Subject: Can MS vpn packets be passed through fwtk ?

From: "Lidgate, Chris A" <[email-masked]>
Date: Mon, 14 Feb 2000 09:30:29 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

I've been asked to look at setting up a MicroSoft vpn for our 
company, a vpn gateway that will work with the standard VPN
tools provided by Win 95 / 98 / NT etc.

>From what I can find out I'm not happy :=( Here is the secenario
as I have it at the moment. Some / all of the following may be 
incorrect and if anyone has any other information that contradicts 
any of this, please jump in and let me know.

>From the setup instructions that I've been mailed, I've been
told that I should set up a Win NT box, with two NIC's, that
must be placed IN PARALLEL with out existing fwtk firewall, one
nic on the DMZ, and one nic on our normal 'private' network.
This machine will then handle the vpn traffic directly. I've been 
told that all of the data to and from the vpn is an IP 
protocol of type GRE (General Routing Encapsulation).

I'm particularly unhappy that the Win NT box will straddle 
my current firewall, thus any attacks on this box can totally 
circumvent the current firewall. I'm not an NT expert and I'm
not at all sure about if or how the NT box can be made secure
(lets say as secure as my current firewall).

I've heard it said that it is not possible to pass vpn traffic
through an fwtk firewall. 

>From a (very cursory) look at the rfc's which describe GRE 
(1701 & 1702 - any others ?) I presume that the problem is that 
the GRE packet's will need to be modified as they pass through fwtk, 
is this correct. ?

If this *is* correct then presumably the reason that plug-gw 
would not work is that it's 'dumb' and is not going to modify 
the packet contents.

Finally do any other fwtk users face this problem, and if so
how would you suggest that I proceed.

(Telling my boss to stuff his NT box *is* an option, but I'll
need to have an alternative employer lined up first ;=}

Chris