laserted
Greets -
I've played with OpenVPN as an appliance server a bit; a very nice piece of work, my thanks to all involved in making it happen.
A quick background:
I have an ongoing project that most recently has been satisfied with regular IPSEC tunnels from point to point and Cisco routers handling the edge/endpoint work.
A recent challenge in what used to be "easy" tunneling ended up with only port 80 and 443 being available to me through a great (big) firewall. Of course, I instantly looked to SSL tunneling, and the jump to use Cisco's SSL server (since my hardware already supports it natively in the SSL VPN cards) was a given. Again, not much new going on there; I was using the OpenConnect solution instead of AnyConnect (which I too gave up on years ago...), however as I'm sure everyone is aware, SSL clients to install on routers are few and far between.
Using just individual software clients (one on each pc, etc) is acceptable, but not optimal - it only allows one to access those machines when the tunnel is active, and it is limited only to the machines that have an active client installed. Bridging at the router or gateway level on client side to emulate what I had with the IPSEC tunnels is also apparently a bit of a unicorn, particularly if I want to stay with my enterprise routers to perform local routing services.
The question:
In the "old" days, VPN tunnels terminated in a VPN concentrator, then got routed into the LAN in whatever acceptable fashion made sense, but the edge router still did all the heavy lifting, instead of integrating everything into a little consumer device (that may not be up to the task of commercial work) - I am looking for a solution similar to this.
Can I create a small lightweight appliance (mini pc, ras-pi, etc) with two physical ethernet interfaces that will effectively become *just* a vpn client gateway, reaching out to my existing Cisco ISR router (as server)?
I have no problem with the tunnel having a different scope and having to write static routes at each end (typical for other tunnels, anyway), however I'm unsure on the config of a client-side to have it automatically accept the certificate offered by my SSL server?
Typically in a client-software situation, you are asked to confirm the certificate and if ok, life carries on. In a command-line or scripted scenario, how does that question get answered? Is it just automatic if the local certificate is identical?
Is this even possible to do while keeping the Cisco hardware (since it's not an OpenVPN device)?
Thanks,
Ted.
laserted
Tim - some of my research pointed to OpenVPN having an openconnect implementation (thus would be compatible with anyconnect/Cisco SSL VPN) - if I was mistaken in that fact (or the great dub-dub-dub provided incorrect information) then the attempt to use OpenVPN would be an exercise in futility. I will be going back to confirm those original sources. The use of TCP 1194 might be a showstopper since I won't have that available through the client site's fw.
Thanks for the sanity check.
Ted.
(This will likely be closed as not feasible to implement.)
