Cisco VPN options? 4

[hinesjrh]

I am about ready to purchase a couple of ASA 5520's and implement the Cisco VPN solutions for my remote / traveling users. Can any of you describe how the different VPN options (SSL from a browser, SSL with AnyConnect client, and IPSec with client) apply to differnt types of users or scenarios? Why would I offer one over the other?

 

[Supergrrover]

Money and ease of connection. The extra SSL licenses cost a lot of money but are a cool feature. They don't require anything but an internet connection from the user so they are very portable from that stand point. I use the two licenses that come with it and they're cool but for the majority I use the VPN client. It's free for as many connections as your device will support.

I haven't use the anyconnect client. So no advice on that one.



Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[garnetbobcat]

Clientless SSL VPN
As the name suggests, the clientless SSL VPN solution just uses the browser. Users connect to the ASA with their browsers and through that session have access to internal HTTP/FTP/CIFS (windows fileshares). With additional plugins you can provide access to Remote Desktop, SSH/Telnet, VNC and Citrix, too.

Some "thick Client" applications are also supported with Smart Tunnels. From Cisco.com: "Smart tunneling allows Microsoft Windows users access to TCP applications without the prerequisite of administrative rights and allows VPN administrators to grant only approved applications access to internal resources."

AnyConnect VPN Client
The AnyConnect VPN client provides a full tunnel experience like the IPSec VPN Client, but does it with SSL and DTLS. This means that getting it through NAT devices or other firewalls is pretty foolproof.

Clients can launch the AnyConnect client in a few ways:

*locally user admin-defined profiles
*connect to the ASA and have it launch automatically
*connect to the ASA, login to a Clientless session and then launch the AnyConnect client.

AnyConnect is also the only way to get a full client for Vista 64-bit PCs.


IPsec VPN Client
The IPSec VPN Client provides a full tunnel experience for the user over IPSec. It is launched on the user's PC.

Unless you enable NAT-T or IPSec over UDP/TCP, users might have a problem connecting to your ASA when traversing NAT or another firewall.

Here's a link to a data sheet on Cisco's SSL VPN solutions.

http://www.cisco.com/en/US/prod/col...s6120/product_data_sheet0900aecd80402e3f.html

Here's a link to SSL VPN Config Examples for the ASA:

http://www.cisco.com/en/US/products/ps6120/prod_configuration_examples_list.html#anchor12

Matt
CCIE Security

http://www.wr-mem.com

 

[brianinms]

I have to give Matt a star for that, as it was one of the most descriptive and concise explanations I have seen in a while.

 

[hinesjrh]

That was good Matt! Thanks.

 

[pnc4me]

I wish I had seen this a year ago! Matt, can I encourage your or someone else looking at this thread to tell me why my PIX connecting to a Direcway satellite modem is so slow? See

http://www.tek-tips.com/viewthread.cfm?qid=1447210&page=1

Thanks in advance!