VPN to firewall or passthrough

1.If you want to have roaming connections access a VPN, is this best handled by connecting to the firewall or pass through to a server? It seems most firewall boxes want a remote ip.

2.Does Windows XP handle non pptp vpn connections or is additional client software needed? I have seen mixed statements on this.

Thank you Dwight

Reply to
Dwight
Loading thread data ...

After I did more reading and understanding, you would use a pass-through when you have remote users connecting and there location maybe different. A vpn to the firewall would occur when you have a predefined end point from the remote user. So for most instances a pass-through connection would be made with vpn server on the recieving end.

Reply to
Dwight Trumbower

What is a VPN in this regard? IPSec? OpenVPN? L2TP (a VPN protocol according to Microsoft)?

What kind of firewall/server are we looking at?

I am mostly/only familiar with IPSec, so I'm going to comment on that regardless...

Configuring IPSec is not trivial on Windows XP; I am in the process of configuring some client machines on heterogenous networks, and while IPSec works fine once you get it going, doing so is quite non-trivial, due to lack of documentation and lack of useful log files (let alone error messages - not even a fatal exception this time!) - I usually work with the Windows log (oakley.log) open, a remote login to the VPN server showing the logs there, and sniffers on both ends.

All in all, to answer your question, it can be done. However, one must install the WinXP Support tools from the Microsoft page, and optionally ipsec.exe. Plus, potentially, a certificate.

Though, admittedly, my decision to rip out L2TP and PPP by using ipsec.exe (see

formatting link
did not simplify matters. It did increase performance, though, and it's a good thing when one does not have to run some half-stable tunneling daemon.

Windows should also support OpenVPN, though I do not have personal experience or ever witnessed OpenVPN in operation.

Joachim

Reply to
Joachim Schipper

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.