2

Silvia Hagen wrote in one of her books (ISBN:9783952294222, page 463) the following (free translation from german):

Tunneling, an essential element of IPsec [...], is problematic for existing firewalls and security gateways on the border to the company LAN. It's impossible to control traffic with an IPsec-tunnel, which has to be defined end-to-end, on the firwall. To solve the problem there has to be defined end-to-security-gateway SAs instead of end-to-end SAs. Therefor exists no standard at the moment.[...]

My question: Any idea what she does mean? I can't see a problem to establish a tunnel from endpoint to security gateway. Or does she mean, that it is a problem, because the traffic wouldn't be encypted in the LAN (from security gateway to endpoint)?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 12 '17 at 4:24
1

The issue is in policing the traffic at the border of your network. If you allow an inside host to form an IPSec (encrypted) tunnel to any outside host, the firewall cannot inspect what flows within the tunnel. At best, the firewall can prevent such tunnels from forming (or try to.) This could allow outsiders past your security measures, or allow information to move beyond your borders.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.