About a decade ago, when a company wanted to provide remote access to employees, the customary method was to employ a group of phone lines connected to banks of dial-up modems. This not only offered limited user capacity and slow connection speed, it was also quite pricey due to phone-related charges.<\/p>\n
The modern Internet brought forth a new remote access technique called the Virtual Private Network, or\u00a0VPN<\/a>. With a VPN, organizations can use the Internet to provide secure remote access to many more employees at much higher speeds without the recurring costs of multiple phone lines and long distance charges.<\/p>\n But virtual private networks often have problems of their own, especially for small businesses with limited funds and\/or IT expertise. VPNs\u2014 most of which employ a protocol called\u00a0IPSec<\/a>\u00a0(IP Security) \u2014 can be tricky to set up, and the user licensing fees common to most VPN client applications can add up rather quickly.<\/p>\n Netgear<\/a>\u00a0offers a solution to both of these shortcomings with its $545 (MSRP) ProSafe SSL VPN Concentrator, Model SSL312. The SSL312 is a VPN appliance that foregoes IPSec in favor of the\u00a0SSL<\/a>\u00a0(Secure Socket Layer) protocol, the standard form of encryption used by Web browsers. The SSL312 is not only inexpensive to buy, but we also found it quite easy to install as well.<\/p>\n Features<\/b> The SSL312 uses Netgear’s familiar compact and low-profile blue metal chassis, with a pair of 100 Mbps Ethernet ports on the front. Depending on your network’s configuration, you can install the SSL312 either behind or alongside your firewall. Choosing the latter option \u2014 although less secure \u2014 reduces the traffic load on your router\/firewall and saves you the trouble of having to configure the firewall to forward all SSL traffic to the SSL312. We set up our test unit using the former (and more common) method, so we had to create a firewall rule to send any incoming SSL traffic (port 443) to the SSL312’s IP address.<\/p>\n Installation and Configuration<\/b> The SSL312 can accommodate up to 25 concurrent connections (workers online simultaneously), but there’s no practical limit to the total number of user accounts you can create. You can opt to set up user and group accounts directly on the SSL312 or have the unit connect to one of various external sources (including\u00a0Active Directory<\/a>,\u00a0LDAP<\/a>\u00a0or\u00a0RADIUS<\/a>\u00a0servers) to authenticate users.<\/p>\n In order to create secure SSL-encrypted connections between the SSL312 and your remote workers, you must first obtain a digital certificate for your company. These can be had from third-party providers like\u00a0Verisign<\/a>\u00a0or\u00a0Thawte<\/a>, or you can instead create your own “self-signed” certificate. Both procedures are outlined fairly well in the SSL312’s documentation, which is overall quite well written and informative \u2014 it will be especially useful for organizations without in-house IT personnel.<\/p>\n The next step is to customize a portal layout for your remote workers, which determines what they’ll see when logging into the SSL312. A default portal layout is already included for you to modify, but you can create additional layouts as well. By setting up multiple layouts and organizing user accounts into different VPN domains, you can create customized portals for various employee groups (e.g. sales, marketing, accounting, etc.). Helpfully, you can launch a portal from within the SSL312’s administration console to easily view the effects of the configuration changes you make.<\/p>\n When setting up a portal, you can pick and choose the features and type of connection you want to make available to your employees. One option is a tunneling VPN connection, in which the remote system becomes a member of the local company network (the VPN connection even gets its own IP address from the SSL312). You can also opt for port forwarding, which will only redirect traffic for specific applications through a secure connection. This lets remote employees use certain applications as if they were on the company LAN (for example, using Microsoft Outlook to access an Exchange server), without the need to route all of the system’s network traffic back through company network.<\/p>\n The SSL312 supports a host of standard remote services, including\u00a0FTP<\/a>, shared network folders (e.g. My Network Places) and support for remote desktop using either Microsoft’s RDP (Remote Desktop Protocol\u2014 supported by XP Professional) or VNC (Virtual Network Computing \u2014 used on Mac\/Linux systems). If your company hosts applications via Microsoft Terminal Services, you can provide links to them through the SSL312 as well.<\/p>\n Remote User Access<\/b> When you log into the SSL312 using the browser, you’re presented with your customized portal page from which you can easily choose your connection type and the services you want to use. When creating a portal layout, you can also bookmark services to simplify access.<\/p>\n Accessing secure information from a public computer (indeed, any non-company system) can be a concern, so the SSL312 employs methods to ensure that residual data isn’t accessible to workers who subsequently use the system. One is a Web cache cleaner that prompts people to delete data like temporary Internet files and cookies when logging out of the SSL312 (we noticed, however, that it doesn’t seem to run if you simply close the browser without logging out first). You can also enable HTTP\u00a0meta tags<\/a>\u00a0on the SSL312, which will prevent browsers from caching VPN pages in the first place.<\/p>\n The Bottom Line<\/b> Any small organization looking to provide secure remote access to its workers with minimal cost and deployment-related grief would do well to take a serious look at the Netgear ProSafe VPN Concentrator SSL312.<\/p>\n Price:<\/b>\u00a0$545 (MSRP) <\/p>\n","protected":false},"excerpt":{"rendered":" About a decade ago, when a company wanted to provide remote access to employees, the customary method was to employ a group of phone lines connected to banks of dial-up modems. This not only offered limited user capacity and slow connection speed, it was also quite pricey due to phone-related charges. The modern Internet brought forth a new remote access technique called the Virtual Private Network, or\u00a0VPN. With a VPN, organizations can use the Internet to provide secure remote access to many more employees at much higher speeds without the recurring costs of multiple phone lines and long distance charges. <\/p>\n","protected":false},"author":2,"featured_media":5600,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts\/202"}],"collection":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/comments?post=202"}],"version-history":[{"count":0,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts\/202\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/media\/5600"}],"wp:attachment":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/media?parent=202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/categories?post=202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/tags?post=202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nThe main benefit of the appliance’s SSL-based virtual private network is that it uses a Web browser as a client instead of requiring you to have a special VPN application for access. Eliminating the dedicated VPN client application saves both configuration hassle and cost, as it means no additional charges for user licensing. Separating a VPN from client software has another benefit \u2014 namely, it doesn’t tie remote employees to systems running the VPN software. When the browser is the remote client, workers can gain access not just from their own PCs, but also from virtually any available computer with a browser and Internet connection.<\/p>\n
\nAfter first connecting the unit directly to a PC to configure it’s default IP address and a handful of other settings (such as selecting an administrator password and specifying\u00a0DNS<\/a>\u00a0servers and a default gateway) we plugged the SSL312 into a free Ethernet port on our switch, and within about a minute it was ready to be configured for use.<\/p>\n
\nThere is one thing to be aware of before installing the SSL312 \u2014 because ActiveX-based browser plug-ins provide so many (most, in fact) of the appliance’s functions, remote workers must use Internet Explorer to access it in order to take advantage of the full range of features. (The appliance also supports the MacOS Safari Browser.) You can still use non-Microsoft browsers for administrative tasks, and Netgear says it’s in the process of developing a set of Java-based plug-ins that will allow remote access via alternative browsers like Mozilla Firefox.<\/p>\n
\nThe SSL312 isn’t the only SSL-based VPN device on the market, but it is the least expensive by a considerable margin (most cost well over $1,000). And although it lacks advanced features like load balancing and failover that you’d find in more expensive enterprise-class devices, these features are unnecessary luxuries for most small firms.<\/p>\n
\nPros:<\/b>\u00a0inexpensive and easy-to-set up SSL-based VPN; no client software required
\nCons:<\/b>\u00a0requires Internet Explorer for remote clients<\/p>\n