Hi Mark, great write-up and very clear and complete.

I have one design question, why is it not foreseen to specify a Radius authentication server on the Security servers ? Isn't it more logical to do the authentication as soon as possible when a user comes in from the Internet ?

Our VPN gateways are set up like that.

Now the Radius authentication has to come from the paired Connection servers, and those are located in another site. The Security server - Connection server connection runs over the company backbone from the site that hosts the DMZ to the site where the View servers run.

Luc