Connection String to AS400 through ASP through a VPN

Well, it depends on you network configuration, and your application requirements.

Why don't you tell us more about what you need to do, from a business perspective.

You need to be aware that improper configuration or application design can result in you exposing your AS/400 to the world over the internet, and possibly disclosing valid user IDs and passwords to any intermediate network at the same time.  This is not good.  If you have any doubts about how to go about creating a secure connection and a secure application, get some expert help!

This kind of connection problematic form a security perspective.  

The reason is that you have an insecure, publicly exposed ASP server that can be accessed by anyone, and you want to allow it to make inbound connections to your secure AS/400 on your secure network.  Because of the nature of these applications, they also often contain valid user IDs and passwords embedded in connections string, config files, or other locations where they may be discovered if the ASP system is compromised.  The ASP system then can be used as a launch pad from which to either compromise the secure network or secure server (AS/400 in this case), or the interfaces between the systems can be compromised and end user input and responses monitored, false information can be injected, and illegal queries/updates/deleted attempted.  Depending on the application, and the nature of the data stored on the secure system, this could be very bad.

Creating  secure applictions in this environment requires some very careful planning and design.

• First of all, have the application server tightly locked down, with no services other than HTTP/HTTPS exposed, properly firewalled and kept current with security patches. 
• Second, encrypt all conversations between the two networks or systems. 
• Third,  strictly limit the  number and type of services opened up between the two systems.
   
• Fourth, have the  secure system initiate connections to the insecure system, not the other way around.  Applications built around messaging and queueing standards (MQ) or web services are great for this purpose.  
   
• Fifth, once the connection is established, strictly limit the type of requests that the insecure system can make of the secure system.  For example, allow application-specific messages to be passed, but do not allow raw SQL statements to be executed from the remote system.  Set up a mechanism to detect and log any unusual or invalid requests. 
• Where possible, authenticate application users on the insecure system, and only permit authorized users to access your applications.
   

One more minor note...

> You need to be aware that improper configuration or application design can result in you exposing your AS/400 to the world over the internet...

But, also be aware that your AS/400 is the most secureable box in the whole setup. Companies often expose Windows boxes while simultaneously fearing to expose their AS/400. Fundamental guidelines can allow your AS/400 to be exposed without much concern. Obviously, if it's not secure on the internal network, it won't be better on the internet.

A Windows server with a VPN connection is effectively an inside server. The VPN provides the opening.

Tom