Security Basics mailing list archives

Previous By Date Next
Previous By Thread Next

RE: VPN overkill?

From: "Ted A" <arcturous () hotmail com>
Date: Thu, 18 Nov 2004 18:11:52 +0000
All,
Thanks much for everyone's input. It was very helpful and educational in some instances. Just goes to show that pure technical knowledge cannot be accurately mis-used without proper management misguidance. 
I'm sure there are managers here who will scoff at that. ;)

Thanks again.
Ted



<html><P>&nbsp;</P></html>



From: &quot;David Gillett&quot; &lt;gillettdavid () fhda edu&gt;
Reply-To: &lt;gillettdavid () fhda edu&gt;
To: &quot;'Ted A'&quot; &lt;arcturous () hotmail com&gt;, &lt;security-basics () securityfocus com&gt; 
Subject: RE: VPN overkill?
Date: Wed, 17 Nov 2004 08:55:28 -0800
MIME-Version: 1.0
Received: from mc6-f24.hotmail.com ([65.54.252.160]) by mc6-s12.hotmail.com with Microsoft SMTPSVC(5.0.2195.6713); Wed, 17 Nov 2004 08:55:09 -0800 Received: from redstripe.fhda.edu ([153.18.96.108]) by mc6-f24.hotmail.com with Microsoft SMTPSVC(5.0.2195.6713); Wed, 17 Nov 2004 08:53:54 -0800 Received: from HURON (quasar110.fhda.edu [153.18.129.110])by redstripe.fhda.edu (8.9.3/8.9.1) with ESMTP id IAA407615;Wed, 17 Nov 2004 08:52:42 -0800 (PST) 
X-Message-Info: JGTYoYF78jElIi14WXgNu7TzbTEIRYYj
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0)
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
Return-Path: gillettdavid () fhda edu
X-OriginalArrivalTime: 17 Nov 2004 16:53:55.0368 (UTC) FILETIME=[06403A80:01C4CCC6] 

  While site-to-site VPNs like this handle a fair bit of bandwidth,
they use a relatively small number of tunnels.  Mostly, the places
I've used concentrators have been either

(a) for client-to-site deployments, with a large number of
    separate tunnels (mostly of fairly modest bandwidth), or

(b) places where the encrypted bandwidth was so great that one
    or more hardware encryption processing modules were justified.

  It doesn't sound likely that your situation meets either profile,
so I'd expect the VPN capabilities included in many routers and
firewalls should be adequate.
  You may be able to sell this on the basis of a pilot deployment
using on-hand/low-cost gear, with a plan to upgrade when (if!)
traffic demands warrant it (see b above).

David Gillett


&gt; -----Original Message-----
&gt; From: Ted A [mailto:arcturous () hotmail com]
&gt; Sent: Tuesday, November 16, 2004 2:17 PM
&gt; To: security-basics () securityfocus com
&gt; Subject: VPN overkill?
&gt;
&gt;
&gt; All,
&gt; First off, good fun reading this list. Some really great
&gt; advice and good
&gt; thinkers on here. Thanks for the great questions and great answers.
&gt;
&gt; So here's my issue. I have an IT infrastructure manager who
&gt; has raised a
&gt; requirement I find myself questioning.
&gt; We have a goal of connecting a remote office to a central
&gt; office via a VPN.
&gt; This manager insists that only acceptable way to accomplish
&gt; this is by
&gt; connecting 2 VPN concentrators. I debate this, noting that a
&gt; PIX should be
&gt; more than capable of handling this connection at the remote
&gt; office and the
&gt; only place the concentrator is needed is at the central office.
&gt; Am I completely off my rocker, thinking that a second
&gt; concentrator for a
&gt; single connection is a little overboard?
&gt;
&gt; Thoughts?
&gt; Thanks,
&gt; Ted
&gt;
&gt;
Previous By Date Next
Previous By Thread Next

Current thread: