Re: VPN and firewalls

[moorestuart () attmail com (Stuart Moore)]

Rik,

When talking about that generic "VPN" technology area, it is important to 
consider products in light of the problem to be solved.  Some of these "VPN" 
products are focused on solving different business problems (e.g., Internet as
a backbone, secure remote access via service provider, electronic commerce).  
Some try to solve all those problems, but are often better suited to one 
versus another.

An example:  One vendor of "upper layer" VPN technology has an interesting 
feature that allows for digital signatures of transport data.  A bank using 
this VPN product in conjunction with a secure web server could obtain a 
digitally signed copy of a web form submission at the VPN gateway, in addition
to a record on the secure web server.  This configuration provides two 
separate records that can be reconciled.  IPsec technology perhaps would not 
be so ideal in providing this type of service.  

I sense a tremendous amount of confusion in the marketplace over the very 
questions you asked.  The current products (despite slick marketing, in some 
cases) are still generally immature, and I think that customers diving into 
this head first will find the pool to be quite shallow.  It will be 
interesting to see how the market unfolds. 

Stuart


____________________ Begin Original Message ___________________________
Date: Sat Feb  7 15:42:15 -0700 1998
From: ltfirewall!spirit.com!rik (Rik Farrow)
Subject: VPN and firewalls
To: internet!nfr.net!firewall-wizards
Content-Type: text
Content-Length: 504

I am curious about why people are choosing VPN solutions which
are independent of firewalls, for example, Aventail or TimeStep.  

Do people poke these streams through their firewalls?

Is it a matter of performance?

Why pay extra for VPN capability which is already included in many firewalls?

What products are preferred and why?

I am looking for answers from people who have tried both methods:  using
the VPN as standalone product or bundled with their firewall.

Regards,
Rik