IPsec vs. SSL

[bignick]

Couldn't one use IPsec to replace SSL on a web/pop3 server?

My thinking is, that instead of having to buy SSL certificates, you could just setup the server to require IPsec on particular ports, or all ports if you really needed - all for "free".

Any downsides to using IPSec over SSL?

 

[Saltin]

Any downsides to using IPSec over SSL

Downlevel clients (to my knowledge, maybe this has changed) like NT 4 and 9x cannot use IPsec. There is also substantial overhead associated with IPsec.

If you have a Windows 2000 Server, you can install Certificate services and create your own certs. People connecting to the server will get a pop-up stating they have not decided to trust the CA yet, but they are given an option to install the cert into thier root store, and even if they chose not to, it's still secured.

 

[Nothinman]

Any downsides to using IPSec over SSL?

The fact that I need a client to connect to your site?

SSL support is built in, or can be enabled easily with things like stunnel, for many applications already. You can't just drop the majority of your userbase, and trust me you will lost the majority of them if you force them to use IPSec instead of SSL to save a few bucks.

 

[bignick]

I don't disagree at all with any of the above statements. My organization is looking to use IPSec for all internal web traffic, and all external access into the POP server. We're mostly a Win2k shop (except for about 10%), so the majority have IPSec support.

I suggested getting a VPN only box for external access, but some of the others just want to use what we've already spent money on.

Thanks again for your input.

 

[n0cmonkey]

If it is internal stuff, create your own certs. Its *FREE*

 

[Saltin]

My organization is looking to use IPSec for all internal web traffic, and all external access into the POP server

That's a lot of overhead to secure internal traffic! Is the internal web traffic that important? Internally, SSL is definetly the better choice, especially when you can integrate your Root CA into Active Directory and publish the root cert to everyone.

I understand why you would want to secure the POP3 authentication/data though. If you use IPsec for that you'll have to make sure no one tries to use a downlevel client from home.....

 

[lowtech1]

You could try SSH.