Printable View
Hello all, I am in need of a vpn solution. Currently we have a AS400 server here at our site that is behind a firewall. Well we have about 50 clients that want to access the server from their homes using their windows boxes. This needs to be a linux solution due to budget. Any recommendations?
Do you want Linux or do you want free or ?
Do you want IPSEC or ssl based?
Most of the free Linux based VPN setups are so poorly documented, that management is
a total PITA. I would never put one in a production environment myself...
Here is a link to a very affordable Linux based vpn setup based on the smoothwall
stuff.
www.smoothwall.net/products/smoothtunnel31
Cheers,
SGS
Quote:
Originally posted here by mrlucifer
Hello all, I am in need of a vpn solution. Currently we have a AS400 server here at our site that is behind a firewall. Well we have about 50 clients that want to access the server from their homes using their windows boxes. This needs to be a linux solution due to budget. Any recommendations?
What type of firewall are you currently using? If your firewall allows for PPTP users, all you will have to do is to define users on that firewall as PPTP users and then on their end they can simply create a new VPN connection from within Windows, using their username and password that you have definded for them on your firewall and they will be granted access to any resources that you define for them. No other software needs to be purchased or installed. At least I know for certain that Watchguard firewalls allow for this type of connection.
Important consideration:
You are granting home users VPN access to the trusted network. Make them clean their boxes and install a firewall before you grant access..... or you could be granting me access to the trusted network too......
Oh.... and log _everything_ that passes from the remote clients to the trusted network and visca-versa......
http://www.smoothwall.org
free, linux, rock solid, VPN support, very well documented, nice logs
Smoothwall has a great solution as already stated, however, as Tiger points out, having the ability to enforce client side policy is *extremely* important. One of the many hats I wear is that of enterprise VPN admin and without the ability to control the minimum requirements of a connecting host (AV, patches, etc.), my network would have more zombies than a Michael Jackson Thriller video.
The last time I checked, Smoothwall did not give you this feature.
While thehorse13 and Tiger Shark make good points, the smoothwall suggestion was an attempt to keep the stated requirement(s) in mind.
VPN solutions with support for AV and Patch checking are expensive and most are NOT vendor neutral. Many have built in firewalls built in to their client while many do not.
Many environments don't have the resources to operate with solutions that include such support. They can however operate with a secure configuration and Smoothwall CAN help them reach some of those goals.
Actually, this used to be true but the new climate in this segment is very competitive. Most if not all security vendors are releasing "God" boxes. These appliances offer VPN (using IPSec/SSL/3DES, etc.), firewall, Spam filter, client-side policy management, e-mail services (SMTP/POP/IMAP) and antivirus. Pricing has come down from the absolutely insane to very affordable. It is certainly true that Smoothwall will meet very basic VPN requirements but if you have a little bit of bling bling sitting around, you may be surprised what you can buy with it these days. Look for Cisco, Nortel, Juniper and Secure Computing to be major players in this space.Quote:
VPN solutions with support for AV and Patch checking are expensive and most are NOT vendor neutral.
Also, interoperability is a *major* buzz word these days. The major players want to be sure that your heterogeneous shop runs well with their drop-in solutions. Many of the vendors walking in my door provide me with a 5 page marketing slick that shows all of the vendors that they work with. This actually makes it a little more difficult when making descisions because the lines of separation begin to blur but that's an entirely different topic altogether. :)
Would these devices be anything like the 5 in 1 printer, copier, scanner, fax machine etc. people sell? It has been my experience that the "all in ones" do only a mediochre job at everything and create a single point of failure that can be a pain in the you-know if you don't have a second device to drop right in there. That just doubled the cost.... ;)
what do you think about this setup?
http://poptop.sourceforge.net/dox/radius_mysql.html
Quote:
Originally posted here by Tiger Shark
Would these devices be anything like the 5 in 1 printer, copier, scanner, fax machine etc. people sell? It has been my experience that the "all in ones" do only a mediochre job at everything and create a single point of failure that can be a pain in the you-know if you don't have a second device to drop right in there. That just doubled the cost.... ;)
Yes, thus far, most of the appliances I have tested do a fair to good job. However, I have seen many of the big players grab up companies that are excellent in each area of offering, so I'm waiting to see an excellent appliance come down the line in the near future.
As far as choke point failure, sure, however, most of the new generation appliances have got beefy failover and fault tolerance features. Of course, as you would expect, you'll need to purchase additional devices (and in some cases, licenses) to implement the failover features.
:)
Of all of the "corporate" AV solutions, only 3 have VPN integration that I know of.Quote:
Originally posted here by thehorse13
The major players want to be sure that your heterogeneous shop runs well with their drop-in solutions. Many of the vendors walking in my door provide me with a 5 page marketing slick that shows all of the vendors that they work with. This actually makes it a little more difficult when making descisions because the lines of separation begin to blur but that's an entirely different topic altogether. :)
Network Associates jives with Checkpoint
Symantec Corp with Checkpoint and maybe nortel stuff.
Trend Micro with Checkpoint
All 3 are quite spendy on the VPN and AV licensing side.
Do you know of any other common combos?
SGS
SonicWall has excellent VPN support. The sonicwall Pro200 has hardware VPN acceleration as well, which pays big when you have multiple clients using the VPN.
Kinda surprised to see no one mention the Linksys VPN router(s). they're incredibly inexpensive ( starting around $80 for 2 tunnel's, $120ish for 70 or so ). stateful packet inspection firewalling. multiple types of VPN support. good SYN flood handling, etc...
Im not trying to sell anyone on um, just had good luck with them so far =)