[Openswan Users] Architecture question

[Andy Gay]

On Fri, 2006-08-04 at 15:01 +0100, Matthew Claridge wrote:
> Hi,
> 
> Never tried to do things this way, so I don't really know if this is
> feasible/easy/possible etc.....
> 
> If, for example, we had a firewall with 2 network segments (DMZs) -
> DMZ1 contains an OpenSwan IPSec device with external IP a.a.a.a and
> private IP b.b.b.b
> 
> DMZ2 contains another network segment using IP addresses of c.c.c.0/24
> 
> Can the VPN in DMZ1 be set up to allow traffic to/from DMZ2? I would
> normally do this by having the VPN inside DMZ2, but we are thinking of
> changing our infrastructure so I'm wondering what options there are...

Not sure I really understand what you're asking. But I think the answer
is yes - in general if you can route packets between 2 places, you can
put an IPsec tunnel between them. If you have firewalls in the path, you
need them to permit and forward your IPsec traffic (protocol 50) and
ISAKMP (udp port 500, and 4500 if your firewall does NAT).
> 
> cheers
> Matt 
> -- 
> This message has been scanned for viruses and 
> dangerous content by MailScanner, and is 
> believed to be clean. 
> _______________________________________________
> Users at openswan.org
> http://lists.openswan.org/mailman/listinfo/users
> Building and Integrating Virtual Private Networks with Openswan: 
> http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155