Define a VPN site for internal private networks

You must define site elements for all Security Engines and External VPN Gateways that are used in policy-based VPNs.

The site elements must always contain the actual IP addresses that are used inside the VPN tunnel. If traffic in the tunnel is subject to NAT, you must add the NAT addresses to the site. For Security Engines, you must add both the NAT addresses and any untranslated IP addresses that are not automatically added to the site. Sites for External VPN Gateways only require the translated address space that the Security Engine actually contacts.

The local and remote site definitions must match the same information about the other gateways involved in the VPN because the gateways verify this information during IKE negotiation. When creating VPNs with external Gateways, make sure that the IP address spaces of both gateways are defined identically in the SMC and on the external device. Otherwise, the VPN establishment can fail in one or both directions. Make sure to update the policies of any firewalls that are involved in the VPN when there are changes in the Site elements at either end.

If you want to use a central gateway as a hub that forwards traffic from one VPN tunnel to another, include all IP addresses that are accessible through the central gateway in the central gateway’s Site elements.

Note: You cannot add or change Site elements under the VPN Client Gateway element.

For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Right-click the Engine, then select Edit Single Engine and browse to VPN > Sites.
  2. Select the elements that represent the protected IP addresses behind the gateway, then click Add to include them in this site.
    • Do not include IP addresses outside the Gateway’s local networks in the site. There is no need to include the Gateways’ own IP addresses in the sites. However, there is usually no need to exclude those addresses if they are in the networks you add to the site.
    • IP address ranges might be interpreted differently from lists of IP addresses and networks depending on the VPN device. The system converts Group or Expression elements into address ranges, networks, or individual IP addresses depending on the IP addresses included. Other VPN devices might treat the same types of values differently.
    • VPN Traffic Selector elements allow you to define the IP addresses, protocols, and ports used by a specific host in a VPN site.
  3. Click Save.

Next steps

If you edited a previously configured VPN, make sure that the configuration of any external VPN gateway device involved contains the same IP address information. Refresh the policy on all affected gateways to transfer the changes.