IPSec VPNs versus SSL VPNs: security, scalability, and administration

IPSec VPNs vs. SSL VPNs

Although SSL VPNs are making great headway in the market against IPSec VPNs, this momentum doesn't necessarily mean that SSL is the right solution for every deployment. This paper explores security, maintenance and administration, scalability, application independence, and site-to-site connectivity as the key issues that should be considered to make the right decision.

Security

Because IPSec VPN solutions require IPSec client software, it provides an extra layer of security. The client machine must have the right VPN client software to connect to an IPSec VPN and presents additional hurdles before gaining access to a network (Bradley). With SSL VPN solutions, if the client platform security is compromised, security becomes an issue although some vendors have developed ways to check the client machines for security threats (All about SSL VPN).

Still, IPSec grants access to the entire network while SSL VPN enables better access control because it tunnels to specific applications so users can only access the applications they are configured to access rather than the entire network (Bradley).

Maintenance and Administration

The requirement for IPSec client software means that companies must maintain the licenses for the client software and must install and configure the software on all remote machines (Bradley). In contrast, according to Bradley, SSL VPN only requires a web browser to initiate a VPN session. This is considered to be largest advantage of a SSL VPN over an IPSec VPN.

Scalability

Through IP, IPSec can be applied in networks of all sizes including LAN's to global networks (Advantages and disadvantages of IPSec). SSL is processor-intensive, leading to poor performance under high loads. For deployments requiring scalability, SSL VPN limitations would have to be resolved by clustering and load balancing techniques (Kilpatrick, 2007).

Site-to-Site Connectivity

IPSec is still the preferred method for site-to-site VPNs because either IPSec or SSL requires a gateway and because many SSL vendors don't currently offer site-to-site connections (Greene, 2007).

Conclusion

There are a number of factors to consider when choosing between an IPSec and a SSL VPN. A SSL VPN is likely to meeting the needs of a small number of users connecting to a small number of applications. Security, scalability, interoperability and site-to-site connectivity requirements, however, require a closer examination of the pros and cons of each approach with the realization that SSL VPNs will be easer to manage and administer provided that its shortcomings are acceptable or can be overcome with additional technologies. However, SSL VPN technology is rapidly advancing, and progress should be closely monitored.