Best VPN implementation

[napkinthief]

Hello, I am new to the networking field, currently stepping up from data center engineer and desktop support. I am looking at the way my company uses VPNs now...

our current setup, requires 2 types of vpn. we use IPSec site to site and client based VPN for end users to work remotely. We have 7 offices globally, each with 2 ISPs for redundancy. Ive already researched and want to move towards the SSL based vpn. we are currently on juniper ssg firewalls, but have option to upgrade this year. fortunately, budget is not an issue, and we are looking at the new juniper gear, the palo alto networks gear, and the cisco. we need to be able to configure, site to site vpn, end user vpn, and isp failover, which i believe all the major ones will do.

looking for whats the best ideas now for making a bulletproof vpn setup.

 

[Mushkins]

Always check the documentation on available features to make sure the gear you're buying supports what you need it to do.

That being said, if budget is no issue and you're buying enterprise-grade gear, whatever you'd be buying from each vendor is going to support what you need it to do. It's all the same technology, the "best" is whichever one the staff is most comfortable configuring.

If you're already familiar with a certain vendors platform (Cisco especially so), it's usually best to stick with the same brand of gear you have currently unless there's a pressing need to change. Otherwise you're bound to end up with some misconfigurations as your team gets acquainted with the new way certain features and configurations need to be performed.

 

[Railgun]

FWIW, my previous organization used Cisco for all site to site and Juniper's Pulse for client SSL VPN (which is no longer Juniper).

If you have time, do a proof of concept. I'd argue against the above in sticking with the same vendor on separate functions. It's great on paper, but in reality, you end up getting stuck with a product that may not do what you want it to do.

Find a product that meets your needs. Configuring IPSec and SSL VPNs can be vastly different, so sticking with a particular vendor is irrelevant.

Can you find a single product to do it all? Sure. My current environment uses Checkpoint for that.

That said, bulletproof is a misnomer when it comes to a particular product for a particular solution. There are some cases where that's true, but for VPN, not so much.