| 10.2 |  | Using ACLs |
| 10.2.4 |  | VPN solution: dual DMZ and VPN concentrator |

| Virtual Private Networks (VPNs), continue to play an increasingly vital role in the overall network security architecture of many companies. It is important to realize that the PIX Security Appliance has been designed to support VPN functionality in a couple of ways. First, it is able to create VPN connections itself, which will be examined in detail in Module 14. The second way the PIX Security Appliance supports VPN functionality is by interfacing with a dedicated VPN concentrator. This example will focus on the second way, and it will look at how access lists are configured on the PIX Security Appliance in order for it to interoperate correctly with a VPN concentrator.

In the VPN solution, the PIX Security Appliance has two dedicated interfaces connected to a VPN concentrator. The dmz interface is connected to the public interface of the VPN concentrator. The dmz2 interface is connected to the private interface of the VPN. The VPN concentrator is configured to assign to VPN clients an address from the 10.0.21.33-62 pool.

A static route on the PIX Security Appliance is defined to route outbound traffic to the VPN client. A static translation is needed on the PIX Security Appliance to allow for communication between the VPN client and hosts on the inside network of the PIX Security Appliance.

In Figure , the PIX Security Appliance is configured with the following two ACLs to control traffic inbound from the Internet and outbound from the VPN clients to the PIX Security Appliance inside network:

- The PIX Security Appliance ACL, IPSec, allows HTTPS traffic from the Internet to the public interface of the VPN Concentrator. The ACL, IPSec, also permits only ESP and ISAKMP traffic to the VPN Concentrator.
- The PIX Security Appliance ACL, WEB, allows HTTP traffic from the VPN clients (10.0.21.33-62) to the inside Web server (10.0.0.10).