Firewall Wizards: Re: stealth firewalls

["Volker Tanger" <volker.tanger () discon de>]

ark () eltex ru wrote:

> YOU (Volker Tanger) WROTE:
>
>> Second problem is doing VPN - or: not! Without a (visible) VPN peer
>> there is no VPN to be established.

> Why not? I see no technical reason why one cannot build birdging
> functionality over 100% isolated underlying VPN infrastructure and
> virtual tunneling interfaces.

Okay, misunderstanding: you can not do VPN without an IP address 

for the VPN peers. 

If the firewall is expected to do the VPN stuff, it has

to have an IP address responding to IKE, ICMP, whatever.
But with this it is no longer a stealth (i.e. IP-addressless)
firewall.


Of course you can do VPN between two peers with a stealth firewall in 
between (that is if the firewall allows), but that was not the point.
Bye
        Volker

--

Volker Tanger  <volker.tanger () discon de>
 Wrangelstr. 100, 10997 Berlin, Germany
    DiSCON GmbH - Internet Solutions
         http://www.discon.de/

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards