|
22 | 22 | under the License. |
23 | 23 | --> |
24 | 24 | <section id="vpn"> |
25 | | - <title>VPN</title> |
26 | | - <para>&PRODUCT; account owners can create virtual private networks (VPN) to access their virtual machines. If the guest network is instantiated from a network offering that offers the Remote Access VPN service, the virtual router (based on the System VM) is used to provide the service. &PRODUCT; provides a L2TP-over-IPsec-based remote access VPN service to guest virtual networks. Since each network gets its own virtual router, VPNs are not shared across the networks. VPN clients native to Windows, Mac OS X and iOS can be used to connect to the guest networks. The account owner can create and manage users for their VPN. &PRODUCT; does not use its account database for this purpose but uses a separate table. The VPN user database is shared across all the VPNs created by the account owner. All VPN users get access to all VPNs created by the account owner.</para> |
27 | | - <note><para>Make sure that not all traffic goes through the VPN. That is, the route installed by the VPN should be only for the guest network and not for all traffic.</para></note> |
28 | | - <para></para> |
29 | | - <itemizedlist> |
30 | | - <listitem><para><emphasis role="bold">Road Warrior / Remote Access</emphasis>. Users want to be able to |
31 | | - connect securely from a home or office to a private network in the cloud. Typically, |
32 | | - the IP address of the connecting client is dynamic and cannot be preconfigured on |
33 | | - the VPN server.</para></listitem> |
34 | | - <listitem><para><emphasis role="bold">Site to Site</emphasis>. In this scenario, two private subnets are |
35 | | - connected over the public Internet with a secure VPN tunnel. The cloud user’s subnet |
36 | | - (for example, an office network) is connected through a gateway to the network in |
37 | | - the cloud. The address of the user’s gateway must be preconfigured on the VPN server |
38 | | - in the cloud. Note that although L2TP-over-IPsec can be used to set up Site-to-Site |
39 | | - VPNs, this is not the primary intent of this feature. For more information, see <xref linkend="site-to-site-vpn"/></para></listitem> |
40 | | - </itemizedlist> |
41 | | - <xi:include href="configure-vpn.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> |
42 | | - <xi:include href="using-vpn-with-windows.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> |
43 | | - <xi:include href="using-vpn-with-mac.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> |
44 | | - <xi:include href="site-to-site-vpn.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> |
| 25 | + <title>Remote Access VPN</title> |
| 26 | + <para>&PRODUCT; account owners can create virtual private networks (VPN) to access their virtual |
| 27 | + machines. If the guest network is instantiated from a network offering that offers the Remote |
| 28 | + Access VPN service, the virtual router (based on the System VM) is used to provide the service. |
| 29 | + &PRODUCT; provides a L2TP-over-IPsec-based remote access VPN service to guest virtual networks. |
| 30 | + Since each network gets its own virtual router, VPNs are not shared across the networks. VPN |
| 31 | + clients native to Windows, Mac OS X and iOS can be used to connect to the guest networks. The |
| 32 | + account owner can create and manage users for their VPN. &PRODUCT; does not use its account |
| 33 | + database for this purpose but uses a separate table. The VPN user database is shared across all |
| 34 | + the VPNs created by the account owner. All VPN users get access to all VPNs created by the |
| 35 | + account owner.</para> |
| 36 | + <note> |
| 37 | + <para>Make sure that not all traffic goes through the VPN. That is, the route installed by the |
| 38 | + VPN should be only for the guest network and not for all traffic.</para> |
| 39 | + </note> |
| 40 | + <para/> |
| 41 | + <itemizedlist> |
| 42 | + <listitem> |
| 43 | + <para><emphasis role="bold">Road Warrior / Remote Access</emphasis>. Users want to be able to |
| 44 | + connect securely from a home or office to a private network in the cloud. Typically, the IP |
| 45 | + address of the connecting client is dynamic and cannot be preconfigured on the VPN |
| 46 | + server.</para> |
| 47 | + </listitem> |
| 48 | + <listitem> |
| 49 | + <para><emphasis role="bold">Site to Site</emphasis>. In this scenario, two private subnets are |
| 50 | + connected over the public Internet with a secure VPN tunnel. The cloud user’s subnet (for |
| 51 | + example, an office network) is connected through a gateway to the network in the cloud. The |
| 52 | + address of the user’s gateway must be preconfigured on the VPN server in the cloud. Note |
| 53 | + that although L2TP-over-IPsec can be used to set up Site-to-Site VPNs, this is not the |
| 54 | + primary intent of this feature. For more information, see <xref linkend="site-to-site-vpn" |
| 55 | + /></para> |
| 56 | + </listitem> |
| 57 | + </itemizedlist> |
| 58 | + <xi:include href="configure-vpn.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/> |
| 59 | + <xi:include href="using-vpn-with-windows.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/> |
| 60 | + <xi:include href="using-vpn-with-mac.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/> |
| 61 | + <xi:include href="site-to-site-vpn.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/> |
45 | 62 | </section> |
0 commit comments