Subject: new to VPN

From: Alan Chung <[email-masked]>
Date: Tue, 28 Jan 2003 14:31:18 +0900

Hi,

I am very new to this VPN technology.
Currently I am reading the documentation around and have some questions
on my mind.  Could someone please give me an advice?

1. There seems so many types of VPN technologies such as GRE, IPSec,
L2TP, PPTP, IP-IP Tunnel...as I have realized so far.
   To be honest, I am very confused and not sure which direction I
should go in order to choose a good solution for my company.
   First, I wonder what type(s) of technology is generally evaluated as
the most secure and widely used one?

2. There is even freeware such as Linux FreeS/WAN using IPSec
technology.  If so, is this secure enough to use for a big wide area
network something above 500 people?
    Is it true that the hardware VPN solutions are always better,
trusted and have higher secure level than software VPN?

I am sorry to ask such general questions on this mailing list.
But I really appreciate if someone can give me some help with this.

Thank you very much.

Alan

---

From: Mukesh Gupta <[email-masked]>
Date: Wed, 29 Jan 2003 09:18:21 -0800

> the most secure and widely used one?

Except IPsec, all of the mentioned technologies are for just tunnelling and
not for security. You could tunnel the traffic using any of those
technologies but then you will need to use some encryption/authentication
technology in order to secure your traffic. IPsec is the obvious choice
there.

> network something above 500 people?

"secure enough" is not a deterministic term and it is the encryption
algorithm that decides how secure your VPN is, not the technology.

> trusted and have higher secure level than software VPN?

I don't think so. AFAIK, hardware VPN solution would just be faster than
software VPN.

HTH,
- Mukesh

---

From: "Jayant Shukla" <[email-masked]>
Date: Wed, 29 Jan 2003 19:56:11 -0800

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Mukesh Gupta

On the contrary, I think software solutions are becoming more secure
than the hardware solutions. If you look at technologies related to
intrusion prevention or known/unknown Trojan detection, the software
solutions have a much better edge. 

> I don't think so. AFAIK, hardware VPN solution would just be faster
than

Fastest VPNs today are hardware solutions, but software VPNs are not too
bad. I run a VPN that can sustain almost 24 Mb/s using 1GHz PIII laptop.
For a customer we are building a VPN (without any custom hardware) to
achieve 1 Gb/s using load balancing. 

In the end, whatever suits your requirements is the best solution, be it
hardware or software. 

Regards,
Jayant
www.trlokom.com 

Fee VPN & Firewall:  http://www.tucows.com/preview/295100.html

---

From: Michael Richardson <[email-masked]>
Date: Thu, 30 Jan 2003 12:57:10 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Jayant" == Jayant Shukla <[email-masked]> writes:
    Jayant> [mailto:[email-masked]]
    >> On Behalf Of Mukesh Gupta > Is it true that the hardware VPN solutions
    >> are always better, > trusted and have higher secure level than
    >> software VPN?
    >> 

    Jayant> On the contrary, I think software solutions are becoming more
    Jayant> secure than the hardware solutions. If you look at technologies
    Jayant> related to intrusion prevention or known/unknown Trojan
    Jayant> detection, the software solutions have a much better edge.

    >> I don't think so. AFAIK, hardware VPN solution would just be faster
    Jayant> than
    >> software VPN.

    Jayant> Fastest VPNs today are hardware solutions, but software VPNs are
    Jayant> not too bad. I run a VPN that can sustain almost 24 Mb/s using
    Jayant> 1GHz PIII laptop.  For a customer we are building a VPN (without
    Jayant> any custom hardware) to achieve 1 Gb/s using load balancing.

  There are two reasons to go to hardware:
	1) speed.	Money is no object. Speed is.

	2) power.	Money (heat!) is the object. Speed isn't.  

  There are a growing number of VPN capable boxes that employ management
processors of around 100Mhz, (not ix86) with rather limited power
budgets. They are using comodity cipher chips with power budgets that 
rival that of the fan on the GHz PIII.  It is these devices where we will see
the most impact of IPsec technology - they are often embedded network
elements of various sorts.

  But, I agree with Jayant - for anyone for whom money is an object, but
power consumption is not (anyone not living in California :-]), but moderate
speed is also, a PIII is very hard to beat. 

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

---

From: Stephen Kent <[email-masked]>
Date: Thu, 30 Jan 2003 17:42:28 -0500

>solutions have a much better edge.

Any software solution executing in a conventional OS context will be 
vulnerable to all of the vulnerabilities that allow exploitation of 
that OS. In contrast, an IPsec implementation operating in a 
constrained environment with a minimal OS, perhaps just a scheduler, 
is less vulnerable in general. Also, if one uses hardware to generate 
keys and if one keeps the keys inside the hardware (consistent with 
FIPS 140-1/2 level 3 design criteria) the keys will be very well 
protected, something that we simply cannot do in software.

Steve

---

From: "Jayant Shukla" <[email-masked]>
Date: Fri, 31 Jan 2003 09:32:27 -0800

> On Behalf Of Stephen Kent
> Sent: Thursday, January 30, 2003 2:42 PM
> To: Jayant Shukla
> Cc: [email-masked]
> Subject: RE: new to VPN
> 
> that OS. 

If you shut off unnecessary services then one can overcome majority, if
not all, vulnerabilities that you are talking about. I think you would
agree that the hardware box too will be less secure if you run a lot of
services on it?

