The Altiga/CiscoVPN3000 series allows you to do split tunneling. You give it a list of networks, and it drops this on the client when it connects. The client will check the list, and if the network is there, will send the packets through the tunnel. Works great for users who have a LAN printer but still want remote access. craig -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Patrick W. Gilmore Sent: Sunday, May 27, 2001 10:25 PM To: nanog@nanog.org Subject: VPN Solution (WAS: ORBS (Re: Scanning)) At 06:58 PM 5/27/2001 -0700, Owen DeLong wrote:
Roaming staff usually needs some form of VPN access, anyway, and even if they don't, this is a great use for one. Put a VPN client on the roamer's computer (Linux, Mac, and Windows 9x/NT/ME/2k all have IPSEC capable clients available), then use the VPN to get back to the mail relay. If the mail relay is behind the VPN tunnel termination point at the server end, then it should only accept mail for relay from valid VPN clients. As such, you solve the roaming staff problem without an open relay. VPN boxes like Ravlin and Nokia Crypto Cluster are cheap enough today that I would consider it a valid cost of doing business if you don't have a better solution.
I have an "operational" question. (SURPRISE! :) VPN solutions are getting inexpensive. However, they are sometimes far from optimal. The VPN solutions I have used (e.g. Bay Networks, MS PPTP) send *every* packet from the end user machine to the VPN end-point, not just selected packets (like with SSH tunneling). This can cause extremely poor performance for some roaming users. For instance, someone in Sydney with a home office in New York trying to get to a Sydney web server suddenly has to make two round trips to New York, just to cross town. Considering trans-pacific fiber congestion and other problems, this can make the VPN nearly unusable. Of course, you could tell the user to turn off the VPN, but you try to explain to a typical end user when he should and should not have the VPN turned on, or that he cannot send mail while browsing the web, or things like that. So, does anyone know of a VPN that does selective forwarding like SSH tunneling?
Owen
TTFN, patrick