Looking for VPN clarification\suggestion

Actually, the best solution is to use a firewall that integrates a VPN. If you can't do this because you already own a certain brand then you should put the VPN server on the inside network. If it were to go on the outside you would have a short segment of unencrypted traffic that must travel to and then through the firewall - kind of defeats the purpose. However, when you place a VPN on the inside network the firewall is not necessarily aware of it, so you won't be able to filter against the application level and you have to deal with NAT or virtual IP addresses. So in the end you see you get the best of all worlds with an integrated product that can protect and filter all VPN traffic. I'm not quite sure how using a DMZ will make theconnection more secure unless your Citris servers are there as well.

It is not safe to put a VPN server behind a firewall b/c if you do all requests to the VPN server have to pass the firewall and they get into your network befor they are authenticated which is not safe.
You have 2 choses that are considered safe:
1.Put the VPN server in the DMZ, in such a configration you have to make sure to open all ports on the firewall that the VPN server is going to use for the VPN clients to log on to the network.
2.Put the VPN server on the same level as the firewall so that your network has now a new gateway to the outside world but to secure it use it as firewall too and restrict all packets except for the ones required for your VPN implenetation (IPsec, PPTP, etc.).
If you need real security for the data dontuse MS PPTP b/c its NOT secure, for additional info visit: http://www.counterpane.com

It is not a difficult question! Citrix employs either 64 bit or 128 bit encryption on their clients and servers. THis handles the server to workstation security issue. THis security will be as good as any other VPN model. THe only question is how do you pass traffic (citrix ports) from the outside to the inside. This can be done easly by most firewalls by a proxy/acl with either redirected traffic or setup an alias ip on the outside then redirting the alias to your farm. If you want to secure the connection stronger, which you should not have to, then you can add a VPN with 56/128 bit encryption and either drop the citrix encryption or double it with the citrix encryption enabled. I think the latter is over kill. I also believe that the citrix web clients will also use strong-authenication to cross firewalls. I know that sidewinder authenticates based on citrix credentials.

Talk with Citrix or your firewall vendor for assistance. I would call citrix first.

good luck

Although it is difficult to determine whether the PIX you have is overkill (the product line varies greatly), in general the PIX has more than enough capacity to handle 200 users (as an example, the higher end models are more accustomed to around 100k). If, however, you determined that the model you have is heavily taxed and that you needed a seperate authentication server, it is necessary to put it inside the firewall for a couple of reasons. First, the VPN account database should be protected as much as is feasible (inside the firewall with clearly defined ACLs). Second, traffic will only be tunneled to the VPN "gateway", this can necessitate akward configurations and result in inappropriate behavior as the now untunneled packets passthrough the firewall. Third, you would not want to open a Citrix "hole" in your firewall when you could just open a VPN hole instead, right?

In short, use the PIX if you can (they have somewhat limited configurability, but good performance). Ifyou cannot, add a VPN gateway inside the firewall and tightly control what traffic is allowed through the L2TP hole.

Go to http://www.sonicwall.com and look at the Pro VX. I have one and it is made for exactly the scenario you propose. If you look at the PIX and Firewall-1, you will have to factor in some pretty hefty training costs while the SonicWall is brain-dead simple to configure and operate.

This question was auto closed due to inactivity