It would be better to use a product like Nokia Secure Access System (NSAS). It offers most of the advantages of VPN plus it gives freedom of accessing from anywhere/anytime. NSAS is an SSL VPN solution.
Naseer Inamdar <[EMAIL PROTECTED]> wrote: Hi all, As per our network policy, nobody should access the servers on the LAN from INTERNET directly. We have two checkpoint firewalls connected back to back separating DMZ zone. Internet | Router | Checkpoint firewall-1 | | ---------------------------------------------- DMZ | Checkpoint firewall-2 | | LAN Both checkpoint firewall have different Policies and are not in load balancing mode.The strategy is to have defense in depth approach. All Internet bound traffic terminates to protected DMZ. However we have few servers that are present on LAN, that are required to be accessed over Internet. The amount of access to these servers from Internet will be less compared to the LAN users, hence cannot be shifted to DMZ. What would be the best practice for accessing these servers. These users want access without VPN connectivity as they dont carry laptops. I have thought of the following solution: Install a reverse proxy server for eg: ISA firewall that hosts these internal servers. All access to these servers shall be then via ISA- firewall which sits on DMZ and communicates to these internal servers via Checkpoint firewall-2. through a secure channel like SSL. Since ISA firewall hosts multiple servers. How a person can access different servers -- for eg: server1, server-2 Note: DMZ is on invalid ip nated to Valid IP on Checkpoint firewall-1 Awaiting for more inputs and other best solutions Thanks and Regards Naseer.Inamdar ---DISCLAIMER------------------------------------------------- The contents of this E-mail (including the contents of the enclosure/(s) or attachment/(s) if any) are privileged and confidential material of Mahindra and Mahindra Limited (M&M) and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee/(s). If this E-mail (including the enclosure/(s) or attachment/(s) if any ) has been received in error, please advise the sender immediately and delete it from your system. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender. -------------------------------------------------------------- ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= --------------------------------- Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
