VPN Interview Question:

Can you list some items for a VPN checklist from deciding whether to use, then selecting, then deploying, then maintaining VPN?

Submitted by: Administrator

Well, IPSEC - real IPSEC as it exists today - is still morphing, but not so much that one shouldn't require it as a basis for a VPN. So we might have:

► IPSEC compliant (including ISAKMP/Oakley)
► Interoperability with other IPSEC compliant vendors
► Strong encryption, long key length
► If the VPN solution is not part of the firewall, which is fine, will it work with the firewall?
► Does the VPN product work both with and without trust? (Remember, it requires working closely with the firewall.)
► For an "add on" VPN, does it work in conjunction with the firewall, or does it simply circumvent the firewall? (I'm not suggesting one way is good and the other bad, but it may be something the security manager cares about, and the answer should be known.)
► Does the VPN support automatic creation of user-level VPNs (for mobile users)? In a very large organization, the system manager probably would rather not have to manually create VPN accounts for every user.
► Has the VPN been certified by a recognized organization? (The ICSA has a certification and testing process for VPNs. Others probably exist as well.)
Submitted by: Administrator