DMZ

[Sabbyman_]

hi guys,

New to to forum but not new to juniper products.

I've recently accquired a SA700 for SSL VPN, cool product btw, but i would like to know the best way of implementing this in a DMZ. I know how to configure it already its just this last part before add into my network.

Any help is appreciated

[kronbladh_]

hey,

Don't really know what you would like to get recommendations on, but I ususally put the external interface in a DMZ and connect the internal interface to a zone representing "authenticated remote traffic". When working with Netscreen FW's, I typically also use the same "remote" zone for terminating IPSEC VPN traffic. From this zone I then create specific FW policies for access to internal resources (e.g. the trust zone).

/mk

[Jickfoo_ · Accepted solution]

Yep,

We put the external interface in a DMZ, NAT the address in the firewall, and put the internal port into a Internal VLAN. Once upon a time we put the internal interface into a DMZ as well but you end up opening all the traffic from that internal interface to your internal network anyway. We protect that internal interface with an IPS. It works well.

How do you like the 700 ? What are you doing with it ? NetConnect ?

Justin

[willj_]

doesnt anyone just use one interface only? (in the dmz)

the only devices we allow to have interfaces in external and internal networks are our firewalls.

[Sabbyman_]

Thanks for everything guys. Got it working on the Internal port only. Works the same way as using both

[warlord6_]

Hi there, I too am playing with an SSL VPN. I am going to put the "outside" port on the DMZ. I plan on MIP(NAT)ing the address to a public once.

Do I even need to bother with a separate "Inside" port? Also, in my Untrust to DMZ policy, what ports should I open the the SSL box? HTTPS ony?

[Jickfoo_]

I've done it both ways but am happier with the internal port on the internal network but behind our IPS.

You need to open TCP 443 and UDP 4500.

Justin