stevefNYC
asked on
VPN solution
This question is more educational than an actual technical/configuration issue. I currently run a small network with an edge c2620 router and a layer 2 3560G switch which does VLAN trunking to a linux firewall/gateway for my end hosts.
My firewall, which sits on the DMZ, is also currently running OpenVPN so users can remotely VPN into the internal network. As this is just currently a beta network, certificate based authentication is all that's used.
Now, this is where my slight dilemma falls into place. I need to allow a set of users to VPN who I don't trust as much. I don't necessarily feel it's a great idea to give them certificate based auth cause they can just toss the certificate on any client and be able to VPN. Also, I'm not responsible for security on their workstations, so if they get compromised, the attacker will have access to my network.
I'd like to figure out a solution to the above. My end users, located in an overseas office, do not have access to their gateway. That, and I'm not entirely sure any of my network equipment have an IOS that supports VPN, but I may be wrong.
Will OpenVPN still be an adequate solution? Should I just make all users authenticate against LDAP? Is there anyway to leave certain users on just certificate based auth and others on LDAP based auth?
My firewall, which sits on the DMZ, is also currently running OpenVPN so users can remotely VPN into the internal network. As this is just currently a beta network, certificate based authentication is all that's used.
Now, this is where my slight dilemma falls into place. I need to allow a set of users to VPN who I don't trust as much. I don't necessarily feel it's a great idea to give them certificate based auth cause they can just toss the certificate on any client and be able to VPN. Also, I'm not responsible for security on their workstations, so if they get compromised, the attacker will have access to my network.
I'd like to figure out a solution to the above. My end users, located in an overseas office, do not have access to their gateway. That, and I'm not entirely sure any of my network equipment have an IOS that supports VPN, but I may be wrong.
Will OpenVPN still be an adequate solution? Should I just make all users authenticate against LDAP? Is there anyway to leave certain users on just certificate based auth and others on LDAP based auth?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.