Firewall and VPN Device

[S Ramakrishnan]

Consider the two configurations:

  <ISP>-<router>-<vpn device>-<firewall>-<LAN>

and 

  <ISP>-<router>-<firewall>-<vpn device>-<LAN>


Which of these is more commonly deployed?
In the second case, since the firewall
cannot see the IP payload (assuming that
IPSec is used in tunnel mode), what
should be the rules on the firewall
to permit incoming IPSec flows? Willthe 
firewall only permit IKE, AH and ESP 
protocols?


- sr


Get your FREE Email at http://mailcity.lycos.com
Get your PERSONALIZED START PAGE at http://my.lycos.com

****************************************************************
TO POST A MESSAGE on this list, send it to vpn at listserv.secnetgroup.com

The VPN FAQ (under construction) is available at
http://kubarb.phsx.ukans.edu/~tbird/vpn/FAQ.html

We are currently experiencing "unsubscribe" difficulties.  If you
wish to unsubscribe, please send a message containing the single line
"unsubscribe vpn your-e-mail-address" to owner-vpn at listserv.secnetgroup.com

****************************************************************