Re: Deploying SSL-based VPNs

[Miguel Dilaj <miguel.dilaj () oissg org>]

Hi there!

We didn't had any issues other than the need to install it on all 
laptops (that surely can be scripted somehow...).
After the mandatory Windows reboot, the user simply got the CA cert, the 
user cert, the user private key, and the config files (as mentioned 
before, we have 2, one that puts the default route through the VPN, and 
other that simply adds routes to our servers).
Starting the VPN is right clicking on the icon and selecting which 
config you want to use, then enter your private key's password, and 
start sailing ;-)

In theory you can go completely clientless by using an IPSec VPN, and 
the IKE/IPSec functionality of Windows XP.
In practice I attempted that, and didn't like it for several reasons, 
one of which being that we want to be able from many places, including 
customers, sometimes over proxies, etc., and all this is impossible with 
IPSec.

For the records, before moving to OpenVPN we used FreeSWAN. It worked, 
with the limitations mentioned in the paragraph above.

Cheers,

Miguel


Joe wrote:
> Hello Miguel
>
> Thanks for sharing your experience. I'm not wondering that OpenVPN works 
> fine. You pointetd out that the deployment of the certificates was a 
> pain. How about deploying the software? Here I see the advantage of 
> clientless remote access solutions. They usually just download a java or 
> active-x client which uses the web-browser as the VPN-endpoint.
> The advantages of clientless VPN's are of course the deployment. However 
> cost and application support of a solution like OpenVPN are much better.
>
> Thanks
> Nik

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------