Solved

VPN Concentrator 3005 Placement

Posted on 2007-04-11
1
362 Views
Last Modified: 2008-01-09
My current Network is as follows:-

Router (X.X.X.129)  >  PIX 515e (X.X.X.131)  >  LAN (10.1.1.0\24)

At present I am using the Cisco VPN Software Client 4.8 to connect to the PIX using IP address X.X.X.131, which then enables users to connect to any server /  host on the 10.1.1.0 network (ports 500 and 4500 have an ACL to forward for NAT transparency)

FTP connections point to the IP address X.X.X.135 (using static route and ACL to pass port 21 to FTP server on 10.1.1.2

SMTP connection point to the IP Address X.X.X.133 (using static route and ACL to pass port 25 to Barracuda Spam Firewall on 10.1.1.5)

WWW / HTTPS connections point to the IP address X.X.X.132 (using static route and ACL to pass ports 80/443 to Exchange Server 10.1.1.9)

Now throw into the mix a donation of 3005 VPN Concentrator and a few 3002 Clients (for remote hosts).

My problem is where do I place the 3005?  

Ultimately, I want to remove the VPN tunneling from the PIX and have the 3005 handle all this and the pix just block or forward traffic.  However, do I place the 3005 between the router and the pix, or do I assign another public IP, say X.X.X.136 to the DMZ port of the PIX and connect the 3005 there.

Any insight / logic would be appreciated.

0
Comment
Question by:zejoka
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
ID: 18902411
I've seen it done both ways.  I've personally implemented more VPN 3005 concentrators placed right beside the firewall rather than behind it in the DMZ. This doesn't mean put it between the router and the PIX, but right beside the PIX where the public interface of the VPN 3005 would be on the same subnet as the PIX public interface, and the VPN 3005 private interface would be on the same subnet as the PIX private interface.  This makes for easier implementation since you won't have to modify any firewall rules to get it working.

The VPN 3005 is a hardened appliance like the firewall, but will only accept connections from a VPN client...in other words, you cannot configure it to forward traffic inbound based on ACL's or anything like that.  It is strictly meant for VPN traffic.  So I don't see a problem putting giving it a public address on it's public interface.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question