Chapter 10 - DMZ-Based VPN Services

Abstract

Virtual private networks (VPNs) are supplanting leased lines as a cost-effective and practical way of providing wide area network (WAN) communication between a central network and various remote networks or extranet partner networks. The key to VPN utilization in demilitarized zones (DMZ) focuses on the deployment of VPN in the DMZ itself. VPN services implementation in the DMZ has its share of difficulties. The placement of the VPN tunnel termination point must be determined. To identify the location for this device, an evaluation for the security of the device itself must be conducted. Most people equate VPNs with Internet Protocol Security Protocol (IPSec), but other technologies such as Layer 2 Tunneling Protocol (L2TP), Point-to- Point Tunneling Protocol (PPTP), Multiprotocol Label Switching (MPLS), and Generic Routing Encapsulation (GRE) have their uses as well as their drawbacks in constructing VPNs. Another factor that affects VPN device placement and VPN design is the function of the VPN. More and more companies are turning from dialup services to VPNs for remote access connectivity for telecommuters as well as mobile workers. The prime motivating factor in this move appears to be an overall lower cost of ownership with VPNs compared with dialup phone lines.