Filter
Top Products
10-20 Firmware Version 4.6 Addendum
AA
AA
ll
ll
ll
ll
oo
oo
ww
ww
ii
ii
nn
nn
gg
gg
VV
VV
PP
PP
NN
NN
ss
ss
tt
tt
hh
hh
rr
rr
oo
oo
uu
uu
gg
gg
hh
hh
aa
aa
FF
FF
ii
ii
rr
rr
ee
ee
ww
ww
aa
aa
ll
ll
ll
ll
An administrator interested in securing a network will usually combine the use of VPNs with the use of a firewall
or some similar mechanism. This is because a VPN is not a complete security solution, but rather a component
of overall security. Using a VPN will add security to transactions carried over a public network, but a VPN alone
will not prevent a public network from infiltrating a private network. Therefore, you should combine use of a
firewall with VPNs, where the firewall will secure the private network from infiltration from a public network, and
the VPN will secure the transactions that must cross the public network.
A strict firewall may not be provisioned to allow VPN traffic to pass back and forth as needed. In order to ensure
that a firewall will allow a VPN, certain attributes must be added to the firewall's provisioning. The provisions
necessary vary slightly between ATMP and PPTP, but both protocols operate on the same basic premise: there
are control and negotiation operations, and there is the tunnelled traffic that carries the payload of data
between the VPN endpoints. The difference is that ATMP uses UDP to handle control and negotiation, while
PPTP uses TCP. Then both ATMP and PPTP use GRE to carry the payload.
For PPTP negotiation to work, TCP packets inbound and outbound destined for port 1723 must be allowed.
Likewise, for ATMP negotiation to work, UDP packets inbound and outbound destined for port 5150 must be
allowed. Source ports are dynamic, so, if possible, make this flexible, too. Additionally, PPTP and ATMP both
require a firewall to allow GRE bi-directionally.
The following sections illustrate a sample filtering setup to allow either PPTP or ATMP traffic to cross a firewall:
■ “PPTP example” on page 10-21
■ “ATMP example” on page 10-24
Make your own appropriate substitutions. For more information on filters and firewalls, see Chapter 12,
“Security.”