Example VPN configuration 2: configure VPN settings for the NGFW Engine

If you have already configured VPN settings for the NGFW Engine, there is no need to change any of the settings.

1. Right-click the Firewall element, then select Edit Single Firewall or Edit Firewall Cluster.
2. In the navigation pane on the left, browse to VPN > Sites.
   The Sites represent the addresses that are routable through the VPN. Sites do not grant any host access directly. The Access rules define the allowed connections.
3. (Optional) Select the internal networks that you want to exclude from the VPN by disabling the interface they are under in the automatic site.
   Disabled interfaces are grayed-out.

   • If you want to include some individual network that is under an otherwise disabled interface, drag and drop it from under the disabled interface onto the Site element. The element is copied to the higher level. The copied definition is not updated automatically.
   • The Sites must include only internal networks. Do not add interfaces with the Any Network element in this type of VPN.
4. To use NAT to translate the IP addresses of the hosts that make connections through this VPN, drag and drop the networks for the translated addresses on top of the (top-level) automatic Site element on the right.
5. Click Save.