I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations:

  1. with firewall
  2. within the internal network
  3. within the DMZ

Any reference also would be appreciated.

  • Could you clarify how option 1 ("behind a firewall") is different from options 2 and 3? Aren't the internal network and DMZ "behind a firewall"? Also, you didn't include the option of the VPN server being connected to the Internet (i.e. not being behind a firewall). Perhaps that's what you intended in 1? – David Wachtfogel Oct 11 '12 at 17:08
  • I have edited first option - its with firewall as firewall can also provide VPN functionality. And yes, for all three combinations, there will be internet, intranet and DMZ (For Web Server), only SSL VPN device needs to be considered, – user13941 Oct 12 '12 at 1:11

SSL-VPN shall have at least two interfaces, i.e. external (Internet facing) and internal (intranet facing). You should filter traffic both from Internet to external address (i.e. allow only https connections), as well as from internal to Intranet.

In your terms that would be DMZ1 (aka dirty dmz) and DMZ2 (aka clean dmz).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy