Re: [tlug] VPN h/w servers

[Al Hoang <hoanga@example.com>]

Hi,

On Fri, Dec 01, 2006 at 06:57:09AM -0800, Gerald Naughton wrote:
> Hi
> Wondering to buy VPN h/w servers like
> http://www.securitywizardry.com/vpnservers.htm
> 
> 
> anyone using anything besides a Linux box ?

	I've used the Nortel VPN from the user side as well as seen
the Cisco VPN in action.  Also been looking at an Astaro box.
	After that, I've not really many other commercial solutions
and look towards OSS versions to see if they fit the needs but the
harder part is specifying the needs.

> Appreciate it if u can tell me the
> advantages/disadvantages ?

	I think this is an ill-formed question without more clarification.  
You could easily write pages in comparison/contrast to VPN solutions but 
the problem is there are varying forms of VPN implementations and I'm 
not sure it makes much sense to compare all of them head-to-head.
	However, most VPNs fall into 2 classifications of
connectivity from my fuzzy understanding of them:
1. Server-client
2. Site-to-site

	The server-client classification I would broadly identify as a VPN
solution where there is one main VPN box that offers access to some
corporate internal network and many clients connect to this VPN box
then can gain access to the internal network.  This works well for
workers who are mobile and need access to resources that are only
available on an internal network.
	The site-to-site approach is where networks that are
segregated remotely/administratively/whatever are linked together
via a VPN and now both networks have access to each other's resources.

	These are different approaches to handling a VPN and which
one is 'best' depends on situation, doesn't it? Once you have answered
the question on classification then it gets down into (in no specific order):
1. encryption types and do you need
2. OS Support (If you're an all Linux shop then decide on a Windows
   implementation, you might be barking up the wrong tree)
3. Ease of use
4. Integration into the larger enterprise network
5. Whether it requires giving users training
6. Available budget
7. Local expertise (Asking a on-site Cisco expert to all of a sudden 
   integrate a Nortel VPN box sounds like a lot of integration testing work)
8. Availability
9. Performance (If the box can only handle 100 concurrent users and you need
   1000, I think this is a problem)

	From my personal standpoint, if an OSS solution does what you need
and it's not hell to maintain, why not stick with it?  OpenVPN so far has
been a good candidate to me as it supports many OSes out of the box and
seems to still be under active development.


Alain