🚀 go-pugleaf

Unless they have some pretty slack policies, there shouldn't be any way to
establish a VPN without involving them.  You have to open ports for
authentication (i.e., 500/UDP for IKE) and encapsulation (esp, gre, etc.),
which requires that they modify their policy.

--
Keith W. McCammon


"Poster" <someone@microsoft.com> wrote in message
news:e2W78.96$mb6.263@pollux.casema.net...
>
> Hello
>
> I'm an IT guy at a working company which only has an internet
> connection through a firewall (FW1) which is managed by another
> IT department (holding company) I like to connect our network
> through a secured VPN connection (haven't bought any software yet).
>  I'm not able to configure the FW1 myself.
> I wonder if it's somehow possible to use this internet connection for
> a VPN connection without changing the firewall AND without involving the
> holding ICT department.  It takes way TOO long waiting for the holding
> company to start their own VPN project.
>
> thanks !!!!
>
>
>
>
>

Try running a port scan from outside of the FW against a node inside.  If
you can (doubtful) than you can do anything you like.

"Poster" <someone@microsoft.com> wrote in message
news:e2W78.96$mb6.263@pollux.casema.net...
>
> Hello
>
> I'm an IT guy at a working company which only has an internet
> connection through a firewall (FW1) which is managed by another
> IT department (holding company) I like to connect our network
> through a secured VPN connection (haven't bought any software yet).
>  I'm not able to configure the FW1 myself.
> I wonder if it's somehow possible to use this internet connection for
> a VPN connection without changing the firewall AND without involving the
> holding ICT department.  It takes way TOO long waiting for the holding
> company to start their own VPN project.
>
> thanks !!!!
>
>
>
>
>

> Try running a port scan from outside of the FW against a node inside.  If
> you can (doubtful) than you can do anything you like.

Even if that is possible (which it likely is not), that has nothing to do
with establishing a tunnel from an internal host.  I could set up a rule (w-
Static Dest NAT) that says NOT-INTERNAL -> INTERNAL ANY ALLOW, which would
allow a portscan from an external host to an internal host.  However, that
internal host still can't initiate access to an external network unless I
explicitly add another rule to permit the action.

On Tue, 05 Feb 2002 19:05:46 GMT, Poster spoketh

>
>Hello
>
>I'm an IT guy at a working company which only has an internet
>connection through a firewall (FW1) which is managed by another
>IT department (holding company) I like to connect our network
>through a secured VPN connection (haven't bought any software yet).
> I'm not able to configure the FW1 myself.
>I wonder if it's somehow possible to use this internet connection for
>a VPN connection without changing the firewall AND without involving the
>holding ICT department.  It takes way TOO long waiting for the holding
>company to start their own VPN project.
>
>thanks !!!!
>

If you have more than one public IP address available, you can set up a
VPN gateway in parallel to the firewall. You'll need a router (or
something) on your LAN to send the VPN traffic to the VPN gateway and
all the other stuff to the FW-1. It's a rather common configuration...
Lars M. Hansen
http://www.hansenonline.net
(replace 'badnews' with 'lars' in e-mail address)