Always on VPN, RAS in DMZ with NIC to LAN?

Hi Everyone,


I've been tasked with building a proof of concept always on VPN system for my network.  There's many guides on the internet, but I can't help think that each one is a security risk.

We have a single Fortinet 1500D firewall which has an interface for the LAN and another for the DMZ.


My DMZ currently hosts an RODC and a domain joined SCCM DP for updating internet clients (which is bad enough).


Reading the deployment guides from Microsoft it infers that the RAS server in the DMZ is domain joined and has an interface for the DMZ and an additional one for the LAN.

Doesn't this pretty much blow all security out the water?

Thanks