You can see that these tunnels operate with other tunnels and security policies. These tunnels are called managed BOVPN tunnels. Another type of tunnel is a manual BOVPN tunnel, which is a BOVPN tunnel that you use dialog boxes to define. For information on this type of tunnel, see About Manual Branch Office VPN Tunnels.
You can quickly create a manual tunnel between devices with a drag-and-drop procedure and a simple wizard, as described in Make Managed Tunnels Between Devices.
However, you must make sure you have performed these procedures before you create managed tunnels:
The certificate must be recognized as an "IPSec"-type certificate by Firebox System Manager. To verify this, Start Firebox System Manager, select View > Certificates, and make sure the Type column in the Certificates dialog box that appears says "IPSec" or "IPSec/Web." If you do not have a third-party or self-signed certificate, you must use the certificate authority on a Management Server.
For more information, see Configure the Certificate Authority on the Management Server.
You can use several options to customize managed VPN tunnels:
VPN Failover, described in Configure VPN Failover, is supported with managed BOVPN tunnels. If you have multi-WAN configured and you create managed tunnels, WSM automatically sets up gateway pairs that include the external interfaces of both ends of your tunnel. No other configuration is necessary.
Global VPN settings on your Firebox or XTM device apply to all manual BOVPN tunnels, managed tunnels, and Mobile VPN tunnels. You can use these settings to:
To change these settings, from Policy Manager, select VPN > VPN Settings. For more information on these settings, see About Global VPN Settings.
You can use Firebox System Manager to see the current status of BOVPN tunnels. This information also appears on the Device Status tab of WatchGuard System Manager. For more information, see VPN Tunnel Status and Subscription Services.
You can use Firebox System Manager to immediately generate new keys for BOVPN tunnels instead of waiting for them to expire. For more information, see Rekey BOVPN Tunnels.