Re: Security concerns with VPN over IPSEC passthrough
From: Greg Hennessy (nntp@NOSPAM.cmkrnl.cix.co.uk)Date: 07/22/02
- Next message: : "HELP- Checkpoint rules and more ..."
- Previous message: : "Re: GPL firewall which supports IP aliases?"
- In reply to: : "Security concerns with VPN over IPSEC passthrough"
- Next in thread: : "Re: Security concerns with VPN over IPSEC passthrough"
- Reply: : "Re: Security concerns with VPN over IPSEC passthrough"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: Greg Hennessy <nntp@NOSPAM.cmkrnl.cix.co.uk> Date: Mon, 22 Jul 2002 21:26:02 +0100
On Mon, 22 Jul 2002 14:38:30 -0400, "JJB"
<103REMOVE-THIS267.1555@compuserve.com> wrote:
>I understand this can be accomplished
>through a corporate firewall if the firewall supports IPSEC passthrough,
>right?
Depends on the VPN server/software. Some support variations of UDP/TCP
encapsulation of IPSEC, so there is no need to support dedicated IPSEC
passthru per ce. Just plain NAT/PAT will do.
>
>My real question is that currently workstations on the private LAN are
>protected by the firewall with all it's security. If the workstation on the
>private LAN has a VPN tunnel to the public Internet server, does this bypass
>all the security that is in place in the corporate firewall
Potentially, if the client is setup with a split tunnel, most definitely.
> in that the
>private workstation is now wide open to anything running on the other end of
>the VPN tunnel? If so this also opens up the entire private LAN, no?
It can do. Where does the tunnel terminate ? On the remote server or on a
remote VPN device ? Do you own and manage that remote VPN device ?
I generally have a pretty simple policy when it comes to running tunnels
through firewalls, the phrase 'you must be joking' comes to mind.
If you are going to provide the access, do on it a dedicated system
physically disconnected from the core LAN. If you dont control both end
points of the tunnel. Dont allow it.
What the business need for needing remote VPN access ?
greg
>
>Appreciate any comments in this area, thanks
>James
>
>
-- $ReplyAddress =~ s#NOSPAM\.##; Mein herz brennt...
- Next message: : "HELP- Checkpoint rules and more ..."
- Previous message: : "Re: GPL firewall which supports IP aliases?"
- In reply to: : "Security concerns with VPN over IPSEC passthrough"
- Next in thread: : "Re: Security concerns with VPN over IPSEC passthrough"
- Reply: : "Re: Security concerns with VPN over IPSEC passthrough"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
