hi, first of all: NAT is not a problem for an up-to-date VPN-client. there is a feature "nat traversal" that makes VPN work. but you will need more ports than only port 80 - so maybe you can allow <any> port from this guest-dmz. the next think is that the guest-network should not be the same IP as he guest's company network. so don't use a 10.x.x.x IP - use a 172.16-32.x.x, they are not that much in use. but still there is a chance that your guest will use a 172-ip in his company network - then maybe his VPN-client is able to deal with that, if not -> bad luck.
hope this helps reinhard At 02:02 25.05.2005, you wrote:
Hi Guys, I had a design question which I wanted to run by you guys. I wanted to create a VLAN for visitors and then have the checkpoint be the gateway for the DMZ. With the appropriate rules in place, everything seems to work for web browsing. Users are on DHCP on this vlan. What do you do for users who need to connect to their company network using IPSEC vpn clients? Everything I've read seems to make this task quite difficult. How have you handled this in your environment? Cameron Kim ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
-- Reinhard Stich ASSIST [EMAIL PROTECTED] Internet Security AG, 1150 Wien, Johnstrasse 29 Tel: +43 1 3709440 RS784-RIPE Fax: +43 1 3709440-333 ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
