Our VPN 3030 is set up parallel to our firewall such that it has a single connection to the public and a single connection to our private network allowing users access to internal reasources from the internet. When wireless was deployed on our campus, it was decided that we would use the VPN to secure and authenticate wireless users. Most users are currently setup connecting to the wireless network, which is behind the firewall, and then terminating a VPN session to the public network interface of the 3030 which works fine. The draw back is that when a user wants to use the wireless network to browse the internet, that user uses a single translation through the firewall to connect to the VPN public interface and then another translation to connect out from the VPN to the internet. To avoid having the loop, I would like to teminate internal VPN users on the private interface of the 3030. As the concentrator is currently set up, it is possible to form a session on the private interface, but I wanted to know if that is by design how the system was meant to work (which is my understanding) or if allowing VPN sessions to terminate on the private interface is insecure and shouldn't be allowed. Thanks in advance for any advice that is offered.
