Network Computingwww.networkcomputing.com

		our customizable newsletter, sends you security alerts, product updates and software patches on the products you use. Sign up now at www.networkcomputing.com /express/

I tested a beta of the cIPro-DMZ and concluded that the gateways share only housing and power supplies: They are separate VPN devices, handling traffic and management individually. Fortunately, this approach affords you some flexibility in configuring your enterprise security; you can divide your private network and your extranet into distinct segments.

On the down side, the cIPro-DMZ is not managed as a single unit, so you will have to coordinate the security rules for both of the cIPros.

With a single cIPro-DMZ in the basic VPN model (see the diagram "Network Models" below), you begin by building a VPN in which all tunnels terminate at a single IP address (through which all traffic is transmitted).

Of course, this model could easily be accomplished with two cIPros--though at a higher cost. (Keep in mind that you will need two public addresses to serve two DMZs.) Other configuration methods are also available. I set up the cIPro-DMZ as both a VPN and a firewall. In this scenario, I configured one cIPro as a VPN and the second VPN as a firewall (see the diagram "VPN + Firewall," at left).

Individual Initializing With two cIPro gateways in the cIPro-DMZ, I had to initialize each device individually--a fairly tedious task that requires inserting a hardware token and manually entering a secret key. Once that's completed, the cIPro is ready to obtain its profile from the cIPro-CA certificate authority.

When I launched a Hewlett-Packard Co. HP OpenView-based management application, I was presented with three icons--one for the cIPro-CA and one for each cIPro. I then had to configure each unit in the Secure DMZ individually, which creates an opportunity for misconfigurations. For example, if I wanted to manage a server on the Public DMZ from the private network, I would have had to add rules to enable access in two places. If RADGUARD had integrated the cIPro-DMZ's management into a single unit, then those two rules could have been combined into one.

Send your comments on this article to Mike Fratto at mfratto@nwc.com.