General design questions - where to put it

[cryptochrome_]

Hi there,

I am wondering what would be the best option to put an SSL gateway into the network. I am planing on placing the gateway into a DMZ of the firewall, but I am not quite sure yet how I connect the internal end. Use two interfaces (internal/external), place the external interface in DMZ and hook up the internal interface directly to the LAN? Or use just one interface and use it for both, internal and externa? Or use two interfaces and put both into the same DMZ?

How are others usually doing it? What's the best compromise between security and ease of integration?

Thanks

Sascha

[Roy_]

Hi Sascha,

Your first impression is correct. Put the external interface in the DMZ and the internal interface on the internal LAN. It works like a charm and even though the Juniper box is hardened, it also gains the benefit of your Internet firewall helping to protect it. We also have an IPS protecting our devices in the DMZ, so if you are using any type of IPS/IDS, the IPS would sit between your DMZ port on the firewall and the Juniper external interface.

Hope this helps,

Roy Kestler

[cryptochrome_]

Thanks Roy,

what puzzels me with this design is the question how routing is supposed to set up on the internal LAN. If the default gateway for the network points to the firewall, the return traffic from SSL secured applications will be sent to the firewall instead of the SSL gateway (the firewall dropping it because not in state table). Am I right? Or will the SSL machine do some sort of NAT so external traffic will be translated to an internal address?

Cheers

Sascha

[Roy_ · Accepted solution]

When you configure the Juniper box you will assign an internal IP address pool. You will also assign an external IP address which is reachable from the Internet and configure your firewall to send connections for that address to the DMZ which your VPN will pick up. Once the connection reaches the VPN it will assign that user an internal IP address from its configured pool and your internal LAN routing takes it from there. So to answer your question the return traffic comes back to the Internal IP address assigned by the Juniper IP address pool. The Juniper box keeps track of which external connection it assigned that internal IP address to and automatically sends it back out to the correct user across the Internet.

Roy Kestler

[cryptochrome_]

All right, got it. Thanks!

[Roy_]

Your welcome! Glad I could help.

Roy Kestler