Subject: Re: [saag] SSL VPN

From: "Fisk, Mike" <[email-masked]>
Date: Mon, 2 Jul 2012 19:28:28 +0000

The marketing around SSL VPN is pretty atrocious in my opinion... Most products basically provide an SSL proxy to internal web servers and, optionally, a "browser-based" plugin that installs a full kernel-level network tunnel for you. On Linux, for example, one major vendor provides a java package that runs sudo, gets the user to authenticate, and installs a traditional VPN client (not exactly the kind of thing you want users to be trained to be accepting of). Whether or not that tunnel uses SSL, IPsec, or rot13 is difficult to tell. Enterprises apparently prefer to get their employees to install network tunnels from the browser than to distribute software in more traditional ways.

-----Original Message-----
From: [email-masked] [[email-masked]<mailto:[email-masked]>]
Sent: Monday, July 02, 2012 12:07 PM Mountain Standard Time
To: [email-masked]
Cc: [email-masked]
Subject: [saag] SSL VPN

Joe Touch writes:

>>>> What, you've never heard of an SSL VPN?
>>>
>>> I've also heard of token ring, but besides the geek community, it's not used
>>> all that much. The dominant VPNs are IPsec and PPTP.
>>
>> Yeah, that's why both Cisco and Juniper have big SSL VPN product lines and
>> why Cisco AnyConnect now supports DTLS.
>
>  From their pages, these appear to be focused on support for email and
> web access to SSL-based services. E.g., from Cisco's page:
>
> ---
> SSL VPN Overview
>
> Cisco IOS SSL VPN provides SSL VPN remote-access connectivity from
> almost any Internet-enabled location using only a web browser that
> natively supports SSL encryption. This feature allows your company to
> extend access to its secure enterprise network to any authorized user by
> providing remote-access connectivity to corporate resources from any
> Internet-enabled location.
> ---
>
> I.e., that's web browser access to services.

That's wrong, sorry.  An SSL VPN provides full IP network extension -
it's most definitely not browser-only.  The technology is effectively IP
encapsulation in TLS, not clever use of TLS to access "SSL-based services."

EMC uses AnyConnect for secure remote access, and it effectively
replaced usage of remote access IPsec VPNs for the entire company.

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

_______________________________________________
saag mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/saag

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 3 Jul 2012 09:34:55 +0300

The issue is that VPN vendors want to provide software to customers that actually work.

There are networks out there (and I wish I had data to cite; maybe someone else has) that provide fairly excessing filtering policies and hence a plain IETF IKEv2/IPsec based VPN wouldn't get through the firewalls. 

Then, you have two choices: 

1) change the transport mechanisms for IKEv2/IPsec (running it over TCP)
2) switch to TLS

Since the IKEv2 exchange is pretty similar to the TLS handshake most people may not have strong preferences between the two. Over the years we had copied the features between TLS and IKEv2 back and forth.  

Ciao
Hannes

On Jul 2, 2012, at 10:28 PM, Fisk, Mike wrote:

> From: [email-masked] [[email-masked]]