Re: [saag] looking to hold a TLS VPN side meeting at IETF 92

[Aaron Zauner <[e-mail]>]

Hi,

Nikos Mavrogiannopoulos wrote:
> argument more than a decade ago, and still the majority of VPNs in use
> are user-space VPNs based on SSL. The last sentence may actually
> capture the benefit... it simply works :)
> 

+1.

IPSec might (!) work well if you use one vendor throughout your network,
pretty much the same thing as some have argued with vendor SSL/TLS VPN
solutions. Because IPSec is such an overly complicated protocol there's
not much security in the clients that are available throughout enduser
operating system. Apple, for example, uses racoon (a NetBSD client) for
IPSec. It only supports IKEv1 in Aggressive Mode. That's a pretty big
userbase that is forced to use an insecure protocol.

Besides a couple of commercial and seldomly used FOSS software
implementations nobody really implements all authentication
subprotocols. I rarely see companies that configure IPSec for their
users (if they do, most hate it and constantly have problems with that
decision), most do use AnyConnect or OpenVPN. That is, of course, for
roadwarrior and site-access setups. IPSec works pretty well for
site-to-site setups; then -- again -- if you use different vendors, or
even different product-cycles of a given vendor, you might run into
interoperability problems. I don't know of a single network engineer
that enjoys deploying IPSec.

I don't really see a need for a new standard as I also think that
everything that is needed for a TLS VPN is already specified. Maybe a
BCP document on how to properly use and implement TLS VPNs would make
more sense?

Aaron