Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Authentication Summary
Automatic key single
certificate VPN
Automatic key
certificate authoritybased
VPN
Chapter 14: Configuring Virtual Private Networks
Sidewinder G2 VPN overview
• authenticates using a self-signed public certificate - each VPN peer must first
import the corresponding peer’s certificate
• ideally used for a small number of remote clients
• used with dynamic IP-assigned clients and gateways
• each peer certificate requires its own Sidewinder G2 security association
• authenticates each VPN peer by using a certificate signed by a certificate authority
trusted by the other peer
• ideally suited for roving client VPN peers (such as those using laptop computers)
• used with dynamic IP-assigned clients and gateways
• single Sidewinder G2 security association can be used to administer many VPN
clients.
General guidelines for selecting a VPN authentication type
Here are some general guidelines to follow when you are deciding which type
of VPN to use:
• If the VPN peer is not a Secure Computing product, and all other types of
VPN methods do not work, try the manual key VPN.
• For a small number of VPN peer clients with dynamically assigned IP
addresses, the single certificate VPN is a cost-effective solution. A shared
password VPN in conjunction with Extended Authentication is also an
option.
• If the VPN peer has a static IP address, the pre-shared password VPN is
the easiest to configure. Extended Authentication would not be used in a
gateway to gateway configuration as there is no one to provide the
challenge/response.
• If there is a large number of VPN peer clients with dynamically assigned-IP
addresses (such as a traveling sales force), the CA-based VPN is often the
easiest to configure and maintain. Another popular option is to use a preshared
password VPN in conjunction with Extended Authentication.
401