We are trying to establish a VPN from a small office back to the corporate intranet. For the small office we have a simple PIX firewall and for the corporate side, we have a Sidewinder (3 "burbs": external, internal, DMZ).
My idea is to put a PIX firewall in the DMZ and the distant small office will have an encrypted tunnel between PIX to PIX. But then I would have to pop a HUGE hole in the Sidewinder to allow traffic back into the internal area. Isn't a DMZ not supposed to have traffic into an internal area? Isn't that the point of a DMZ? Traffic stays out of the internal network but internal can still get to the DMZ?
Would it be better if I made the Sidewinder just be one of the "ends" of the VPN? So I would have PIX to Sidewinder?
Any information on that type of configuration?
Thanks!