On Fri, 2004-05-21 at 22:32, James Yonan wrote:
> I would stick with industry-standard technologies, like IPSec, as much
> as possible. I have used IPSec in tunnel mode to setup VPN tunnels
> between several branch offices.
While IPSec tends to work fine for static VPNs in cases where you have full
control over all firewalls, there are cases that come up where IPSec cannot be
used, such as
* Mobile (i.e. road-warrior) usage. Road warriors running a VPN client on a
laptop may need to securely connect from untrusted networks such as client
sites, internet cafes, LANs behind NAT, etc., where the VPN user does not have
control over the firewall policy on the local network. A user-space VPN such
as OpenVPN can connect via TCP, UDP, HTTP, socks, etc, and can do it over NAT.
I think this can/will be solved by implementing Mobile IPv4 or Mobile
IPv6 and using Home Agents that are able to proxy the mobile host and
thus masquerade the fact that it has changed its network attachment and,
with high probability, its IP address. In fact, I think there are Mobile
IPSec extensions currently in draft status.
However, it's probably more difficult to implement a solution based on
Mobile IPSec at the moment than using a solution like OpenVPN.
* VPNs between machines which don't have a static IP address,
such as cable
modem or DSL clients which have a DHCP assigned address. OpenVPN has the
ability to "follow" its peer if it changes its address due to a DHCP
I think the previous paragraph still applies here.
* IPSec is tightly coupled with IP and therefore is principally
securing IP-based routed networks. However an extremely common VPN
application is in securing ethernet 202.3 bridges. User space VPNs which
utilize TUN or TAP type virtual network interfaces can tunnel or bridge
arbitrary application or transport protocols transparently.
As far as the issue of industry standarization is concerned, there is
an RFC to standardize SSL/TLS VPN usage. This is certainly a valid issue,
though movement is occuring toward drafting a standard.
There are several drafts related to VPN technologies, like MPLS VPNs,
IPSec + L2TP for end-user and machine authentication, and SSL/TLS/SSH
tunneling. They will take time to reach the standard status, but I think
this will happen sooner or later.