Best practice

[oddyager]

We acquired a new company last year and part of "site" overhaul we've been doing is adding a proxy server in there and adding a new cisco gear (security apparently wasn't a big concern there and the many maintenance periods they had meant longer lunch hours for the employees...). In anycase, I set up a DMZ on a ASA 5510 and placed the proxy in there. So basically there's 2 layers of filtering being done with access rules on the ASA to permit what types of web traffic and have web site filtering done on the proxy. Everything was cool until I've been hearing complaints about folks using MS VPNs from their machines to connect to remote client sites. Since there wasn't a proxy or firewall in the past this never came up. Brilliant. The MS VPNs can't terminate to a proxy so I was forced to do give the local machines straight static NAT translations and allowed GRE, PPTP traffic in from the ASAs. Is there a better way to do this? I would prefer to completely abandon the MS VPNs in favor of something else.

 

[azev]

Since you allready have asa in place, why not use asa to terminate all the vpn client using cisco vpn client ?

 

[dphantom]

Originally posted by: azev
Since you allready have asa in place, why not use asa to terminate all the vpn client using cisco vpn client ?

I agree. I am in the process of doing the same thing now.