cancel
Showing results for 
Search instead for 
Did you mean: 

NC: ESP vs. oNCP : Which one offers the best security criteria?

SOLVED
Highlighted
New Contributor

NC: ESP vs. oNCP : Which one offers the best security criteria?

Hi,
One of my customers is asking us what is different in term of security when using ESP transport mode for NC instead of using the default oNCP.
My point of view is that ESP should be more secure because the symmetric encryption key is changed after a given time or a given amount of tranmitted data. This makes replay attacks much more complicated.
What is your opinion?
Thanks in advance
Seb
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Occasional Contributor

Re: NC: ESP vs. oNCP : Which one offers the best security criteria?

Hi,

I think that there is not a big difference from the security view. ESP has a better performance than oNCP. So if you use VoIP i would recommend ESP.

Greetings

Kifah

View solution in original post

5 REPLIES 5
Highlighted
Super Contributor

Re: NC: ESP vs. oNCP : Which one offers the best security criteria?

I'd vote for ESP for the simple fact that it uses udp.. Less prone to port scans and the like and it's faster.

Highlighted
Occasional Contributor

Re: NC: ESP vs. oNCP : Which one offers the best security criteria?

Hi,

I think that there is not a big difference from the security view. ESP has a better performance than oNCP. So if you use VoIP i would recommend ESP.

Greetings

Kifah

View solution in original post

Highlighted
New Contributor

Re: NC: ESP vs. oNCP : Which one offers the best security criteria?

Ok, thanks for your opinion.
If somebody has a more detailled explanation, it will be the welcome.
Best regards
Seb
Highlighted
Occasional Contributor

Re: NC: ESP vs. oNCP : Which one offers the best security criteria?

ESP has 1.5X the performance of NCP. Use ESP always.

-=Dan=-

Highlighted
Occasional Contributor

Re: NC: ESP vs. oNCP : Which one offers the best security criteria?

I would not recommend always using ESP. In fact, there are cases where the packet size of ESP can do some very funky things to routers (WRT, DLINK). We have had numerous reports of faulty DNS, packet loss, etc. when using ESP transport mode. The benefit to using NCP/oNCP is that you have a lot more flexibility because it rides over TCP (connection-oriented, retransmission of lost packets) so if you don't need to run stream-dependent traffic like VoIP or streaming media, NCP can in fact be just as effective to the end-users.

Hope that helps.

-C