Summary

Virtual private networks (VPNs) can be used to provide authenticity, privacy, and data integrity. There are two types of VPNs: site-to-site and client-to-site. Both utilize IKE for key management and several encryption algorithms to do the actual encrypting of traffic. The process of establishing a site-to-site VPN can be broken down into three steps: configuring the firewall and/or management stations , configuring the VPN domain, and adding encryption rules to the security policy Rule Base. Establishing a client-to-site VPN is similar, except that users are configured with the proper authentication method, and then the Rule Base is updated with a Client Encrypt rule. Remote users must install the SecuRemote software and download SecuRemote server topology before they can use a client-to-site VPN. Several methods exist for automatically updating site topology. Self-extracting packages can be created to ease the installation and configuration of software onto client systems. (Self-extracting packages are covered in more depth in Chapter 11.)