Whats the security difference between Policy Based IPSec VPN tunnel vs HTTPS + Basic auth

Question

We have several customers with the same service installed within their DMZ. This service is a HTTPS server. The server does not have authentication, this is solved by configuring the NetScaler firewall, configuring a forwarding rule to accept HTTPS on a endpoint (https://service.domain.com) and add Basic Autentication in NetScaler. After checking credentials NetScaler then forwards the request to the server hosting the service and returns.

Then we have this customer who want everything in tunnels. Our service connecting to the customer service is running in Azure Cloud and I'm struggling a bit with getting the logic up and running.

I know little about "vpn" (Policy Based IPSec) vs https+basic auth. But don't they operate on the same level on the OSI model - then security wise are no real benefits the one or the other solution?

The outcome is the same:

• they operates on the same level on the OSI model
• data is encrypted in both solutions
• there is access control in both solutions

Answer 1

There are two type of VPNs are available.

• Router based VPNs
• Policy Based VPNs

In policy based VPN the tunnel is specified within the policy itself with an action of "IPSec". Also for policy based VPN only one policy is required. A route based VPN is created with two policies, one for inbound and another for outbound with a normal "Accept" action. click here

A static route is also required for a route based VPN, so anything destined to the remote network must go through the virtual IPSec interface which was created when specifying this within the Phase 1 settings.

HTTPS basic authentication HTTP User agent provide User name and password to for authentication. It header contain Authorization: Basic <credentials> click here

IPsec Tunnel is encapsulated connection over public internet.It has two modes. Tunnel mode and Transport mode.

Tunnel mode is transport default mode. In Ipsec, original IP packet is protected by Ipsec using encryption. tunnel Mode is created between gateways. Gateway is acting as a proxy for host for behind the gateway.

HTTPS+basic authentication is not a vpn. It has no tunnel. Implementation is done by through enforcing access controls.

This has some issues.

• password sent over 64base encryption.
• Users can store password in browser permanently.(based on request.)

However HTTPS provide protection during the transmission.

for more information click here