Re: [saag] looking to hold a TLS VPN side meeting at IETF 92

[Aaron Zauner <[e-mail]>]

Hi,

Paul Wouters wrote:
> On 03/17/2015 06:13 PM, Aaron Zauner wrote:
> 
>> IPSec might (!) work well if you use one vendor throughout your network,
> 
> That's a somewhat obsoleted viewpoint. While I think that is correct for IKEv1 and all the proprietary bold-on solutions, I do not see as many issues with
> IKEv2. Although for large scale solutions, there tends to be a strong vendor-lock but mostly in the management/gui aspects of having many devices (not endusers)
> 
>> solutions. Because IPSec is such an overly complicated protocol there's not much security in the clients that are available throughout enduser operating
>> system.
> 
> I'm not sure what you mean here. With the exception of group PreShared Keys and in particular Aggressive Mode IKEv1, yes that's broken and should not be used.
> But it _has_ been obsoleted for almost a decade now.
> 
>  Apple, for example, uses racoon (a NetBSD client) for
>> IPSec. It only supports IKEv1 in Aggressive Mode. That's a pretty big userbase that is forced to use an insecure protocol.
> 
> It does support IKEv2 in the latest iOS, but the provisioning is so locked up that people haven't made it work yet
> 
> It does suppor IKEv1 with certificates, which is _not_ insecure, even in Aggressive Mode.

And a lot of Users will struggle with configuring this. That's why Cisco
et al ship management solutions with e.g. AnyConnect. See below:

> 
> As for those still think IPsec is too hard to configure, according to http://www.theguardian.com/technology/2015/jan/09/why-netflix-wont-block-vpn-users there
> are 30 million people using a VPN to access netflix. With the apple vs android split, that's about 15 million end users who are using IPsec just fine.

Right. I've reviewed a lot of these services, most of them do _not_
support IKEv1 with Certificates but rather use a pre-shared key, which
most of them, put up publicly on their website. Some providers do have
better solutions, most offer a combination of Services with the primary
choice for endusers being OpenVPN or L2TP/IPSec (PSK public and the same
for all users).


Aaron