Compatibility with Other Products

163 • Network Address Translation NAT is a protocol many routers support that allows machines to access the Internet even though they have internal IP addresses set aside in RFC 1918 that are not usable on the wider Internet. Essentially, each machine is given a nonroutable address, while the router has a routable IP address. When each of the machines behind the router wants to access the Internet, it pretends to have the IP address of the router. If you want to use NAT, we suggest a double-router setup, as shown in Figure 10-2 . It shows a gateway router to the Internet and a perimeter network with Internet-routable IP addresses. On the perimeter network is a NAT-capable router multi-homed to have interfaces to both the perimeter network and the internal network. The machines on the internal network have only non-Internet routable IP addresses. The VPN server is also multi-homed between the perimeter and internal networks, and will route only VPN traffic to and from those networks. Figure 10-2. Running a Network Address Translation router with a VPN server

10.3 Delivering Quality of Service

We have already spoken about QoS in reference to choosing an ISP. This section will discuss creating QoS for your own connectivity. QoS gives you the ability to manage your bandwidth. It does this by allowing you to assign priorities to certain types of network traffic based on user, application, host, network, or protocol. With a VPN, you might be using your VPN Internet connection for normal Internet traffic as well, such as email, web browsing, file transfers, etc. Since a VPN connection is business-critical, you might want those users to have less latency time compared to some other services. In this case, you could bump up the 164 priority of your VPN traffic, while lowering the priority of traffic that is not necessarily business oriented, such as PointCast, NNTP, or access to certain URLs. The Resource Reservation Protocol RSVP is a proposed Internet QoS standard that can be used to manage IP traffic. It is already available on some routing and VPN equipment, and some operating systems. In addition, there are a number of bandwidth management products available from vendors such as Packeteer and Check Point.

10.4 Security Suggestions

Our primary security suggestion is to make the VPN the only entry point to your network from the Internet. That is, make sure all of your systems are blocked or otherwise inaccessible from the Internet unless outside users connect to it via a VPN. Chapter 2 describes the use of firewalls to do this, and the subsequent implementation chapters go into more detail.

10.4.1 Restrict Who Has VPN Access

Its not a good idea to give out VPN access to just anyone. If your organization is undergoing constant change, or you are running a virtual corporation where everybody works from home, you may find it difficult to limit the users who have access. You may want to only allow people who really need remote access to have it. Here are some examples of people who might need remote VPN access: • Traveling sales or marketing people who need access to email and files. • Employees who work from home, or who need access to network servers after hours. Examples might be software developers, testers, documentation writers, or managers. Unless someone is permanently working from home or has a constant need for such access, it might be a good idea to grant them access only while they need the account, such as when theyre ill or unable to come into work. For example, an employee who breaks her leg badly and has to stay at home for several months might still be able to dial in and work. • Network or systems administrators. We also suggest that you create an acceptable-use policy governing your VPN accounts, which you should distribute to anyone with VPN access. Here are some suggested guidelines: • The VPN account is not a generic Internet account that an employee can use for anything he or she wants. Its virtually an extension of the corporations own network and the account the user has on the corporate system, even though it might go through an ISP. The user shouldnt give the account information to kids, relatives, friends, or even fellow employees. • The user shouldnt be routing a multi-homed connection to the VPN and another ISP. See the sidebar for an example of why. • The user should direct all technical support problems regarding the VPN to the network administrator rather than directly to the ISP involved. If needed, the network administrator can contact the ISP. There should be no reason for the user to give his or her password or the internal network domain to the ISP. • VPN users should change their passwords more often than other users of the internal network domain. They should also be sure to choose meaningless passwords, possibly