I'm currently looking to implement a VPN solution (based on a Checkpoint Connectra) purely to provide remote access to staff (no site-to-site, or customer access), but the one design decision I can't quite seem to reconcile in my own mind is the placement of the VPN appliance on the network.
I see that there are several options:
- VPN Appliance in the DMZ
- VPN Appliance on the LAN behind the firewall
- VPN Appliance in parallel to the firewall
The Checkpoint documentation only mentions the VPN appliance on the LAN, or in the DMZ as options. Are there any overwhelming reasons for not having the VPN appliance in parallel to the firewall with a WAN router ACL directing the VPN traffic in the direction of the appliance? Or alternatively any overwhelming advantages to using one of the other two placement options?