You'd better shop around for VPNs

Virtual private networks are a staple way of giving remote users access to network resources, but one size does not fit all.

The IP Security protocol that protects VPNs has been around for years. Its tunnels sometimes get stopped by firewalls and also can provide paths for worms and other malicious code to intrude. Furthermore, VPN client software must be maintained, which can be difficult or impossible for remote users.

In the past four years, Secure Sockets Layer VPNs have gained popularity over IPSec ones.
The National Park Service replaced three types of IPSec VPNs with the e-Gap remote-access appliance from Whale Communications Ltd. of Fort Lee, N.J.

About 20,000 NPS employees can access their IBM Lotus Notes applications from any PC with an SSL-capable Web browser.

But SSL VPNs have drawbacks, too. Because they act at the application layer, some applications require modification to work with them. The new Hybrid-VPN Gateway from Net6 Inc. of San Jose, Calif., tries to combine the best of both kinds of VPN while eliminating their drawbacks.

'We haven't found any application that won't work over the Hybrid-VPN,' said David O'Berry, director of information systems for the South Carolina Department of Probation, Parole and Pardon Services.

The Park Service's choice of an SSL VPN was driven by security needs as well as a desire to simplify, said Kendra Peel, NPS' Lotus Notes administrator.

'The VPN allowed access to too much, and that was a security concern for us,' Peel said. 'We wanted to provide all the users with the securest possible access to the resources.'

E-Gap Remote Access takes the user to a Park Service proxy server through a Web portal. When the user enters a Notes user name and password, the server accesses the requested data and sends it back to the browser.

'The user is never actually inside the internal network,' said Aimee Rhodes, Whale's strategic relations director.

Browser access, however, can introduce its own set of security risks, so e-Gap times out inactive sessions. Features such as Microsoft Outlook's automatic checks for new e-mail can thwart time-outs, but e-Gap identifies and ignores the computer-generated requests.

Although an SSL VPN does not need client software, e-Gap downloads to the client a wiper applet to clean out attachments and cached data as each session ends.

NPS has licenses for 500 concurrent users, 250 on each of two servers for load balancing. Because the NPS network has only one Internet connection, both servers are located at NPS headquarters in Washington.

Although e-Gap is almost transparent to the end user, it does require tuning for specific applications.

'The configuration of the software is not something you can just jump into,' Peel said. 'It has a high learning curve.'

Fortunately, she said, she enjoys configuration and is happy with Whale's level of support. And once the software is up and running, she finds it needs little maintenance.

'It's nice to have a piece of software you can go without looking at for weeks at a time,' she said.

Firewall problems

South Carolina's probation department began looking for an alternative VPN because of firewall troubles. The department's 700 employees, about 500 of them field agents, supervise more than 50,000 offenders. Agents can access department resources while in court in 15 counties from notebook PCs installed in the courtrooms.

'We've always used an IPSec VPN for remote access,' O'Berry said. 'Each county had a different system. Some had no firewalls, and some had firewalls whose rule sets had to be changed to allow IPSec.'

'It was a nightmare,' assistant network manager Tom Webb said. 'I spent a couple of weeks just calling back and forth,' formulating rule sets for firewalls he had never seen.

O'Berry looked for an SSL VPN to carry fat clients through the multiplicity of county firewalls, but he also wanted something that would work easily with multiple applications.

He took a chance on the Hybrid-VPN product, introduced in April. Like an IPSec firewall, it intercepts traffic at the network layer and transports it to the end user at the application layer via SSL.

'The reality is that customers need both' SSL and IPSec, Net6 CEO Murli Thirumali said.

The Hybrid-VPN can handle up to 2,000 sessions on a single server. The South Carolina department has about 100 notebooks in 25 counties, and it expects to expand to the state's remaining 21 counties. About 150 federal probation officers also are expected to use the VPN with notebook thin clients.

'The SSL box is one of the staples for this,' O'Berry said. 'We can go across port 443 at all locations without modifying any of the firewalls.'

O'Berry stressed the necessity of research for answers to IT problems.

'Leave no stone unturned,' he said. 'I could have very easily missed this product,' which had just come out of beta testing when he discovered it.

'Sometimes you have to take the chance' as long as the product has the basic needed functionality at an affordable price, O'Berry said.