RE: VPN and Firewall

Hey Serg,

Depending on the grunt of the box, I'd recommend that you deploy the VPN
option on the firewall. Depending on what solution you're using, it
gives you a single point of access control for all traffic (including
your VPN traffic). That is, VPN access can be terminated on the firewall
and security policy can be enforced by the firewall. By deploying a
separate VPN server, you need to configure security policy for another
point in your network, potentially adding to complication and
administration cost. It also means that you have to manage another
server.

Just my thoughts.

Regards,

Jason Ha [CISSP, CCSE, JNCIS-FWV]
Senior Security Engineer,
Security Operations Centre
VeriSign Australia

-----Original Message-----
From: sergb@tpg.com.au [mailto:sergb@tpg.com.au] 
Sent: Thursday, 10 March 2005 10:34 AM
To: firewalls@securityfocus.com
Subject: VPN and Firewall

Hi All, 

I am running a Linux based firewall and now need to deploy a VPN.
Because firewall runs on a Linux box, I can install all network security
software on that box (within reason ofcourse), so my question is: 

Would it be better to install a VPN solution on the firewall box itself
or on a physically different machine and why? 

    Thanks,
        Serg