VPN Concentrator placement

C

cb9fl

Limp Gawd
Joined
Jan 2, 2006
Messages
456
I'm having a hard time determining the proper placement of a VPN concentrator.

Suppose a company has a /30 from their ISP with a Cisco 2801 running Adv Sec as the firewall. Where would a VPN 3000 go? The only placement I can see is on the LAN side of the 2801 which would require the concentrator to be NATed. Would that work? How would clients connect to the VPN 3000?

Would a company normally have the 2801 run as a straight router and instead obtain a block of IPs from the ISP? That would allow an ASA or PIX to run as the firewall with a VPN 3000 within the block of IPs from the ISP.

What is normal PIX/ASA - VPN 3000 IP addressing scheme?
 
attaching it directly to the lan sounds like a bad idea as you are effectively circumventing the firewall and potentially bridging your lan and the internet. anything internet facing i always place in a firewalled dmz on a private address and then use network address translation to surface it to a public address.
 
I don't know if i'd consider our 3005 install normal or not but here is how its installed.

vpninstall.jpg


Essentially we have the outside interface of the 3005 on its own separate vlan (with public address) getting trunked to the 2621 and is physically plugged into the PIX.

The inside interface of the 3005 is on the customers inside vlan. (both interfaces are plugged into the L3 core)

Hope this helps, sometimes even I get confused.
 
Our 3020 sits with its private port plugged into our LAN. Its WAN port has a public IP.
 
atomiser said:
attaching it directly to the lan sounds like a bad idea as you are effectively circumventing the firewall and potentially bridging your lan and the internet. anything internet facing i always place in a firewalled dmz on a private address and then use network address translation to surface it to a public address.
Click to expand...

Thats kind of that point, at least in my organization. When someone enters on the 3020, either via hardware client, LAN to LAN session, or software client, I want them with access to all resources, unobstructed.
 
every environment is different so whatever works best for you. me, i prefer a layered approach to security.
 
so uh... if its all set up now, whats not working? pretty much anything other than what you have diagramed, and i think you are goign to need more than a /30.
 
You must log in or register to reply here.
Back
Top