Table of Contents
The post covers the VPN options a Palo Alto firewall supports: Site-to-Site VPN for linking branches and partners over the internet instead of MPLS, Remote Access VPN (IPsec or SSL) for off-site users, and Cloud VPN for tying on-prem data centres to cloud workloads. It also covers SSL VPN in both forms: a browser-based portal that exposes specific apps, and a tunnel mode that gives broader network access. It ends with Double VPN, which is really a setup rather than a protocol: traffic is encrypted through two VPN servers in a row, so it’s more secure but slower.
The moment we think about the power of the public Internet as the most viable and cheap medium of fastest communication, network security comes to mind as a matter of concern. Though fast, cheap and reliable but if not properly secured it could lead to confidential data leakage, user identity exposure and misuse of credentials, password stealing etc. the digital footprints required to be hidden from prying eyes while sending data over Internet or public networks.
VPNs or virtual private networks here come to the rescue and provide reasonable assurance to ensure their users connect in a secure manner. Data is encrypted in a VPN tunnel and hides the online presence of the sender, its physical location, and data it is sending.
Palo Alto leading provider of network solutions and its firewall supports various types of VPNs such as Site-to-Site VPN, remote access VPN, cloud VPN, SSL VPN and double VPN.
Palo Alto VPN Protocols
Site-to-Site VPN
Main office to satellite offices connectivity is usually established with Site-to-Site VPNs. It is a preferred choice of communication where businesses utilize the internet for confidential data transmission securely instead of using MPLS communication. A Site-to-Site VPN can be used by businesses to extend its network boundary to partners, suppliers and customers where VPN is established as an extranet based VPN. Two private networks can be connected securely using a Site-to-Site secure tunnel.
Remote access VPN
Remote access VPN is widely used by offsite users to connect in a secure manner with organization applications and information wherein all data transmitted or received is encrypted. Security is inbuilt irrespective of the user location a virtual tunnel is created between end user and enterprise network. This type of VPN can be IPSec tunnel based or SSL (Secure socket layer) based. Ideal when a remote user is connecting from their home or personal location.
Cloud VPN
On premises data centres and cloud environments can be securely connected using cloud VPNs. There another name is VPN as a service (VPNaaS). This type of VPN allows secure access to business applications, resources and data hosted onto cloud via a web interface or dedicated application. Ideal when secure access is required both for on premises applications and cloud hosted applications.
Related: IPSec VPN Set Up – Palo Alto
SSL VPN
SSL or secure socket layer as the name suggests is employed using a security protocol or its predecessor TLS or transport layer security to encrypt data between VPN gateway and end user system. SSL VPN does not require a specialized software for its functioning and is widely available with web browsers. SSL VPNs are of two types – SSL portal VPN and SSL tunnel VPN.
- SSL portal VPN is web page based which allows its users to access resources etc. using a secure SSL connection by providing credentials. With successful login to the portal end users can access designated applications and services.
- In SSL tunnel VPN users can access multiple network resources not just limited to the ones accessible via browser only. Ideal for securing internet sessions of end users and secure access to organization resources.
Double VPN
Double VPN is not exactly a VPN type rather a configuration wherein user traffic is channeled via two sequential VPN servers to enable dual level encryption. In this configuration user data is encrypted and sent over the communication channel to another VPN server which will encrypt it again before it reaches its final destination. Here security is high but at the cost of speed. Ideal for enhanced security scenarios.
Conclusion
Palo Alto doesn’t offer just one VPN, because no single VPN suits every business. The right choice depends on who is connecting and what they need to reach. If you’re linking a head office to branches or partners, Site-to-Site VPN is the natural choice. For a workforce spread across homes and client sites, Remote Access VPN, keeps those users inside the security perimeter wherever they log in. If your applications are split between an on-prem data center and the cloud, Cloud VPN connects the two cleanly. SSL VPN suits users who need quick, browser-based access without installing a client. Double VPN is better kept for the rare cases where extra privacy is worth the drop in speed.
In practice, most organisations end up running more than one of these side by side. The best starting point is to map your users, sites and workloads first, then choose the VPN type that fits each one, rather than forcing every connection through the same tunnel.
