Solved

VPN Concentrator 3005 Placement

Posted on 2007-04-11
1
351 Views
Last Modified: 2008-01-09
My current Network is as follows:-

Router (X.X.X.129)  >  PIX 515e (X.X.X.131)  >  LAN (10.1.1.0\24)

At present I am using the Cisco VPN Software Client 4.8 to connect to the PIX using IP address X.X.X.131, which then enables users to connect to any server /  host on the 10.1.1.0 network (ports 500 and 4500 have an ACL to forward for NAT transparency)

FTP connections point to the IP address X.X.X.135 (using static route and ACL to pass port 21 to FTP server on 10.1.1.2

SMTP connection point to the IP Address X.X.X.133 (using static route and ACL to pass port 25 to Barracuda Spam Firewall on 10.1.1.5)

WWW / HTTPS connections point to the IP address X.X.X.132 (using static route and ACL to pass ports 80/443 to Exchange Server 10.1.1.9)

Now throw into the mix a donation of 3005 VPN Concentrator and a few 3002 Clients (for remote hosts).

My problem is where do I place the 3005?  

Ultimately, I want to remove the VPN tunneling from the PIX and have the 3005 handle all this and the pix just block or forward traffic.  However, do I place the 3005 between the router and the pix, or do I assign another public IP, say X.X.X.136 to the DMZ port of the PIX and connect the 3005 there.

Any insight / logic would be appreciated.

0
Comment
Question by:zejoka
1 Comment
 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
ID: 18902411
I've seen it done both ways.  I've personally implemented more VPN 3005 concentrators placed right beside the firewall rather than behind it in the DMZ. This doesn't mean put it between the router and the PIX, but right beside the PIX where the public interface of the VPN 3005 would be on the same subnet as the PIX public interface, and the VPN 3005 private interface would be on the same subnet as the PIX private interface.  This makes for easier implementation since you won't have to modify any firewall rules to get it working.

The VPN 3005 is a hardened appliance like the firewall, but will only accept connections from a VPN client...in other words, you cannot configure it to forward traffic inbound based on ACL's or anything like that.  It is strictly meant for VPN traffic.  So I don't see a problem putting giving it a public address on it's public interface.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now