IPSec VPN alternatives

"Clientless VPN" technology is catching on as the term that describes products that serve as an alternative to traditional IP Security-based VPNs.

These products come into play when an IPSec-based VPN has too much overhead, has too many proprietary extensions, is too expensive or is too limiting to solve the problem at hand. Case in point: An extranet-type VPN, with hundreds or thousands of companies participating, would be almost impossible to manage using off-the-shelf IPSec technology.

Several vendors, including Aventail, Neoteris, Netilla, SafeWeb and TrueDisk, have introduced Secure Sockets Layer (SSL)-based VPN security gateways, while Check Point Software and Nortel have added SSL-based VPN service to their overall VPN products.

The key to SSL-based VPNs is a client application available on everyone's computer: the Web browser. An end user launches a Web browser and then connects, using HTTP-over-SSL, to the SSL security gateway. After the SSL gateway authenticates the user, it proxies the connection - typically using HTTP - to a Web server inside.

One common application example is Web-based e-mail, such as Outlook Web Access (OWA), the Web front end to Microsoft's popular Exchange mail system. By dropping an SSL-based VPN server in front of an OWA Web server, a network manager can add encryption, authentication and control without putting the additional load of SSL encryption directly on the OWA server.

In this context, SSL-based VPNs not only encrypt the traffic passing over the Internet, but also keep the unwashed masses from having direct contact with an Internet Information Server.

Some vendors have taken the idea of SSL-based VPNs even further by including protocol translators in their products. These gateway between the client-side HTTP-over-SSL and different protocols on the inside. This lets you browse your file system over the SSL VPN, for example.

The security model used in SSL-based VPNs is weaker than the one used in IPSec. There are more opportunities for outside attack, the cryptographic model is not as robust, and the authentication is not as strong.

Additionally, there are many applications that don't work over SSL-based VPNs. But for many applications, an SSL-based VPN can provide sufficient security with almost none of the headaches of a full IPSec-based remote access product.

Learn more about this topic

SSL gets respect from IPSec vendors

Secure Sockets Layer-based remote access is about to hit the big time. Network World, 07/29/02.

SSL catching up to VPNs in popularity

A growing number of organizations looking for a fast, secure way to link remote users and business partners are turning away from traditional IP Security-based VPNs and toward products and services based on Secure Sockets Layer technology. Network World, 02/18/02.

Evaluating VPN security alternatives

Users looking for a fast, secure way to link remote employees and business partners are finding myriad choices to avoid deploying traditional IP Security-based VPNs and instead install products or services based on Secure Sockets Layer technology. Network World, 10/14/02.

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.
Now read: Getting grounded in IoT