
VMware, Inc. 53
Chapter 10 vShield Edge Management
5UnderStaticBindings,clickAddBindings.
Anewrowappearsinthetable.
6Double‐clickeachcellintherowtoenterorselecttheappropriateinformation.
ThePrimaryNameServerandSecondaryNameServ erfieldsrefertoDNSservice.YoumustentertheIP
addressofaDNSserverfor
hostname‐to‐IPaddressresolution.
7ClickCommittosavetherule.
8IfDHCPservicehasnotbeenenabled,enableDHCPservice.
See“StartorStopvShieldEdgeServices”onpage 56.
Manage VPN Service
vShieldEdgemodulessupportsite‐to‐siteIPSecVPNbetweenavShieldEdgeandremotesites.
Figure 10-1. vShield Edge Providing VPN Access from a Remote Site to a Secured Port Group
Atthistime,vShieldEdgesupportspre‐sharedkeymode,IPunicasttraffic,andnodynamicroutingprotocol
betweenthevShieldEdgeandremoteVPNrouters.BehindeachremoteVPNrouter,youcanconfigure
multiplesubnetstoconnecttotheinternalnetworkbehindavShieldEdgethroughIPSectunnels.These
subnetsandtheinternalnetworkbehindavShieldEdgemusthavenon‐overlappingaddressranges.
YoucandeployavShieldEdgeagentbehindaNATdevice.Inthisdeployment,theNATdevicetranslatesthe
VPN
addressofavShieldEdgeintoapubliclyaccessibleaddressfacingtheInternet.RemoteVPNroutersuse
thispublicaddresstoaccessthevShieldEdge.
RemoteVPNrouterscanbelocatedbehindaNATdeviceaswell.YoumustprovideboththeVPNnative
addressandtheNATpublicaddress
tosetupthetunnel.
Onbothends,staticone‐to‐oneNATisrequiredfortheVPNaddress.
Komentarze do niniejszej Instrukcji