tailieunhanh - check point ng vpn 1 firewall 1 advanced configuration and troubleshooting phần 4

minh bạch hơn bằng cách sử dụng giấy chứng nhận gắn liền với Active Directory nếu bạn đang sử dụng một mạng Windows. Nếu sử dụng một thiết lập như thế này rộng rãi, chắc chắn nhìn vào sử dụng thẻ tăng tốc hoặc cho mật mã hoặc có thể sử dụng các gói Hiệu suất nếu bạn không chạy trên một nền tảng Windows, | Advanced VPN Client Installations Chapter 5 161 made more transparent by the use of certificates that tie in with the Active Directory if you are using a Windows network. If using a setup like this extensively be sure to look into using either accelerator cards for cryptography or possibly the use of Performance pack if you are not running on a Windows platform for example the SecurePlatform deployment has Performance pack included and gives even more performance gains for cryptography than using accelerator cards on Windows. Figure Encrypting Internal Traffic Unencrypted Traffic Switch on secure network Server Encrypted Traffic passing through unsecure network segment Switch Workstation w SecureClient Using SR SC from Behind a CP-FW-1 System There are many different ways to configure SR SC for the type of protocols that it will use for connectivity. The older more established methods include using Authentication Header AH or Encapsulating Security Payload ESP . The AH method can be dismissed summarily AH does not permit any tampering with the packets so if your client is behind any type of hide NAT firewall the client VPN will not ESP method on the other hand is a little more forgiving and will allow your client VPN to work through a firewall. The newer and currently more widely used method is UDP encapsulation. UDP encapsulation allows the client to encapsulate the payload inside a UDP packet on a port that you specify and uses that port to send all the normal IPSec payload. Allowing ESP mode client VPNs to work through your firewall is going to require three protocols first protocol will be TCP port is also known as FW1-topo and you can find this service description by clicking Manage Services and looking for FWl-topo. See Figure for an illustration of the protocol. FW1-topo is used to allow the client to download site topology to create a new site as well as to update the site if any changes are made to the encryption .