Where does the VPN server go?
Assuming a common network topology consiting of a 3 legged firewall with internal network and DMZ, where would a vpn server be commonly placed? (VPN for remote users, not site-to-site)
-ON the firewall?
-behind firewall on the internal network?
-behind firewall in the DMZ?
What kind of authentication is commonly used with users?
Could/should vpn auth be integrated with internal network's DCs (W2k pdc for example (with kerberos?))
Thanx
Ammo
Re: Where does the VPN server go?
Ammo,
Let me give you the CORRECT answer with regards to this. If you want to have a VPN for remote users it should either sit directly ON the Firewall or exactly in parallel with the Firewall. The VPN should have an outside live ip address and in order for you to ever be able to pass through this VPN Server you must be able to authenticate through it. So say you are using a PIX firewall and a Cisco VPN Concentrator, you would have your Core Router connected to the internet, then a switch between your router, the vpn concentrator and pix firewall. both the firewall and vpn server have a live ip address. If you are going to have a high number of users authenticating to your vpn server and have a nice pocket of $$$, check out the cisco vpn concentrators, they are very simple to setup and excellent.
http://cisco.com/warp/public/44/jump/vpn_devices.shtml
They come with a software package which you load on the computers and acts as the vpn client.
No reason to add the VPN Server to the DMZ. Its just causing a crap load of added traffic to your dmz causing possible collisions to important traffic going to your servers. Unless you want to over kill your dmz and go gigabit.. :D
You dont want to put the vpn server behind your firewall. as you said, it opens up a nice hole within your firewall.
Regards,