Re: Changes in setup/configuration for VPN and IPSec??

In article <1177577935.520327.21150@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>,
<qazmlp1209@xxxxxxxxxxxxxx> wrote:
VPN network:
- The additional VPN related setup/configuration is required only at
the entry/exit point of the network i.e. routers. No changes are
necessary on other machines/systems in that network.

IPSec network:
- Each machine/system in the network will need to have the
additional
IPSec related setup/configuration.

Is that correct?

No. IPSec has two modes, point to point and network to network.
The (quite common) network to network mode is the same
as what you describe under "VPN Network".

"VPN" is a generic word to describe Virtual Private Networks
no matter how implemented. IPSec is one possible implementation.
Others include PPTP, GRE, and MLPS (amongst others.)

Which one is preferred over the other, and in what
scenarios?

Point to Point: the user can only reach the security endpoint
(e.g., a single server) unless that server allows the user's
traffic to be forwarded on. Good, for example, for allowing
vendors to check your currently open Request For Proposals
without allowing them to get at anything else.

Network to Network: it isn't uncommon for telecommuters to
require access to several internal machines
.

Relevant Pages

  • Re: [fw-wiz] Benefits of Network Extention Mode vs IPsec
    ... "Network Extension Mode" is Cisco-specific terminology, ... you're talking about Cisco VPN gear. ... One of the big problems for IPsec deployments is making sure that the VPN ... For remote access VPNs, where you've typically got a single machine ...
    (Firewall-Wizards)
  • Re: [Full-disclosure] Remote Desktop Command Fixation Attacks
    ... This set of steps is redundant in many places, and it's also enormously expensive, since you're using no less than three different expensive bits of networking hardware (AP, PIX, VPN Concentrator), in addition to a bunch of x86 server hardware, windows server licenses, and at least one ISA license. ... Your computers necessarily don't have full access to your network infrastructure when they aren't logged on, so GPOs, software updates, etc can't be applied at the times you want them to be applied. ... Turning on, enabling, and implementing every possible security setting and device you think of is not defence in depth, and will probably only have two effects - your users won't use your wireless network, and you'll burn so much cash you won't have any left to spend on *useful* security measures. ...
    (Full-Disclosure)
  • TidBITS#792/15-Aug-05
    ... We also note the release of Security Update 2005-007, ... Macintosh FTP client, free for educational and charitable use. ... mentioned virtual private network (VPN) technologies. ...
    (comp.sys.mac.digest)
  • RE: VPN Error 800
    ... The VPN client IP is 10.0.1.40, this is a private IP address. ... server IP address is 81.137.105.244, this is a Internet IP address. ... not test VPN connection from your perimeter network. ... SBS on your switch to make it work. ...
    (microsoft.public.windows.server.sbs)
  • Re: VPN connection question
    ... What kind of a VPN are you trying to set up a PPTP or a IPSec? ... Office Network: Serverless peer network behind a Linksys BEFSX41 Router ...
    (Ubuntu)