NC "IPsec-like" functionality?

[rhedar_]

Hi,

What is meant when Network Connect is descibed to provide an IPSec-like network tunnel? I know through the configuration UI that it utilizes ESP.

Thanks!

[Mrkool_]

i think they mean the thick client like access. With network connect you can jsut deploy the thick client that the user can launch. this way the user does not have to use the web browser to login and than click network connect they can just launch this app login and get network connect.

[rhedar_]

Thanks. I guess I'm more interested in the protocols used by the IPsec suite - AH, ESP, and IKE. Which of these protocols are and aren't used by NC?

[Mrkool_]

NC can use ESP and than falls back on NCP.

Network Communications Protocol (NCP)ÑStandard NCP has been replaced by oNCP. Windows client applications, including the Secure Meeting Windows client, WSAM, and Terminal Services fallback to NCP if oNCP fails.

Optimized NCP (oNCP)ÑOptimized NCP (oNCP) significantly improves the throughput performance of the client applications over NCP because it contains improvements to protocol efficiency, connection handling, and data compression. Windows client applications, including the Secure Meeting Windows client, WSAM, Network Connect and Terminal Services use oNCP by default.

no ESP , AH or IKE support.

Encryotion can be set to

AES128/MD5 (maximize performance) AES128/SHA1 AES256/MD5 AES256/SHA1 (maximize security)

[JintsFan_]

If you are looking for IPSec functionality, then I wouldn't suggest a SSL-VPN.

The SSG firewalls are compatible with (almost) any IPSec client. You should look into those.

[DanSmart_ · Accepted solution]

It is considered IPsec-like, since it uses ESP over UDP, but does not use IKE. Since you must log into the SA first, all key exchange is done over SSL and the ESP is setup over UDP so it can traverse a NAT. Since there's no IKE, its more consitent connecting over a NAT connection. ESP is higher performance than SSL, but NC will fall back to SSL on a last resort.

-=Dan=-

[rhedar_]

Thanks! I was wondering how key exchange was handled. So, NC uses ESP over UDP and will fallback to SSL. IKE and AH aren't being used.