Subject: VPN placement, ssh, dmz services

From: MONZ <[email-masked]>
Date: Tue, 04 Apr 2000 12:17:53 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Given a typical firewall setup like:

  ----firewall----dmz-----router-+-------internal servers
         |                       +-------adm/economy
        vpn                      +-------workstations

Wouldn't it be safest to place vpn directly on the firewall, as shown?
Vpn could be placed on the router, but if the vpn is compromized, access
may be possible to the whole internal net, right?

Now, if several depts. must be interconnectet through vpn, I guess more
netcards can simply be added to the firewall, or another router can be
added there, like:

  ----firewall----dmz
         |
      router-+--vpn
             +--vpn
             +--vpn

Any experiences with vpn products that works well in a mixed Linux/NT
server and Linux/windoze workstation environment are welcome.
Ditto with making (different versions of) ssh work in above situations.

One more thing: When several public services is placed on the dmz, it
should suffice to split the dmz with a hub, or is a switch nessesary
here?
-- 
Mogens Valentin  WWW: http://www.danbbs.dk/~monz/  mailto:[email-masked]
Web, Programming, Network, Security - Installguides and docs for Linux..
Skaane/Sjaelland Linux User Group (5200++ members) - http://www.sslug.dk
Use http://www.linux.org/ for freedom of choice with OpenSource software

---

From: Keith Young <[email-masked]>
Date: Tue, 04 Apr 2000 13:45:21 -0400

> Wouldn't it be safest to place vpn directly on the firewall, as shown?

Yes. That is one method of installation that we do with our VPN product
(Gauntlet/Raptor/Progressive + SmartGate VPN = SmartFireWall).

It usually works okay... just be wary of things such as CPU load and
disk space for logging.

> may be possible to the whole internal net, right?

Very true. I wouldn't recommend this at all.

> should suffice to split the dmz with a hub, or is a switch nessesary

Depends. If you have a fairly high amount of traffic on that net, a
switch would be a better solution. However, note that sniffing traffic
or intrusion detection systems won't work well on a switch.

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]

---

From: MONZ <[email-masked]>
Date: Tue, 04 Apr 2000 21:50:12 +0200

> Wouldn't it be safest to place vpn directly on the firewall, as shown?

Can't locate the source where I (at least) believe I saw the above
setup.
Further reading clearified that vpn is most often established as a pure
software solution on the firewall using one and same internet
connection.
But does situations exist where one would choose a separate connection?

I find it amazing that so few are working with vpn; by now I should've
been corrected here, like on three other security/firewall
maillist/newsgroups.
-- 
Mogens Valentin  WWW: http://www.danbbs.dk/~monz/  mailto:[email-masked]
Web, Programming, Network, Security - Installguides and docs for Linux..
Skaane/Sjaelland Linux User Group (5200++ members) - http://www.sslug.dk
Use http://www.linux.org/ for freedom of choice with OpenSource software

---

From: Markus Schreier <[email-masked]>
Date: Wed, 05 Apr 2000 08:20:46 +0200

Hi,
sorry, to understand this thread: 
SOme theoretical things about the questions:
vpn is as fare as i know virtual private network.
It is a possibility to connect some far away places through the internet
by ip-tunneling.
The IP-traffic is cipherd and packed into other ip-packets. Being at the
destination place the original data is decoded.
If i understand you correctly, the question is, where to encode / decode 
the packets?
If this is misleading, please correct me. 

Markus

---

From: Gareth Bromley <[email-masked]>
Date: Wed, 05 Apr 2000 07:39:18 +0100

> Very true. I wouldn't recommend this at all.

I find it quite strange that the firewall administrator doesn't have direct
control of the external router to implement initial network filtering (Increase
security, reduce traffic hitting the firewall). e.g.

Ext network----Ext Router----firewall----dmz----Internal Router----.....

