Virtual Private Network Workgroup Report

1
Virtual Private Network Workgroup Report

• VPN Workgroup
• University of California, Davis
• April 2006

http//security.ucdavis.edu/vpn_report.pdf
2
Background

• Workgroup appointed by Interim Vice Provost to
• Identify the security problem(s) that are
  resolved by a VPN service.
• Review the campus remote access connectivity
  requirements.
• Discuss how VPN services are able to meet such
  requirements.
• Provide recommendations regarding VPN use at UC
  Davis

3
What is a VPN?

• Creates a secure network tunnel over the public
  Internet between two locations
• Can be used to link networks
• Can be used for remote access
• Two technologies in broad use, IPSec and SSL
• IPSec VPN is best deployed for expanding network
  connectivity
• SSL VPN is increasing deployed for remote access

4
(No Transcript)
5
VPN Issues

• Split vs SingleTunnel A single network tunnel
  results in additional campus network traffic and
  possible security issues. Split tunneling is
  scalable and reduces the drain on institutional
  computing and network resources.

Appliance
6
VPN Issues

• End-point Security Verifies security
  configuration of a remote computer establishing
  the VPN connection.
• Without this function, trust is established
  between a possibly untrustworthy remote computer
  and destination.

7
VPN Needs

• Faculty and staff need secure access to
  departmental services for local VLAN resources
• Institutional resources, such as
• Material not available via current library proxy
  service
• Patching or anti-virus servers
• Sakai integration with online course material
  will be affected by current accessibility
  limitations for e-journals.
• Institutional benefits during pandemic events

8
Preliminary Costs

• Commercial VPN solution
• 75K one-time hardware, 15 recurring support
• 0.5 FTE initial and continuing support
• Open-source SSL VPN solution
• 5K hardware
• 0.75 FTE initial and continuing support

9
Recommendations

• Issue RFI for SSL VPN solution, using
  specifications in workgroup report
• Confirm funding support
• Evaluate commercial and opensource SSL VPN
  solution(s)
• Implement pilot SSL VPN solution