RE: [fw-wiz] VPN endpoints

From: Fetch, Brandon (BFetch_at_texpac.com)
Date: 08/25/04

  • Next message: Bruce Platt: "[fw-wiz] Off-Topic: Memo of Understanding for Using an Ethical Hacker" 
    To: firewall-wizards@honor.icsalabs.com
Date: Wed, 25 Aug 2004 13:32:24 -0500

    I think you'll find that there are two 'accepted' installation methods with
    one some consider to be more secure than the other.

    Terminate the VPN on either of these networks - DMZ or Inside.

    If you're referring to a Cisco VPN concentrator with two interfaces (public
    & private), the public obviously goes on the outside network with a publicly
    accessible IP address.
    Where the private interface goes is the big issue.

    The more secure setup is 'terminating' the VPN on the DMZ as this allows you
    to then filter any/all traffic that is coming in through the VPN using your
    DMZ ACLs. You can have the VPN clients receive a different IP address scope
    from the DMZ network hosts and then restrict where those IP addresses can
    go.

    If you're confident in your internal security and feel like letting your VPN
    clients run rampant inside your corporate network then terminate the VPN on
    the Inside network with an internally routable addressing scheme. However,
    they're free to muck about with whatever/wherever they desire. :)

    HTH!

    Brandon Fetch
    817-871-4036
    -- carpe ductum -- "Grab the tape"

    -----Original Message-----
    From: hermit921 [mailto:hermit921@yahoo.com]
    Sent: Tuesday, August 24, 2004 12:37 PM
    To: firewall-wizards@honor.icsalabs.com
    Subject: [fw-wiz] VPN endpoints

    We are planning to put a VPN endpoint at our site for remote access. We
    know nothing about the remote client computers, we just provide an
    authentication mechanism for the users. The question concerns where we put
    the VPN endpoint on our network.

    I figure it this way: 2 VPN device interfaces, either of which can go
    outside the firewall, on a DMZ, or inside the firewall. That gives us 9
    possible arrangements, some of which are ridiculous, but fun to
    consider. We came down to two configurations.

    One approach is putting the internal interface on a DMZ. The other
    approach is to have the VPN bypass the firewall entirely. I am looking for
    advice on which approach is better, and reasons why.

    hermit921

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

    This message is intended only for the person(s) to which it is addressed
    and may contain privileged, confidential and/or insider information.
    If you have received this communication in error, please notify us
    immediately by replying to the message and deleting it from your computer.
    Any disclosure, copying, distribution, or the taking of any action concerning
    the contents of this message and any attachment(s) by anyone other
    than the named recipient(s) is strictly prohibited.

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Bruce Platt: "[fw-wiz] Off-Topic: Memo of Understanding for Using an Ethical Hacker"

    Relevant Pages

    • Re: [Full-disclosure] Remote Desktop Command Fixation Attacks
      ... This set of steps is redundant in many places, and it's also enormously expensive, since you're using no less than three different expensive bits of networking hardware (AP, PIX, VPN Concentrator), in addition to a bunch of x86 server hardware, windows server licenses, and at least one ISA license. ... Your computers necessarily don't have full access to your network infrastructure when they aren't logged on, so GPOs, software updates, etc can't be applied at the times you want them to be applied. ... Turning on, enabling, and implementing every possible security setting and device you think of is not defence in depth, and will probably only have two effects - your users won't use your wireless network, and you'll burn so much cash you won't have any left to spend on *useful* security measures. ...
      (Full-Disclosure)
    • TidBITS#792/15-Aug-05
      ... We also note the release of Security Update 2005-007, ... Macintosh FTP client, free for educational and charitable use. ... mentioned virtual private network (VPN) technologies. ...
      (comp.sys.mac.digest)
    • Re: Access to network drives for home and roaming users
      ... All the VPN does is to add a security layer to the remote access, ... Do you want the data in a DMZ, or do you want them to come straight ... through the firewall to your LAN? ... have a windows 2003 R2 network with an internal and perimeter network, ...
      (microsoft.public.inetserver.iis.security)
    • RE: VPN Error 800
      ... The VPN client IP is 10.0.1.40, this is a private IP address. ... server IP address is 81.137.105.244, this is a Internet IP address. ... not test VPN connection from your perimeter network. ... SBS on your switch to make it work. ...
      (microsoft.public.windows.server.sbs)
    • Re: VPN with SBS 2003 (not R2) and DSL.
      ... Reading property value for VPN returned OK ... Reading VPN Server Name returned OK ... identical network cards. ... it seems doubtful that SBS will work properly with two NICs ...
      (microsoft.public.windows.server.sbs)