A typical "Enterprise" VPN implementation includes an enforcement of IP 
traffic routing.  For example, it is not uncommon for the Policy to 
disallow any IP traffic outside of the IPSec tunnel.  So, when a user is 
connected to the corporate VPN, web surfing, music listening, etc... all 
IP traffic traverses the VPN, then makes it's way out over the Public 
Internet (if allowed).

Most of the corporate VPN setups I've worked with have a very restrictive 
Policy.  When connected, web surfing passes through some sort of "nanny 
filter" or a tracking appliance.  Access to Internet resources not on the 
approved list are blocked, everything else is logged with your username on 
the record.

How does the SSL VPN product differ from a custom Apache/SSL solution, I 
can't see much difference there between this and the ssh tunnels we use 
for the same purpose.  Although, a well constructed IPSec or ssh tunnel 
solution is a lot more difficult to spoof or crack than is SSL.  If you 
have a need to really keep the bad guys out of your data stream, SSL is 
not neccessarily secure enough.  (Good enough for typical consumer credit 
card transaction, not good enough for real secrets!)

 - tom e.
-----------------------------

On Wed, 28 Aug 2002, Mike Starke wrote:

Would anyone like to comment on this page/article?
http://www.aventail.com/ssl_vpn_benefits.asp

My only experience with VPN's is either using
OpenBSD w/IPsec for Lan-to-Lan connectivity, or
we had a Cisco Concentrator  and their client software
at my last place of employment for the road warriors.

I suppose my question would be this:
How does this (above link's hardware) differ from
connecting to something like an Apache server running
SSL?

Another question I have in my mind goes like this:
At my last employer's place I had a Citrix Server
with numerous "Published Applications", and access
to these pulblished apps via my debian/apache-ssl intranet
web sever. The other neat thing I had in this environment
was a NetApp filer. My web server NFS  mount'd the NetApp
(snapshots) departmental web directories. The departmental
'assignee' maintained their perspective "web site" via their
mapped out drives; and the web server just provided the
access/front end to all of the info.

Now I am wondering if I could create a comparable environment
using Linux. Wouldn't it be neat if one could log into
their Debian (big D fan :-) apache-ssl server, click on a link,
and have a GNU/Enterprise window open that is actually running
on my internal Debian/Application Server?

v/r
Mike
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change  you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss