wordpressrobot.com

Selecting the Right SSL VPN Solution

Not all SSL VPN harvest are produced copy. Those with functional limitations or incomplete feature sets will not be able to fully deliver the advantages outlined in the previous sections. To guard against making a choice that is less than ultimate, companies should evaluate harvest against the following criteria.

Comprehensive Access

Ultimately, the goal is to be able to provide any user, operating in any place, with practically any type of device, access to just about any service or application. From a practical perspective such access will not permanently be allowed, but the point is to at least have the capability so that it can be utilized when the need arises. From a technical perspective, this entails supporting enough access modes to account for all types of applications, including Web, client server, legacy and multiple types of TCC. Furthermore, it is vital to know the dependencies and limitations for each of the access modes. What client operating systems are supported? What browsers are supported? What, if any, client software is required, can it be dynamically downloaded, and what technology (such as Committed-X) and configuration dependencies (such as user must have administrative privileges) are applicable. An ultimate solution is one that incurs the fewest dependencies while still supporting all of the organization’s access needs.

Comprehensive Security

Not only must data be protected while it is in transit and for whatever time it resides on a client device, but it is also elemental to protect the organization’s overall computing environment from remote systems that have been compromised or otherwise infected. In other words, security capabilities must be thought of in terms of providing end-to-end protection, and should ideally include the following countermeasures:

 

Transparency and Compatibility

On the one hand, this involves minimizing the effort and investment required by the users that require access. There should be no need to buy, operate and maintain any specific software or hardware at the remote end of the session. In addition, any dynamically downloaded software, such as agents or plug-ins used to support certain access modes or security features, should not disrupt or otherwise exchange the surgical procedure of any programs or the client system itself.

On the other hand, the same conditions should also apply for the party providing the access. The SSL VPN gateway should just “fit in.” Small, if any, network re-configuration should be required. Furthermore, it should be able to operate completely independently or, optionally, it should be able to take advantage of any existing credential and attribute stores (for example, LDAP directories), access management software and portal software that the organization is by now using. Most importantly, it should not require applications and other resources to be modified in any manner in order to be in the least accessible.

 

 

Ease of Use and Administration

This category of criteria is somewhat similar to the previous one. But, in this case it is more about the day-to-day experience of the users, as well as IT/security operations. For the users, the key to success is ease of use. The interface should be intuitive, if not familiar, and very simple to navigate. Users should not have to sign on more than once in a given session. Nor should they have to make any decisions (for example, in terms of the access mode to use), other than to select the resources they want to access. In the event that one or more groups of users will have access to multiple resources, then a customizable, portal-style look-and-feel will be appropriate.

For the administrators, it comes down to management functionality. A centralized management capability is elemental, but it should also be possible to depute policy creation to local administrators who may be more familiar with a specific group of users and the resources they are accessing. When it comes to the policy model, there should be flexible grouping of related bits and pieces, as well as re-use and modularity of object definitions and policy fragments. Overall, there should be an ability to implement virtually any access rule an organization can articulate. In addition, real-time session monitoring is helpful for troubleshooting purposes, while extensive logging capabilities are needed to support capacity plotting and compliance reporting activities.

Performance

This category of criteria is intended to cover more than just system capacity or throughput. Given today’s highly collaborative applications, latency requirements should also be considered when evaluating performance-related features such as the count and type of processors being used, supple memory, and enhanced techniques for handling and inspecting packets/sessions. Scalability is a further vital factor, particularly when it comes to cost effectiveness. This will be single-minded in large part by a product’s management capabilities, but can also be affected by support for advanced features such as clustering and virtual systems.

Dedicated SSL VPN Appliance vs Multi functional Appliance

Having extra features on an appliance is sometimes fantastic to have, but when considering a full scaled solution implemented across an entire enterprise, providing dedicated functionalities like SSL VPN should be taken into significance first.

Juniper

Juniper`s SSL VPN solution is based on the Secure Access series of platforms, which are hardened security appliances built from the ground up purely for SSL VPN purposes. Cisco Cisco reduces efforts on SSL VPN functionalities to an appliance that does IPSec VPN, Firewall, and increases on other functionalities instead.

 

Robust and advanced configuration options

Juniper’s SSL VPN solution differentiates itself from Cisco’s ASA with mature harvest and feature set that have evolved, and been validated by thousands of customers. Solution includes richer features and better configuration across the board and not just limited to a particular area. This signifies Juniper’s leadership in this market and much larger customer base who remain loyal.   Juniper’s solution has richer AAA capabilities (Certification, Authorization and Accounting) including support for SAML (Security Assertion Markup Language), and Single Sign-On using NTLM v2, Kerberos and Kerberos Constrained Delegation.

Cisco lags behind in both the depth of AAA features as well the ease of use and configuration options for existing AAA features. Juniper’s solution has richer Endpoint Security features, including support for Host Checker on Windows Mobile. Cisco’s solution includes primitive support for endpoint security and no support for Windows Mobile or even Mac and Linux support (apart from on the Cisco Secure Desktop which is separate from their fixed Host Checker).