Re: [fw-wiz] VPN concentrators

From: Dave Piscitello (dave@corecom.com)
Date: 08/26/02 

From: Dave Piscitello <dave@corecom.com>
To: Patrick Darden <darden@armc.org>, scouser@paradise.net.nz
Date: Mon Aug 26 10:34:18 2002

Goes to show you that "best thinking" is subjective.

Firewall appliances with crypto acceleration for IPsec and an optional/DMZ
port satisfy most site requirements without all the extra hardware,
addressing/subnetting, and routing issues (how you return IPsec traffic
when you have FW and VPN appliance in parallel isn't a simple "default
gateway is the firewall" config on the internal network). You also don't
have to manage policy across multiple systems with multiple UIs, and you
don't have to deal with multiple sources of logging and reporting of policy
violations.

I'm happy with this arrangement.

At 08:39 AM 8/26/2002 -0400, Patrick Darden wrote:
>Here is the current best thinking, to my knowledge:
>
> ds3 to internet
> |
> |
>---------------
>Bastion Router|
>---------------
> | |
> | \
>firewall \
> | vpn engine
> | |
>==================
>internal network |
>==================

David M. Piscitello
Core Competence, Inc. &
3 Myrtle Bank Lane
Hilton Head, SC 29926
dave@corecom.com
843.689.5595
www.corecom.com

Relevant Pages