Re: IPSectarianism

[<mdevney () teamsphere com>]

On Tue, 16 Jan 2001, Dave Wardle, Critical Networks, Inc. wrote:

> Date: Tue, 16 Jan 2001 18:48:31 -0800 (PST)
> From: "Dave Wardle, Critical Networks, Inc." <dave () criticalnets com>
> To: nanog () merit edu
> Subject: IPSectarianism
>
>
> Is anyone on the list aware of Service Providers (ISP/NSP...) who DO
> block IPsec traffic, with or without informing their customers or peers?
I used to work for an ISP (http://www.pilot.net) who blocked *all* traffic
except that specifically asked for, in the interests of security.  This
was spelled out in the sales contract, and in fact was a prime selling
point.  (I ipened a lot of pinholes in a lot of firewalls for IPsec.)  I
imagine there are other ISPs who do the same.  

> From a customer standpoint, where I am now, I would never sign on with an
ISP/NSP who filtered *any* traffic.  I can manage my own firewall thank
you very much.[1]  I pay them for network access, to get my packets from
me to elsewhere and back, not to be my guardians.  

> I'm trying to assess the pros and cons of major Enterprise Customers
> basing their entire remote office/small office/mobile network access
> strategy on some type of IPsec based VPN solution.
I've been very happy with Cisco's IPsec VPNs from PIX to PIX.  They're
reasonably stable, very easy to set up, and since I'm not the one paying
12 grand + for what amounts to a 2-year-old desktop box running modified
IOS, their price is right.  Oftentimes clients simply say "Cisco?  Cool,
here's some money."  Only caveat being, you really need the failover.  

Mobile, I can't help you, sorry.


> Any thoughts?
>
> Cheers
> Dave
>
> -------
> Dave Wardle, Principal Consultant 
> Critical Networks, Inc.
> -------
> Email:    dave () criticalnets com
> Homepage: www.criticalnets.com
> -------
> Cell:     831 332 1021
> Tel:      831 662 1710
> Fax:      831 662 1710
> -------
[1] Please no snide comments about my current provider, I am not too
pleased with them for exactly the reason you're thinking and am discussing
other options with my supervisor.