In the above case using an external router, this could be used as the VPN end
point, as with have done over a number of technologies. A caveat however, the
router vendors have been quite slow deploying fully IPSEC compliant solutions, and
in some cases require a mix of part IPSEC + proprietary to make VPNs (This
normally makes these solutions less friendly ;) )

It really depends on the type of client connecting I guess, remote site or remote
user. I like Keiths SmartGate for users (especially with SmartCards), external
router based solution for sites. Horses for courses I guess,

Just my 2p worth,

--Gareth

---

From: MONZ <[email-masked]>
Date: Wed, 05 Apr 2000 17:42:47 +0200

Gareth Bromley wrote:
> > > Vpn could be placed on the router, but if the vpn is compromized,
> > > access may be possible to the whole internal net, right?

> I find it quite strange that the firewall administrator doesn't have
> direct control of the external router to implement initial network
> filtering (Increase security, reduce traffic hitting the firewall). e.g.
> 
> In the above case using an external router, this could be used as the VPN
> end point, as with have done over a number of technologies. A caveat
> however, the router vendors have been quite slow deploying fully IPSEC
> compliant solutions, and in some cases require a mix of part IPSEC +
> proprietary to make VPNs (This normally makes these solutions less
> friendly ;) )
> 
> It really depends on the type of client connecting I guess, remote site
> or remote user. I like Keiths SmartGate for users (especially with
> SmartCards), external router based solution for sites.

You're right. The institution for whom I'm looking at this, does have a
Cisco1600 as frontend, but it's been set up by the ISP who still
controls it, and no info is available. They are somewhat dissatified
with the ISP and are shopping for another ;-

I'll have to find out more about the Cisco. The problem is that possibly
several institutions will be linked on a vpn, but may choose different
external routers and firewalls. Fortunately, some of them are not yet on
the internet, so I'm hoping to lay out a uniform structure the rest will
adhere to. Which relates to your remark on friendliness...

Links to relevant info are more than welcome.

---

From: MONZ <[email-masked]>
Date: Wed, 05 Apr 2000 17:42:46 +0200

> If this is misleading, please correct me.

It's not. If you saw my second selvcorrecting posting, you'd see I found
out I initially had an abnormal view on vpn :- I thought vpn was always
setup on a separate internet connection, which is clearly not the case.
What can I say? Vpn is new to me...

I need to have another topic clarified:
What's the security difference between a multi-nic'ed firewall/router
and a firewall-dmz-router solution?
Of course the router can do nat, thus providing an extra layer of
security, but so can the firewall/router, though I understand that a
compromized firewall/router may give more direct access to the internal
network.
-- 
Mogens Valentin  WWW: http://www.danbbs.dk/~monz/  mailto:[email-masked]
Web, Programming, Network, Security - Installguides and docs for Linux..
Skaane/Sjaelland Linux User Group (5200++ members) - http://www.sslug.dk
Use http://www.linux.org/ for freedom of choice with OpenSource software

---

From: Keith Young <[email-masked]>
Date: Fri, 07 Apr 2000 13:29:50 -0400

> normally makes these solutions less friendly ;) )

I just wouldn't allow unencrypted traffic from the external router to be
outside the firewall. I personally like encrypting traffic as close to
the end point (or trusted network) that I can....

Plus, your security rules on your firewall are either going to be too
broad ("allow src router.ip dst any port any" if router is doing VPN
natting... eeek!) or too restrictive ("allow src router.ip dst
intranet.web port 80" for each service via router VPN).

Unless, of course, if your internal router supports VPN traffic and you
forward it from the outside through your firewall ("allow src any dst
internal.router protocol 50,51") which I don't recommend either...

> router based solution for sites. Horses for courses I guess,

I like SmartGate too  :-).

We have actually done a similiar config for a high security law
enforcement group. SmartPass for client-to-server and Gauntlet tunnels
between sites for server replication. They think it works great.

Anyway, I'll shut up now and stop changing the topic from the FWTK... 
:-)