Hi,
I have a corporate network protected from Internet through a Pix firewall. The corporate network is accessed by vendors who connect via IPsec VPNs on to the extranet arm of the firewall . Specific application layer ports are opened for traffic from required partner site addresses to the servers on the intanet.
Now there is a requiremnet to allowaccess from a new partner for a pilot project. We are not sure about the security of this partner network and we may not be able to audit it . So we neeed to allow access from this new partner through an IPsec VPN to the extranet arm of the firewall and then allow access to specific machines from the partner network to machines on the intranet on required application layer ports.
Now how do we ensure the secuirty of this architecture. I mean.. is it just trusting the partner and their network or is there any other way to further enhance the secuirty of the architecture. The partner might have machines with Public IP addresses (but they say that this pilot network is isolated from their interent and to make matter worse the partner is an ISP) coming into our network. Does this degrade secuirty by any means?
Is it a good solution to NAT the public address to private address space when they enter to our network through the VPN router? I mean will help in enhancing the secuirty by any means?
Is there any other suggestion? appreciate every one help in this matter..
regards,
jj
