Thanks in advance for your advice

We have to implement VPN connection for nearly 7 countries

Option 1 :

As we have private MPLS link to all 7 countries. It is been outsourced Third party.

  1. They provide VPN with 2FA with a extra cost. But challenge is it opens up access to all countries.
  2. Managed by Third party, Every change request depends on them
  3. Thinking that it might be challenge to manage in terms of security and compliance
  4. though we have a option of creating access list to restrict access to their respective countries. i beleive its challenge for security becuase some of the countries may be PCI compliant and do different projects.
  5. Is it possible to monitor through the local FW or IPS?


  1. Every country has their own FW(ASA or Fortigate)
  2. Can we create VPN in the respective FW? Is it advisable than VPN through MPLS?
  3. Is the VPN free for the Fortigate and ASA?. Is there any limitations?
  4. I believe its easy and have more control to implement VPN in the respective countries
  5. As they will have access only to the particular zone (country)
  6. It will be useful for future projects in terms of compliance.

As usual, please provide your highly valuable comments/answers/opinion. Which is the best way to go

  • Maybe if you divide your question in individual question you can get more valuous responses. For example, does it have any sense to have a VPN through a MPLS? – Eloy Roldán Paredes Dec 10 '15 at 11:48

The fact that you have listed out the pros and cons pretty much speaks for itself. There is no right answer here. It comes down to what you feel works best for you.

Many large organisations I work with use MPLS, specifically for the ease of connectivity to anywhere globally, however MPLS itself doesn't offer much security, so a company-owned VPN is almost always used across the ISP's MPLS network.

Either way, you'll want to think about firewall positioning. Is it sufficient to segregate by country? I'd typically segregate by risk profile, country, service, and possibly other criteria...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.