?
Solved

Best practice for VPLS service

Posted on 2013-11-16
1
Medium Priority
?
823 Views
Last Modified: 2013-11-17
I am wondering what the best practice is for a VPLS connection.  Since the connection is a VPN LAN on the same LAN segment as my network is it really necessary to have a firewall between the VPLS end point and my network edge?

Thanks for any help...

Jerry
0
Comment
Question by:adminjam
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 64

Accepted Solution

by:
btan earned 1500 total points
ID: 39654180
there is some good discussion in this forum, primarily the FW filter for authorised protocol and permitted traffic. VPLS create that secure tunnel that all, also the local LAN should be segregated prior to the external facing of other site VPN LANs..

https://supportforums.cisco.com/thread/2171058

Your Firewalls at both Sites Can be placed at the WAN connecting between sits, use Multi-VRF lite in your internal LAN for both sites. this ensures segmentation and path isolation between the Small offices Locally. On both Firewalls, you Can Only allow VOIP communication between Sites and add permissions as per your requirement.

it would be good to place a FW in the LAN of each site, even if you dont have a L3 Switch locally to perform the Inter-Vlan routing between Offices, You Can then Leave this functionality to the Firewall, with right Access permition & (Security Level), a FW can do routing between your internal.

FW can do specific filter against VPLS too...overall is to tighen and not be reliant on one layer which can be just encrypted tunnels pt to pt only.

http://www.juniper.net/techpubs/en_US/junos/topics/reference/general/firewall-filter-match-conditions-for-vpls-traffic.html
0

Featured Post

Building an interactive eFuture classroom

Watch and learn how ATEN provided a total control system solution including seamless switching matrix switch, HDBaseT extenders, PDU, lighting control to build an interactive eFuture classroom.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Examines three attack vectors, specifically, the different types of malware used in malicious attacks, web application attacks, and finally, network based attacks.  Concludes by examining the means of securing and protecting critical systems and inf…
Keystroke loggers have been around for a very long time. While the threat is old, some of the remedies are new!
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question