One vendor wanted to install their VPN device (Cisco 800) behind the firewall. They asked us to open ports so they can establish the tunnel.
Another vendor wanted to install their VPN device (Cisco 1921) outside the firewall, but physically attached to our network. They would then be routed into our network through the gateway. (Is this even possible? This is a secondary question that doesn't have to be answered here)
In general, which is more secure?
What are the pro/con of each configuration?