Security Basics: Re: VPN protocols

[aditya.mukadam () gmail com]

Alex,

Its quite an interesting and a broad question. The answers you would receive would not be unique however it will be 
good to understand the view points.

Since you donot want a specific VPN products, I will try to answer in non-technical language.

Factors :

1) Main point: amount of security needed for comunication?
Doesn't matter: Go for PPTP or L2TP
Must : IPSec or SSL

2) Will users be connecting while traveling/home i.e Remote Access solution ? or two company locations needs to 
communicate securely i.e. Site to Site ?
Remote Access: PPTP, L2TP, IPsec Client or SSL VPN
Site to Site: IPSec only !!!

3) Budget
less: PPTP or L2TP
good: IPSec or SSL. and if you need remote access, I would recommend  SSL because your helpdesk would not get call for 
installing the IPSec Software, configuring it.In SSL VPN , all you need is your SSL compatible browser !

4) Choice between installing software vs browser based
Ok to install software of PC: IPsec
No ! I dont want any software or client : SSL
I dont want to install any software but if there is something in built ,I don't mind using it: PPTP, L2TP

5) Ease of configuring the VPN Gateways:
More of less equal ( cos you can find the configuration guides etc on internet ). IPSec with different OS can get into 
issues !

6)  Number of users using VPN
less users: doesn't make business sense to invest in a vendor solution.So you would like to use something which would 
be inbuilt in windows. PPTP and L2TP can be used in such cases.
more users:If its a big rollout, you would definitely wanna go for either SSL or IPSec

7) Comparable Speed ( this is debatable, but below id my view).
 IPSec is faster than SSL


Other factors could be: type of users ( techie or non-techie), ease of troubleshooting etc

Hope this helps. Please let me know if you have questions.

Thanks,
Aditya Govind Mukadam