According to the Wonderware SR # 2461129
VPN is not supported across a Galaxy. It blocks DCOM which will disable many things such as Platform Manager and Object Viewer. Authentication with a domain will not be updated throughout a galaxy, you will have to authenticate on the GR ->
Domain Controller each time you log in at a new site. InSQL will not work either. The only way it will work is to have a dedicated connection to all the machines. Not through the Internet. In order to get AppServer and InSQL to work they will need at least 1Mb/s bandwidth. So, they will need to call their phone company and set up a leased line that will directly route each site to the GR with that bandwidth.
Which does not make sense to me as my Cisco PIX to IOS FW router does not block any ports. I have Domain Controllers on the other sides of DSL Connections and they Sync up just fine with the Corporate Servers.
Any Ideas on why they might be saying this?