> In contrast, an IPsec implementation operating in a
> is less vulnerable in general. 

Ok, no services and a limited OS! That's good, but what makes you think
the limited OS will not have any vulnerabilities? Is there a size below
which an OS ceases to have any vulnerability?

This box with limited OS that you describe must be very difficult to
use! How do you configure/update/manage these boxes in a VPN with say 50
sites?

> Also, if one uses hardware to generate

There is a lot more to practical security than FIPS level 3. Maybe your
box is fine, but a Trojan can have a field day with the computers behind
your box.

Another point about gateway based security is that your data is not
secure over the local network, and is vulnerable to internal attacks.
According to an FBI survey, over 80% of the attacks come from inside?

The bottom line is that making a sweeping claim that hardware is more
secure is misleading. 

Regards,
Jayant
www.trlokom.com

---

From: Stephen Kent <[email-masked]>
Date: Fri, 31 Jan 2003 15:59:57 -0500

>agree that the hardware box too will be less secure if you run a lot of

The approach you describe is one that has been practiced for many 
years when vendors built firewalls on top of general purpose OS 
platforms. It has never been a way to create a very high assurance 
implementation, although I agree it improves the situation. Dedicated 
hardware devices usually do not have the OS services present to shut 
off, so they are better off.  I think we see more of this flavor in 
modern firewall products as well, so I think there is a parallel 
evolution path here.

>which an OS ceases to have any vulnerability?

It is not just a matter of size, of course, but of purpose built vs. 
general purpose OS environments.

>use! How do you configure/update/manage these boxes in a VPN with say 50

The management interface ought not be closely tied to the underlying OS.

>box is fine, but a Trojan can have a field day with the computers behind

Yes, but it's not the fault of the box, which is the focus of this discussion.

>According to an FBI survey, over 80% of the attacks come from inside?

That survey is old, and had a different definition of "attack." But, 
if you want to do a good job inside an enterprise net, then the 
analogous approach is the "IPsec in the NIC" approach, which is far 
better than the "IPsec in the OS approach."

>The bottom line is that making a sweeping claim that hardware is more

Since the comment applies to just the security of the IPsec device, 
not the computers behind it, I think it is fair to say that a 
dedicated, hardware implementation of IPsec has the potential to be 
considerably more secure than an implementation that runs on a 
general purpose computer with a general purpose OS, even if one 
attempts to harden the OS by turning off extraneous services.

Steve

---

From: Paul Koning <[email-masked]>
Date: Fri, 31 Jan 2003 15:17:58 -0500

>> In contrast, an IPsec implementation operating in a constrained
 >> environment with a minimal OS, perhaps just a scheduler, is less
 >> vulnerable in general.

 Jayant> Ok, no services and a limited OS! That's good, but what makes
 Jayant> you think the limited OS will not have any vulnerabilities?
 Jayant> Is there a size below which an OS ceases to have any
 Jayant> vulnerability?

 Jayant> This box with limited OS that you describe must be very
 Jayant> difficult to use! How do you configure/update/manage these
 Jayant> boxes in a VPN with say 50 sites?

There's a very large difference between a general purpose OS like
Windows or Unix, and an embedded system OS.  Large, as in several
orders of magnitude.

That doesn't translate into "difficult to use".  Ease of use doesn't
come from millions of bells and whistles, it comes from having a well
crafted set of services that matches the requirements of the
applications running on the system.  A dedicated VPN gateway requires
only a very small set of OS services.

In an earlier life, I was involved in building a pretty successful VPN
product.  It got very good reviews for ease of management, and in
particular did very well for large VPNs (50+ sites).  The OS in that
box is perhaps a few thousand lines -- a classic RTOS kernel.

Perhaps you need to spend some time studying how embedded systems are
built.

 >> Also, if one uses hardware to generate keys and if one keeps the
 >> keys inside the hardware (consistent with FIPS 140-1/2 level 3
 >> design criteria) the keys will be very well protected, something
 >> that we simply cannot do in software.
 >> 

 Jayant> There is a lot more to practical security than FIPS level
 Jayant> 3. Maybe your box is fine, but a Trojan can have a field day
 Jayant> with the computers behind your box.

 Jayant> Another point about gateway based security is that your data
 Jayant> is not secure over the local network, and is vulnerable to
 Jayant> internal attacks.  According to an FBI survey, over 80% of
 Jayant> the attacks come from inside?

 Jayant> The bottom line is that making a sweeping claim that hardware
 Jayant> is more secure is misleading.

That's a silly argument.  The subject of the discussion is VPN
devices.  Of course it's true that a VPN is not a complete security
solution.  That isn't the question.  The question is: given that you
use a VPN as a piece of your security solution, how do you compare the
different implementation approaches to building an IPsec VPN device?

To answer that question, you have to compare the various ways to build
that box.  Yes, you can put it in your PC.  FreeS/WAN is a good way to
do that...  You can also put it in a dedicated device.  If you do, you
have opportunity to make it more secure.  (You can also mess up and
make it less secure, of course; that's what design discipline is for.)

FIPS is mostly concerned with physical attack, i.e., what can you do
if you can get your hands on the box.  With a PC, you're lost as soon
as that happens, because PCs have no physical security.  With suitable
dedicated hardware, you can provide much better protection than that.
If you trust the locks and the people who have keys for those locks,
then this may not matter.  

     paul