Add Routes for a Tunnel

To add routes for traffic through a branch office VPN tunnel, you add a tunnel route that specifies the local and remote IP addresses for the route.

You can configure an unlimited number of tunnel routes, but the number of tunnel routes that can be active on the Firebox at the same time is limited by the device feature key. For more information, go to VPN Tunnel Capacity and Licensing.

If you select a gateway configured for IPv4, you must specify IPv4 addresses in the tunnel route settings.

In Fireware v12.4 or higher, if you select a gateway configured for IPv6, you must specify IPv6 addresses in the tunnel route settings.

  1. On the Addresses tab of the Tunnel dialog box, click Add.
    The Tunnel Route Settings dialog box appears.

Screen shot of the Tunnel Route Settings dialog box

  1. In the Local IP and Remote IP sections, select the address type from the Choose Type drop-down list. You can specify a host IP address, network address, or a range of host IP addresses. You can also select an Any option to specify a 0.0.0.0 route:
  • In Fireware v12.3.1 or lower, you can select Any (0.0.0.0/0).
  • In Fireware v12.4 or higher, you can select Any IPv4 or Any IPv6.
  1. In the adjacent text boxes, type the values. The IP address you specify must be of the same address family (IPv4 or IPv6) as the gateway.
  2. In the Direction drop-down list, select the direction for the tunnel. The tunnel direction determines which direction traffic can flow through the tunnel.
  3. If you want to enable broadcast routing over this tunnel, select the Enable broadcast routing over the tunnel check box. For more information, go to Enable Broadcast Routing Through a Branch Office VPN Tunnel.
  4. You can use the NAT tab to enable 1-to-1 NAT and dynamic NAT for the tunnel if the address types and tunnel direction you selected are compatible. For more information, go to Configure Outgoing Dynamic NAT Through a Branch Office VPN Tunnel and Configure 1-to-1 NAT Through a Branch Office VPN Tunnel.
  5. Click OK.
  1. On the Addresses tab of the New Tunnel dialog box, click Add.
    The Tunnel Route Settings dialog box appears.

Screen shot of the Tunnel Route Settings dialog box

  1. In the Local and Remote sections, configure one of these options to specify the local and remote network address:
  • (Fireware v12.3.1 or lower) Type an IPv4 address in the text box.
  • (Fireware v12.4 or higher) Type an IPv4 or IPv6 address in the text box.
    The IP address you specify must be of the same address family (IPv4 or IPv6) as the gateway.
  • Click the button adjacent to the Local drop-down list to specify a host IP address, network address, range of host IP addresses, or a host name.
    For IPv6, if you select Host Name, your local computer must be able to resolve the host name to an IPv6 address.
  • (Fireware v12.4 or higher) Select the Any IPv4 or Any IPv6 box to specify a zero route (0.0.0.0/0 or ::/0).
  1. In the Direction drop-down list, select the direction for the tunnel. The tunnel direction determines which direction traffic can flow through the tunnel.
  2. If you want to enable broadcast routing over this tunnel, select the Enable broadcast routing over the tunnel check box. For more information, go to Enable Broadcast Routing Through a Branch Office VPN Tunnel.
  3. You can use the NAT tab to enable 1-to-1 NAT and dynamic NAT for the tunnel if the address types and tunnel direction you selected are compatible. For more information, go to Configure Outgoing Dynamic NAT Through a Branch Office VPN Tunnel and Configure 1-to-1 NAT Through a Branch Office VPN Tunnel.
  4. Click OK.