When BOVPN Virtual Interfaces or manual VPN policies are utilized, Fireware manages traffic crossing the tunnels using standard firewall policies where the tunnel virtual interface names serve as policy source and destination objects.
Evaluating the policy table:
1. Policy 1 (tunnel1-http.out) permits HTTP traffic (TCP port 80) originating from Any source routed out to destination tunnel 1.
2. Policy 2 (tunnel1-http.in) permits HTTP traffic (TCP port 80) originating from tunnel 1 routed inbound to Any destination.
3. Policy 7 (BOVPN-Allow.out) permits Any protocol (which encompasses TCP port 80 HTTP) originating from Any source routed to destination tunnel 2.
4. Policy 8 (BOVPN-Allow.in) permits Any protocol originating from tunnel 2 routed inbound to Any destination.
Because bidirectional allow rules are active for both tunnel endpoints—specifically restricted to HTTP for tunnel 1 and broadly permitted for all services on tunnel 2—HTTP connections can be both initiated and received across both Branch Office VPN tunnels. Therefore, the statement is True.
[Reference: WatchGuard Network Security Essentials — Networking, Policies, and NAT: BOVPN Virtual Interface Policies and Bidirectional Tunnel Filtering., ――――――――――――――――――――――――――――――――――――――――――――――――――――――――――]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit