Low-end VPNs secure networks affordably
BUDGETING FOR a new VPN can be more daunting than learning the technology. Even relatively small companies must shell out many thousands of dollars to link their LANs to remote users or networks, with still more spent each year on support contracts and software update subscriptions.
It's no surprise that companies of all sizes are looking for ways to save money on their VPN servers. One alternative to the dozens of low-end commercial VPN servers is VPN software that costs you nothing.
Among VPN software offerings are OS-bundled and open-source solutions that use well-established standards: PPTP (Point-to-Point Tunneling Protocol), IPsec (IP Security), IKE (Internet Key Exchange), and 3DES (triple DES) encryption.
Microsoft partnered with Cisco Systems for its Windows 2000 implementation of VPN. Windows 2000's VPN services improve on PPTP by combining IPsec's superior packet security with Cisco's L2TP (Layer 2 Tunneling Protocol) tunneling. IPsec can tunnel on its own, but it won't encapsulate non-IP traffic, and it is difficult to use for remote clients, especially mobile ones. L2TP addresses these issues.
The Windows 2000 VPN server is mature and very efficient, traits that have many non-Windows shops running Windows 2000 solely for VPN. Windows 2000's IKE swaps encrypted authentication data using Kerberos Version 5, X.509 public key certificates, or preshared keys (passwords).
With Kerberos and public key certificate servers included free, Windows 2000 is a one-server VPN solution for links to Windows 2000, Windows XP, and Cisco VPN nodes. Because Microsoft's VPN solution deviates from VPN standards, linking to other types of VPN systems or gateways requires experimentation.
Sun's Solaris 8 Unix implements IPsec, but no standards-based VPN server or client is part of the distribution. The same is true of Hewlett-Packard's HP-UX 11i. Sun and HP sell VPN software as an add-on, and there are several commercial VPN solutions for Solaris and HP-UX. Users report varying degrees of success porting open-source VPN servers to Sun and HP versions of Unix.
Breaking with its Unix competitors, IBM made IPsec VPN a standard feature of AIX. The VPN feature set of AIX 4.3.3 is solid, with thorough documentation and a graphical management interface. Other IBM networking products implement L2TP and PPTP to simplify remote-client connections, but AIX eschews these protocols, focusing on pure IPsec server and gateway connectivity. AIX's IKE options include RSA signatures and preshared keys, with X.509 certificate support planned for AIX 5.
A few open-source VPN solutions stand out for their stability, adherence to standards, and level of acceptance.
One well-regarded open-source VPN server for Linux is PoPToP, named for the PPTP protocol it implements. It offers broad compatibility with a variety of clients and gateways and emphasizes Microsoft and Microsoft-compatible VPN implementations.
Several IPsec VPN implementations are available for Linux. The reigning open-source solution is FreeS/WAN. With FreeS/WAN's detailed documentation and active discussion group, it's easy to find specific information about connecting FreeS/WAN to other IPsec solutions. The latest release of FreeS/WAN includes an IKE module that uses RSA signatures or preshared keys.
Open-source editions of BSD (FreeBSD, NetBSD, and OpenBSD) feature a marvelous IPsec VPN implementation that is efficient, rreliable, and broadly interoperable. The BSD IKE engine, raccoon, supports preshared keys and RSA signatures and can be extended to support X.509 certificates. Similar to FreeS/WAN, raccoon does not yet validate a certificate against the issuing certificate server. Incidentally, Mac OS X uses BSD networking, so its VPN features match BSD's.
If you're already running Windows 2000 or AIX 4.3.3 servers, rolling out a VPN may be as simple as adding a network adapter and installing the VPN modules from a CD-ROM. Choosing from among the open-source solutions requires more thought. PoPToP on Linux is the simplest and most broadly compatible VPN server.
For IPsec VPN, FreeS/WAN has a large and loyal following, but BSD's implementation enjoys BSD's faultless reputation for reliable network services. Either will do the job, but for open-source IPsec VPN, we lean toward BSD.
» posted by ITworld staff
InfoWorld
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
VMware ESX Server in the Enterprise
By Edward L. Haletky
Published Dec 29, 2007 by Prentice Hall.
Enter now! | Official rules | Sample chapter
Green IT
By Toby Velte, Anthony Velte, Robert C. Elsenpeter
To be published Oct. 10, 2008 by McGraw Hill Professional
Enter now! | Official rules | About the book
