Firewall back to back connectivity solution

[Balakrishnan Appavu]

Hi,

The customer must need a cisco IPsec client VPN solution (for iPhone). So, we needs a Cisco security appliance to establish the VPN client. But he has an UTM in place for his current services (SMTP,PoP & browsing). Now we need to place the cisco appliance and configure for VPN client tunnel and the VPN client traffic needs to pass-through Existing UTM for Anti-x scanning.Whether the traffic/Data from the cisco appliance will pass through the UTM and get scanned before reaching the LAN. Refer the diagram.

Confirm how the traffic flow would be or suggest for alternate soln to acheive the same.

Thanks.

[ramds]

Hello Balakrishnan,

I went through the setup and below is my understanding:

The UTM device sits between the ASA and the upstream router which is the internet gateway for the ASA. Now, the IPSec traffic is encrypted and encapsulated traffic and hence no device can do any type of inspection on this traffic.

So the ideal place to put this UTM device is in the lan before the end hosts, where the plain traffic is seen and this would be scanned and later sent to the corresponding pc.

Hope this helps.

--

Ramya

--Please rate the solutions.