<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">If you don’t want user administration, then ipsec tunnels are the way to go.<div><br></div><div>IPsec devices on the low grade could be pfsense (I think), Possibly DLINK could do it (cannot comment), or pick up a couple of juniper net screen 5 GT NS-5GT-001 VPN firewall devices, or low end link sys VPN devices.</div><div><br></div><div>If the budget supports it, cisco 5505’s would be ideal as there is lots of documentation to support them.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br><div><div>On May 7, 2014, at 12:53 PM, Joe Wennechuk <<a href="mailto:youcanreachmehere@hotmail.com">youcanreachmehere@hotmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div class="hmmessage" style="font-size: 12pt; font-family: Calibri; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div dir="ltr">I am going to get a hardware device for this purpose. I don't want to end up having to support all of the user administration.<span class="Apple-converted-space"> </span><br><br>What would be the best low cost hardware VPN for connecting windows clients? I am not sure If I want to use Cisco, and their VPN client. I was hoping I could find one that can use native windows tools to set up the VPN instead of some proprietary client software.<br><br>My higher-ups don't want DDWRT, or PF sense.<br><br><div>> Date: Mon, 5 May 2014 19:33:04 -0400<br>> From:<span class="Apple-converted-space"> </span><a href="mailto:unsolicited@swiz.ca">unsolicited@swiz.ca</a><br>> To:<span class="Apple-converted-space"> </span><a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a><br>> Subject: Re: [kwlug-disc] Easy Software based VPN<br>><span class="Apple-converted-space"> </span><br>> Less reliable? Either she works and you have connectivity, or you don't.<span class="Apple-converted-space"> </span><br>> Whether client interfaces are user friendly, or encryption is<span class="Apple-converted-space"> </span><br>> sufficient, is a different story. As is easy of setup, if any. Most of<span class="Apple-converted-space"> </span><br>> the time, for most of the people, any encryption is more than<span class="Apple-converted-space"> </span><br>> sufficient. (Anyone so interested probably can't break in any time frame<span class="Apple-converted-space"> </span><br>> that matters.)<br>><span class="Apple-converted-space"> </span><br>> Let's remember that OpenVPN is a different beastie than IPSec, the<span class="Apple-converted-space"> </span><br>> international standard. OpenVPN is more than sufficient most of the<span class="Apple-converted-space"> </span><br>> time, but I understand there is a point at which it doesn't scale very<span class="Apple-converted-space"> </span><br>> well. i.e. There is a tipping point where the simplicity of setup of<span class="Apple-converted-space"> </span><br>> OpenVPN doesn't scale as well/simply, while IPSec is apparently<span class="Apple-converted-space"> </span><br>> irritatingly complex to set up - but once implemented scales almost<span class="Apple-converted-space"> </span><br>> endlessly, easily.<br>><span class="Apple-converted-space"> </span><br>> And there's a cost tradeoff in that too. OpenVPN, cheap or free, IPSec<span class="Apple-converted-space"> </span><br>> non-trivial cost. In either case, most of the cost is in the admin time<span class="Apple-converted-space"> </span><br>> to set up / maintain, not the fees charged. (Per user basis.) And with<span class="Apple-converted-space"> </span><br>> developer fees/costs you get a more refined / user friendly client end.<br>> (e.g. As I understand it, the proprietary Cisco VPN solution.)<br>><span class="Apple-converted-space"> </span><br>> In the end, likely any encryption, even PPTP, will more than suffice. If<span class="Apple-converted-space"> </span><br>> encryption is even needed. (And even that is less often than commonly<span class="Apple-converted-space"> </span><br>> thought.)<br>><span class="Apple-converted-space"> </span><br>> <a href="https://www.ivpn.net/pptp-vs-l2tp-vs-openvpn">https://www.ivpn.net/pptp-vs-l2tp-vs-openvpn</a><br>><span class="Apple-converted-space"> </span><br>> "Due to the major security flaws, there is no good reason to choose PPTP<span class="Apple-converted-space"> </span><br>> other than device compatibility" - not quite true. PPTP being faster /<span class="Apple-converted-space"> </span><br>> having lower overhead. But there's a premise here: Is there any real<span class="Apple-converted-space"> </span><br>> value in your data that people will want to expend time and resources on<span class="Apple-converted-space"> </span><br>> deciphering? Probably not, particularly when it is only the pipes, not<br>> 3rd parties, whom even have access to the data stream. Most of the time,<span class="Apple-converted-space"> </span><br>> the value of encryption is merely and only that it's not going across<span class="Apple-converted-space"> </span><br>> the wire clear text. Beyond that, is there anything in your data people<span class="Apple-converted-space"> </span><br>> are willing to spend $ on to discover - well, no encryption will be<span class="Apple-converted-space"> </span><br>> sufficient for the truly determined. PPTP is probably more than<span class="Apple-converted-space"> </span><br>> sufficient - but if OpenVPN is as easy to set up and with just as little<span class="Apple-converted-space"> </span><br>> overhead / CPU requirements, may as well use it. Which to use has less<span class="Apple-converted-space"> </span><br>> to do with encryption strength / security flaws than just about every<span class="Apple-converted-space"> </span><br>> other aspect beyond that.<br>><span class="Apple-converted-space"> </span><br>> <a href="http://networkengineering.stackexchange.com/questions/1067/what-are-the-downsides-of-openvpn">http://networkengineering.stackexchange.com/questions/1067/what-are-the-downsides-of-openvpn</a><br>><span class="Apple-converted-space"> </span><br>> <a href="http://www.enterprisenetworkingplanet.com/netsecur/article.php/3844861/OpenVPN-Is-Too-Slow-Time-to-Consider-IPSEC.htm">http://www.enterprisenetworkingplanet.com/netsecur/article.php/3844861/OpenVPN-Is-Too-Slow-Time-to-Consider-IPSEC.htm</a><br>><span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span><br>> On 14-05-05 02:43 PM, CrankyOldBugger wrote:<br>> > PPTP is an older, less reliable tech. Use L2TP or, even better, openVPN.<br>> > If you go with openVPN (as many people do), be sure to steer clear of the<br>> > versions affected by Heartbleed!<br>> ><br>> > There's a comparison of some different types at<br>> > <a href="http://www.giganews.com/vyprvpn/compare-vpn-protocols.html">http://www.giganews.com/vyprvpn/compare-vpn-protocols.html</a><br>><span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span><br>> _______________________________________________<br>> kwlug-disc mailing list<br>> <a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a><br>> <a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org">http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org</a><br></div></div>_______________________________________________<br>kwlug-disc mailing list<br><a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a><br><a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org">http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org</a></div></blockquote></div><br></div></body></html>