Re: Recommendations

One issue I've had with Netscreen firewalls in the past is that I've
never managed to get them to support IPSec pass-thru for generic IPSec
clients through the Netscreen in router mode with PAT (i.e. not using
NAT-Traversal or any other type of TCP/UDP encapsulation of the IPSec
traffic). Is this a known limitation of the Netscreen, or is there a
trick I haven't found? I haven't tried the latest software, so maybe
this is no longer an issue - the last version I've tried is 4.0.3r3.0
in a 5XP.

Dana

Travis Watson wrote:

Paul,

You've already received some good recommendations and I don't mean to poor it
on, but you may want to look at m0n0wall as well for the smaller
site--particularly if management is cheap ( http://m0n0.ch/wall/ ). It's
pretty cool stuff and the price is right.

Having said that, I usually lean toward Netscreen. They are very reasonable
in price, solid, and easy to manage. The only caustion I would give you is
that the 5-series has the 10 user and "unlimited" option for VPN. Ten nodes
through a tunnel can happen pretty quickly and the unlimited option just
about doubles the price. The 10 user limitation is for VPN only, however,
not general connectivity.

Good luck.

--Travis

On Thursday 08 April 2004 08:39 pm, Paul R. Yaskowski wrote:

I'm looking to setup a site-to-site VPN the replace a leased line used
solely for AS/400 access. I have a couple questions as to what I should
get.

The main office consists of about 25 users with static SDSL. The remote
office is about 5 users with dynamic ADSL.

I've looked at the PIX-501, but I've always been a little scared of
per-user licensing. If I purchased a 10-user PIX-501, and set it behind the
SDSL at the main office, it would only allow 10 users to get Internet
access?

No matter what product I choose, would a site-to-site VPN work with a
static address on one side and a dynamic on the other?

Would any PIX handle PPPoE with a dynamically assigned IP?

The company is cost-conscious, and I've looked at the PIX-506E, without the
per-user licensing, but it is 50% more.

Any comments or suggestions as to which products I should look at would be
a great boon to me. I prefer Cisco products, because I am familiar with
their interface, but am flexible.

I would appreciate any help with this, I had Cisco certs back in the
hey-day, but I worked with them so rarely that I let the certs expire.

Paul

_______________________________________________
VPN mailing list
[email protected]
http://lists.shmoo.com/mailman/listinfo/vpn

_______________________________________________
VPN mailing list
[email protected]
http://lists.shmoo.com/mailman/listinfo/vpn

_______________________________________________
VPN mailing list
[email protected]
http://lists.shmoo.com/mailman/listinfo/vpn