Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations:

  1. with firewall
  2. within the internal network
  3. within the DMZ

Any reference also would be appreciated.

share|improve this question
Could you clarify how option 1 ("behind a firewall") is different from options 2 and 3? Aren't the internal network and DMZ "behind a firewall"? Also, you didn't include the option of the VPN server being connected to the Internet (i.e. not being behind a firewall). Perhaps that's what you intended in 1? – David Wachtfogel Oct 11 '12 at 17:08
I have edited first option - its with firewall as firewall can also provide VPN functionality. And yes, for all three combinations, there will be internet, intranet and DMZ (For Web Server), only SSL VPN device needs to be considered, – user13941 Oct 12 '12 at 1:11

SSL-VPN shall have at least two interfaces, i.e. external (Internet facing) and internal (intranet facing). You should filter traffic both from Internet to external address (i.e. allow only https connections), as well as from internal to Intranet.

In your terms that would be DMZ1 (aka dirty dmz) and DMZ2 (aka clean dmz).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.