9.7. SSL VPN
9.7.1. Overview
NetDefendOS provides an additional type of VPN connection called SSL VPN. This makes use of
the Secure Sockets Layer (SSL) protocol to provide a secure tunnel between a remote client
computer and a NetDefend Firewall. Any application on the client can then communicate
securely with servers located on the protected side of the firewall.
The Advantage of SSL VPN
The key advantage of SSL VPN is that it enables secure communications between a client and a
firewall using the HTTPS protocol. In some environments where roaming clients have to operate,
such as hotels or airports, network equipment will often not allow other tunneling protocols,
such as IPsec, to be used.
In such cases, SSL VPN provides a viable, simple, secure client connection solution.
The SSL VPN Disadvantage
A disadvantage of SSL VPN is that it relies on tunneling techniques that make extensive use of
TCP protocol encapsulation for reliable transmission. This leads to extra processing overhead
which can cause noticeable latencies in some high load situations.
SSL VPN therefore demands more processing resources than, for example, IPsec. In addition,
hardware acceleration for IPsec is available on some hardware platforms to further boost
processing efficiency.
Cryptographic Suites and TLS Version Supported by NetDefendOS
NetDefendOS supports a number of cryptographic algorithms for SSL VPN. Only some are
enabled by default and all can be either enabled or disabled. All the supported algorithms are
listed in Section 13.9, “SSL/TLS Settings”. Note that TLS version 1.0 and 1.2 is supported by
NetDefendOS but not version 1.1. Refer to Section 13.9, “SSL/TLS Settings” for how to disable
version 1.2 so only 1.0 can be used.
By default, only the four algorithms which are considered the most secure are enabled. It is not
recommended to enable the weaker algorithms and they exist primarily for backwards
compatibility.
A Summary of SSL VPN Setup Steps
SSL VPN setup requires the following steps:
• On the NetDefend Firewall side:
i. An SSL VPN Interface object needs to be created which configures a particular Ethernet
interface to accept SSL VPN connections.
ii. An Authentication Rule needs to be defined for incoming SSL VPN clients and the rule
must have the Interface property set to be the name of the SSL VPN object created
above.
The Authentication Agent of the rule must be set to L2TP/PPTP/SSL VPN and the rule's
Chapter 9: VPN
752
To Next Page
Loading...
