SSLVPN

All mbox gateways (HSG/CMG/HSA) support SSLVPN. Our SSLVPN is based on OpenVPN technology, which utilizes Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL) cryptographic protocols. It uses X.509 certificates and hence asymmetric cryptography to authenticate the counterparty with whom they are communicating, and to exchange a symmetric session key. This session key is then used to encrypt data flowing between the parties. This allows for data/message confidentiality, and message authentication codes for message integrity and as a by-product, message authentication.

mbox SSL VPN has following key characteristics:

• • primarily runs in client-to-server VPN mode. One mbox acts as a VPN server (head end); one mbox acts as a client (remote end). In this case, remote/client site mbox can support dynamic/DHCP public IP addressing or behind any firewall (without punch a hold on the firewall for inbound access) because the VPN is always initiated from remote(client) site. This is a significant advantage over traditional IPSec or GRE VPN tunnels, which require both sites to have static IP addresses and directly accessible/reachable to each other. And it is extremely scalable, easy to deploy and support.

  • two mbox gateways form site-to-site VPN (for protected networks) for their protected private networks. Hosts behind mbox gateways can communicate directly, as if they are passing through a private leased line. Dynamic routing protocols (OSPF and BGP) are used to auto learn/advertise routes/networks behind each gateway.

  • all SSLVPN tunnels can run in either tunnel mode (default) or tap mode (layer 2 tunnel). Note: If you want to run OSPF or bonding/bridging with SSL tunnel, it's a must to run in tap mode.

    • • in either tunnel or tap mode, raw/original traffic is encapsulated and encrypted into a virtual tunnel:

      • there's a virtual IP assigned to the tunnel interface, for both server and client

      • by default, no address translation for raw traffic passing through the tunnel, eg. hosts on each side "see" each other's original IP address

      • by default all traffic is allowed to pass through the tunnel, eg. no firewall filtering inside tunnel

      • supports both unicast and multicast across the tunnel

• • SSLVPN tunnel provides data encryption, integration and authentication

    • RSA certificate for gateway authentication

    • DH algorithm for generating session keys

    • SHA-512/MD5-128 for data integrity

    • DES/3DES/AES-256 for data encryption

A few things to NOTE:

• there's significant performance degradation using SSL VPN tunnels due to SSL encryption (also depends on which which encryption options used). For example, for an CMG-1500, which produces wired speed (1Gbps) routing and firewall/NAT throughput, the max SSLVPN throughput can drop down to 200Mbps.

• we must explicitly permit input TCP/1443 (depends on your VPN instance port number) on the VPN server for remote clients to communicate with gateway mbox

• we must restart (stop & start) VPN server for after changing server configs, in order for the new config client to take effect.

• use "no security sslvpn-server x" to remove SSLVPN configuration

• use "no client xxxx" under sslvpn-server context to remove each client profile config

• configure "firewall-access xx" rules to permit traffic passing through tunnels