SSL-based remote access to hit the big time

Check Point's entry into the Secure Sockets Layer-based remote access market signals a key point in the VPN world.

Until now, Check Point, one of the top vendors of firewalls and IPSec VPN software, was focused only on IPSec. It has its own client with a sophisticated management platform for setting policies and pushing updates, addressing well one of the key gripes about remote access VPNs. Distributing, managing and maintaining all the clients in a large deployment is a lot of work.

The addition of SSL lifts some of that burden. By using the SSL capabilities of browsers, Check Point eliminates the need altogether of keeping track of the clients. Any PC with the ability to handle any type of remote access already has the browser. Administrators have to do nothing to all those remote machines to take advantage of SSL remote access.

There is a tradeoff. Not all SSL-based remote access gear can handle client-server applications. They require that the applications themselves are already Web-enabled. So if you want to take advantage of this technology, you may have to be willing to accept limits.

Most users that have jumped on the SSL remote access technology say this limitation is not crippling. Many if not most remote access users are just tapping in to collect their e-mail and don't really need all the additional resources that an IPSec VPN would enable. So for them, a zero-maintenance remote access client is welcome.

For businesses with some users who need the expanded capabilities of an IPSec VPN, many businesses are running SSL and IPSec remote access networks in tandem. The strain of running the SSL network is light enough to make the two networks worthwhile.

Since the SSL alternative is already viewed as a supplement to IPSec, it makes sense that Check Point would add SSL support to its gateway platform. It is a good enough idea that it will likely be picked up by other IPSec VPN vendors.

Those vendors that focus solely on SSL remote access have more sophisticated products than Check Point's by virtue of their longer history in the field, so you may want to consider that before jumping with both feet into Check Point's offering. But if you hadn't considered SSL remote access at all, you should regard Check Point's entry into the area as a mark that the technology is going to stick around at least to fill a specific niche.

Tim Greene is a senior editor at Network World, covering virtual private networking gear, remote access, core switching and local phone companies. You can reach him at tgreene@nww.com.

Network World VPNs archive
Past newsletters.