Re: [FW-1] R60 and Linux (FreeSwan)/VPN Client Support

2008-06-15 Thread pkc_mls
Chris Lyon a écrit : On Sun, Jun 15, 2008 at 1:05 PM, Hugo van der Kooij <[EMAIL PROTECTED]> wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Lyon wrote: | So from a security standpoint, Linux would be much harder to control | since it would be a split tunnel. So the remote machine

Re: [FW-1] Cannot enable ClusterXL on SPLat R65

2008-06-15 Thread pkc_mls
Mark Senior a écrit : Hello group I just upgraded an old SPLat R55 HA cluster to R65 HFA_02. The first cluster member upgraded fine, but the upgrade went inexplicably pear-shaped on the second (couldn't revert, couldn't reinstall the upgrade, couldn't even reboot). So, I rebuilt the second clu

Re: [FW-1] R60 and Linux (FreeSwan)/VPN Client Support

2008-06-15 Thread Chris Lyon
On Sun, Jun 15, 2008 at 1:05 PM, Hugo van der Kooij <[EMAIL PROTECTED]> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Chris Lyon wrote: > | So from a security standpoint, Linux would be much harder to control > | since it would be a split tunnel. So the remote machines could be an >

[FW-1] Cannot enable ClusterXL on SPLat R65

2008-06-15 Thread Mark Senior
Hello group I just upgraded an old SPLat R55 HA cluster to R65 HFA_02. The first cluster member upgraded fine, but the upgrade went inexplicably pear-shaped on the second (couldn't revert, couldn't reinstall the upgrade, couldn't even reboot). So, I rebuilt the second cluster member. At this po

Re: [FW-1] R60 and Linux (FreeSwan)/VPN Client Support

2008-06-15 Thread Hugo van der Kooij
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Lyon wrote: | So from a security standpoint, Linux would be much harder to control | since it would be a split tunnel. So the remote machines could be an | entry point to the network. Think of Linux machines as just another 3rd party gateway. N

Re: [FW-1] R60 and Linux (FreeSwan)/VPN Client Support

2008-06-15 Thread Chris Lyon
Well the issue is the lack of control of the remote machine. You really don't have any is what I am getting out. Like with Windows or Mac, you can put up a personal firewall and control the traffic while connected or not. It looks like there can't be any technical controls on the remote machine to

Re: [FW-1] R60 and Linux (FreeSwan)/VPN Client Support

2008-06-15 Thread Ray
Possibly. You could have policies to control how they are set up, but personally I don't believe in policies without technical controls to back them up. Ray > Date: Sat, 14 Jun 2008 17:26:06 -0700 > From: [EMAIL PROTECTED] > Subject: Re: [FW-1] R60 and Linux (FreeSwan)/VPN Client Support > To: