Re: [saag] looking to hold a TLS VPN side meeting at IETF 92

[Peter Gutmann <[e-mail]>]

Aaron Zauner <[e-mail]> writes:

>IPSec might (!) work well if you use one vendor throughout your network,
>pretty much the same thing as some have argued with vendor SSL/TLS VPN
>solutions. 

That's the impression I got from folks who have to deploy IPsec solutions,
there seem to be two approaches:

1. Use all gear from the same vendor, configured identically.

2. If you can't manage that, budget lots of time to get things working, and
   bring along something like OpenSWAN and a lot of debugging tools (to quote
   their docs, "Configuration is normally the easy portion of setting up an
   ipsec tunnel, it's normally the debugging that takes up the majority of
   time. Particularly if dealing with heterogeneous peers").  Get things up
   and running, typically in some lowest-common-denominator mode, and never
   touch it again in case it breaks.

>Because IPSec is such an overly complicated protocol there's not much
>security in the clients that are available throughout enduser operating
>system. Apple, for example, uses racoon (a NetBSD client) for IPSec. It only
>supports IKEv1 in Aggressive Mode. 

That's pretty much a given when you have to use approach #2, unfortunately.

>IPSec works pretty well for site-to-site setups; then -- again -- if you use
>different vendors, or even different product-cycles of a given vendor, you
>might run into interoperability problems. I don't know of a single network
>engineer that enjoys deploying IPSec.

Yup.  It's great if you're being paid by the hour, but then again so is
digging ditches.

>I don't really see a need for a new standard as I also think that everything
>that is needed for a TLS VPN is already specified. Maybe a BCP document on how
>to properly use and implement TLS VPNs would make more sense?

Or just "Use OpenVPN".  It's not the perfect solution, but most of the time it
just works.  Want to use an Android phone to check email on your corporate
server?  Use OpenVPN.  iPhone to monitor your home alarm?  OpenVPN.  Two PCs
to talk to each other privately?  OpenVPN.

Peter.