The following figure shows a VPN tunnel between two sites.

When a client that is secured by VPN Peer A needs content from a server located at the other site, VPN Peer A initiates a connection request to VPN Peer B.

It uses certificates for device authentication, SSL for securing communication between all components, and IPSec to secure data. Figure: VPN Deployments 420 PAN-OS 6.0 Administrator s Guide Palo Alto Networks, Inc.

VPNs Site-to-Site VPN Overview Site-to-Site VPN Overview A VPN connection that allows you to connect two Local Area Networks (LANs) is called a site-to-site VPN.

After successful authentication, the peers negotiate the encryption mechanism and algorithms to secure the communication.

The IP Security (IPSec) set of protocols is used to set up a secure tunnel for the VPN traffic, and the information in the TCP/IP packet is secured (and encrypted if the tunnel type is ESP).

The IP packet (header and payload) is embedded in another IP payload, and a new header is applied and then sent through the IPSec tunnel.

The source IP address in the new header is that of the local VPN peer and the destination IP address is that of the VPN peer on the far end of the tunnel.

When the packet reaches the remote VPN peer (the firewall at the far end of the tunnel), the outer header is removed and the original packet is sent to its destination.