1

What does an SSL VPN protect you from vs an IPSec VPN and what are the pros and cons to each?

0

1 Answer 1

1

Pro IPsec VPN:

  1. you can create site-to-site VPNs, allowing multiple hosts to access a remote network at the same time

  2. in this scenario, hosts don't need any additional software to participate in the VPN, allowing for arbitrary operating systems as long as they are able to network

  3. supports client-to-network as well, using a client software

  4. encrypted traffic between VPN gateways cannot (at this time) be
    decrypted by third party, without the receiving end noticing

Contra IPsec VPN:
5. requires dedicated hardware in each participating network, usually embedded in a router or gateway firewall.

Pro SSLVPN:

  1. uses a standard protocol (HTTPS) which is very rarely blocked in public spaces (hotels, free Wifi etc.); IPsec needs ESP, AH protocols, or standard UDP on uncommon high ports (500, 4500).

  2. for limited, predefined access to remote applications, a user only needs a browser and no additional software client. This requires on the SSLVPN gateway a proxy for each application offered.

Contra SSLVPN:

  1. to support arbitrary applications, hosts need to use a software client for SSLVPN tunnel mode

  2. hosts can only be part of the VPN if there is a browser or a VPN client software available for their OS (figure: printers, measurement probes,...) encryption places an additional CPU load on the host (vs. on the VPN gateway for IPsec)

  3. can be decrypted when intercepted, scanned and re-encrypted (although this will trigger a certificate warning at the client's end).

4
  • If this is the case with SSLVPN(with being intercepted) then is there any other purpose in using SSLVPN over HTTPS or SSL/TLS rather than just having control over application access? Jul 4, 2016 at 15:10
  • yes, pt. 6. If you're on the road, hotels and public WiFi outlets often block non-very-standard ports or protocols. HTTPS is so common that it's nearly guaranteed to work anywhere. Jul 4, 2016 at 16:22
  • So then would using mutual HTTPS be easier to manage rather than a VPN since it wouldn't require any extra equipment, just personal certificates? Jul 5, 2016 at 0:54
  • VPNs (SSL or IPsec) always require a gateway on one side, and at least a software client on the other. If with "mutual HTTPS" you mean a webserver with SSL, that's kind of the equivalent of a gateway. Depends on what you already have, and what your requirements are (application support, CPU load, user identification). Jul 5, 2016 at 8:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.