Security Basics mailing list archives
Re: VPN vs changing routes
From: chort <chort () amaunetsgothique com>
Date: Tue, 10 Jun 2003 13:07:20 -0700 (PDT)
Routing will only work if the end-user has a direct physical link to the corporate network. Some how the traffic must get from the end-user's workstation to the corp network. If they are on broadband, for instance, the packets would have to go to the local hardware (DSLAM, etc), through the provider's network (in the clear), to an Internet peer, and finally into the corp network. Hopefully you won't just blindly trust this IP through your firewall, since it's possible for any hop along to intermediate path to effectively spoof that IP. Remember, the VPN only makes the next hop *appear* to be the corp. network. The packets still follow the same path, they're just encrypted until they reach the terminating point inside the corp. network. That's why it's called a Virtual Private Network, the encryption turns a public network into a virtually private network (transparently to the user). Perhaps I am misunderstanding the question, but that would appear to be the difference from my interpretation of your question. -- -chort On Tue, 10 Jun 2003, Keenan Smith wrote:
All, Given a single user in a single location with a static IP, besides encryption, what would be the difference between using a VPN to connect to the corporate network vs. changing the routing to make the corporate network the first hop? It seems to me that the latter combined with a firewall rule and NAT would function the same way as a VPN without the overhead. So other than encapsulating all data between the network and the VPN client, is there any advantage to using the VPN over a change in routing? Thanks in advance for all the good advice. KC Smith ~~~Ensuring that suave and debonair sophistication is always a part of IT --------------------------------------------------------------------------- Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! The Gartner Group just put Neoteris in the top of its Magic Quadrant, while InStat has confirmed Neoteris as the leader in marketshare. Find out why, and see how you can get plug-n-play secure remote access in about an hour, with no client, server changes, or ongoing maintenance. Visit us at: http://www.neoteris.com/promos/sf-6-9.htm ----------------------------------------------------------------------------
--------------------------------------------------------------------------- Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! The Gartner Group just put Neoteris in the top of its Magic Quadrant, while InStat has confirmed Neoteris as the leader in marketshare. Find out why, and see how you can get plug-n-play secure remote access in about an hour, with no client, server changes, or ongoing maintenance. Visit us at: http://www.neoteris.com/promos/sf-6-9.htm ----------------------------------------------------------------------------
Current thread:
- RE: Firewall and DMZ topology, (continued)
- RE: Firewall and DMZ topology Mann, Bobby (Jun 09)
- RE: Firewall and DMZ topology ed (Jun 10)
- Re: Firewall and DMZ topology Erik Vincent (Jun 10)
- Re: Firewall and DMZ topology Daniel B. Cid (Jun 10)
- RE: Firewall and DMZ topology ed (Jun 10)
- RE: Firewall and DMZ topology Mann, Bobby (Jun 09)
- Re: Firewall and DMZ topology Chris Berry (Jun 10)
- RE: Firewall and DMZ topology David Gillett (Jun 10)
- Re: Firewall and DMZ topology Erik Vincent (Jun 10)
- Re: Firewall and DMZ topology Zach Crowell (Jun 10)
- Re: Firewall and DMZ topology Erik Vincent (Jun 10)
- VPN vs changing routes Keenan Smith (Jun 10)
- Re: VPN vs changing routes chort (Jun 10)
- RE: VPN vs changing routes David Gillett (Jun 10)
- Re: [security] VPN vs changing routes Martin (Jun 11)
- Re: VPN vs changing routes Joerg Over Dexia (Jun 11)
- Re: Firewall and DMZ topology Daniel B. Cid (Jun 10)
- Re: Firewall and DMZ topology Steve Bremer (Jun 10)
- Message not available
- Re: Firewall and DMZ topology Daniel B. Cid (Jun 10)
- Re: Firewall and DMZ topology Aaron Fisher (Jun 11)