Hi David
There are generally 2 ways i have seen VPN concentrators deployed.
1) Public interface on one DMZ behind the firewall. Private interface on another DMZ behind firewall. To get to the public interface you have to pass through the firewall.
2) Public interface parallel with firewall ie. publci interface is usually assigned an IP addresss out of the same subnet as the outside interface of the firewall. Private interface connected to DMZ hanging off the firewall.
I would not want to have the private interface connecting straight into the LAN, rather in both 1 & 2 it should be connected to a DMZ.
With option 1 you can add a rule on your firewall only allow the relevant IPSEC ports to the public interface of your concentrator. However sometimes the firewall can be more of a hindrance than a help especially if you are using a lot of NAT
With option 2 you need to make sure that only the IPSEC protocols are accepted on the public interface. No problems with NAT at your end. If you happen to have control over your border router upstream of the firewall then you can add an access-list rule to only allow IPSEC ports to the public interface of your concentrator.
Either way is acceptable, the key thing being that common to both is the need to have the private interface on a DMZ.
HTH
Jon
