VPN Security question

[Danny]

Archived from groups: comp.security.firewalls (More info?)

Hi,

We have Pocket PC 2003 handhelds that we would like to connect to our
corporate network via GPRS/VPN. Our firewall is a SonicWall, with
hardware VPN accelerator. However the SonicWall does not allow (to
the best of our knowledge!) the PocketPC VPN client to connect -
possibly due to incompatibility reasons. In order to achive the
required result we are thinking of installing a MS ISA 2000 server in
either the DMZ or Internal LAN and configuring it as a VPN server. To
allow external clients to connect we would have to create a rule on
the SonicWall to allow PPTP(1723) to our internal address.

Should we place the ISA Server on the DMZ or can we leave it on the
LAN?

Does anyone have any comments on this configuration? Is it secure?
We have tried it, it works...however using the shields up scanner at
grc.com shows that port 1723 is open, is there anyway to make this
stealth?

Regards,


Danny

 

[Guest]

Archived from groups: comp.security.firewalls (More info?)

Nope, you can't stealth 1723 because MS VPN (PPTP) uses that as a control port.


d_codling@hotmail.com (Danny) wrote in message news:<b3587fea.0405260152.6916061e@posting.google.com>...
> Hi,
>
> We have Pocket PC 2003 handhelds that we would like to connect to our
> corporate network via GPRS/VPN. Our firewall is a SonicWall, with
> hardware VPN accelerator. However the SonicWall does not allow (to
> the best of our knowledge!) the PocketPC VPN client to connect -
> possibly due to incompatibility reasons. In order to achive the
> required result we are thinking of installing a MS ISA 2000 server in
> either the DMZ or Internal LAN and configuring it as a VPN server. To
> allow external clients to connect we would have to create a rule on
> the SonicWall to allow PPTP(1723) to our internal address.
>
> Should we place the ISA Server on the DMZ or can we leave it on the
> LAN?
>
> Does anyone have any comments on this configuration? Is it secure?
> We have tried it, it works...however using the shields up scanner at
> grc.com shows that port 1723 is open, is there anyway to make this
> stealth?
>
> Regards,
>
>
> Danny