SSL VPNs won't save the world

Recently, a newcomer joined the world of VPN buzzwords: Secure Sockets Layer VPN. In April at NetWorld+Interop and at the Network World security tour I moderated last month, attendees had many questions about this new kind of VPN. Some would like to set up a competition, with IP Security and SSL VPNs squaring off in some 21st century version of World Wrestling Entertainment.

Reality is a lot less interesting; there is no competition between SSL and IPSec. The truth is that SSL VPNs have emerged because there's a clear need, one which IPSec has never been able to meet.

I've been involved with VPNs for a long time, and despite the slideware and happy promises of every IPSec vendor in the world, it's clear that IPSec has one very weak spot: remote access, specifically in the area of extranet applications. Multivendor interoperability in IPSec always has been difficult, but in remote-access and extranet applications, about the best that can be said is that IPSec works well only in tightly controlled, single-vendor environments. IPSec remote access can be difficult to deploy for large numbers of users. Where multiple gateways and corporations are involved, such as in an extranet environment, IPSec remote access has had more failures than successes.

I'm excited about SSL technology because it is strong where IPSec is weak. All the difficulties in extranet deployment, multivendor interoperability and general aggravation of multiplatform clients go away. With SSL VPNs, all you need is a Web browser, the universal client. It's great to see a new technology and so many good products come to market to solve a problem that hasn't been addressed well in the past. This is not like ATM to the desk, a solution looking for a problem. SSL can solve real business problems, and at lower cost and aggravation level than IPSec.

This also is why network managers have become excited: They're tired of the hassles and problems involved in extranet remote access, and the simple model presented in SSL VPN products looks not only pretty secure but also easily manageable. SSL isn't as secure as IPSec, but it's close enough to solve the extranet and Web-based remote-access needs of many organizations. And it's about a billion times simpler to deploy and manage.