Security

Ask something
Discussion Locked

Security/Performance in my VPN setup

0 helpful
3 replies

by labrat

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This is my first office-to-office VPN over the Internet setup. I have basic VPN training...but "In theory, there is no difference between Theory and Practice. In practice, there is!" I'll give points to all responses that offer explainations and/or practical advice about my planned setup.

It is simple. A branch office will intiate a VPN tunnel between the office routers. The branch systems will login on a NT 4.0 Terminal Server/Metaframe Server.

Security/Performance:
The workstations run XP Pro and Citrix Metaframe client. The Servers are NT 4.o domain with authentification thru NT 4.0 Terminal Server/Metaframe Server. The application is a Orders/Inventory Pervasive SQL 2000i database. A migration to Small Business Server 2003 Standard Edition is being planned if that matters. There will be no files transfered--only the data for Terminal/Metaframe clients at the Branch. The ICA client performance is very good over PPTP connections from users' homes.

1. Info isn't Super Secret but needs to be secure. I plan to install DES encryption between the routers. Is that good enough or is there any security concerns with the NT security?

2. Do youhave any suggestions for my first setup concerning security/performance issues? Any suggestions on authentification parameter settings? Any problems with PFS and Keep Alive?

3 replies

by gavin

For performance concerns:
1) Make sure you hav high banwidth for your WAN links, possibly make IPSec traffic to higher priority using QoS in firewall.
2) Firewall/VPN to have hardware encryption accelerator to speed up the encrypt/decrypt process.

For Security concerns:
1) Try to seperate between VPN authentication and your domain/application authentication. Use different login/password for each.
2) Use higher encryption 3Des or AES and combination of authentication method for phase 1 and phase 2 SHA & MD5 perhaps.
3) Define VPN policy instead of allowing everything through the tunnel.
4) I'm sure you can think of more... :-)

Cheers,
Gavin Ng
Afiintra Technologies Sdn Bhd

This discussion is closed to new replies.