Firewall Wizards mailing list archives
RE: vpn end-point
From: Dave Piscitello <dave () corecom com>
Date: Fri, 19 Mar 2004 08:40:51 -0500
My experience as well. People tend to size access routers to perform according to the WAN access connection rate.
I am surprised no one mentioned that terminating VPN at the firewall lets you distinguish VPN traffic from all other traffic routed through the firewall (without topological or addressing finagling), and protects VPN traffic to the security policy enforcement point, e.g., across the "DMZ" you have between the router and firewall (unless the router-firewall link is a crossover cable, it's a network, and I've seen people throw IDS/IPS, performance analysis devices, and gee, how about a web server there - and that's only the list of systems they learn about).
At 05:12 PM 3/18/2004 -0500, paul wrote:
This is the opposite of my experience. I've yet to see a router with enough CPU to do 3DES and handle significant traffic at the same time.
_______________________________________________ firewall-wizards mailing list firewall-wizards () honor icsalabs com http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
Current thread:
- RE: vpn end-point Claussen, Ken (Mar 18)
- RE: vpn end-point paul (Mar 18)
- RE: vpn end-point Dave Piscitello (Mar 19)
- RE: vpn end-point Frederick M Avolio (Mar 19)
- RE: vpn end-point Dave Piscitello (Mar 19)
- Re: vpn end-point Shimon Silberschlag (Mar 22)
- RE: vpn end-point Mark Gumennik (Mar 27)
- RE: vpn end-point Dave Piscitello (Mar 19)
- RE: vpn end-point paul (Mar 18)
- <Possible follow-ups>
- RE: vpn end-point Robert Perez (Mar 18)
- RE: vpn end-point Sloane, David (Mar 18)
- RE: vpn end-point Dean Davis (Mar 18)