Re: Best VPN Appliance

[Matthew Elmore <nanog () mattelmore com>]

On Mar 18, 2010, at 5:17 AM, Dawood Iqbal wrote:


The problem i'm facing so far is MAC OS X compatibility. The demo box i had
> for Juniper was not able to run Network Connect on MAC OS 10.5.8.



We use an SA700 (lowest-end model) and I use NC regularly form my Mac, but I
am running 10.6.2. I did not have trouble running NC when I was on 10.5
however, but that was several months ago. The biggest trick on the Mac is
figuring out how to use a client-side certificate properly...


> From your experience from F5, Juniper and Barracuda, which one will be best
> in terms of;



Speaking only from my experience with the Juniper product:

1) Support


When dealing with configuring and troubleshooting the appliance itself, JTAC
has been pretty helpful when I've had to call on them. However, it has been
hard getting help when dealing with client issues (Bob's PC won't establish
tunnel properly, host checker issues, etc.).

2) Resiliency


We don't do HA as we only have a handful of users, so I can't speak to this.

3) Security


It's good enough for us, and we have lots of rules we have to follow
(financial institution). Authentication is hooked into our Active Directory,
so passwords are managed from there. We require a client-side certificate
issued from a private CA, which works well, even recognizes and enforces
certificate revocation lists.

4) Scalability


See #2. We have a max of maybe five concurrent users, and that's a rare
occurrence.

5) Manageability



Set it and forget it. Only thing I have to do is load ESAP updates
occasionally (host checker engine definitions). There are a couple useful
SNMP oid's but they're not documented very well.