AMP for Endpoint over IPSec S2S VPN

[dngore]

Hi Experts,

We are proposing AMP 4E for servers (linux and Windows). Customer will have private cloud AMP & TG installation at one site.

And Serers with AMP connector at another site. These two sites will be connected by Site to site VPN. So basically AMP connector will communicate over VPN to AMP PC & TG

Do you see any challenges or risks in above solution?

[rolszowy]

In L2L VPN over internet, MTU will be smaller than default 1500 bytes. Because of that SSL handshake can fail because of the Don't Fragment flag set in IPv4 header.

In this case I would either allowed and enabled ICMP Unreachable (recommended) or cleared DF-bit on the tunnel itself. Other than that, you should be covered.