New Tools Aimed at VPN Management

Computerworld - The idea of a virtual private network (VPN) that securely tunnels through the public Internet to connect offices and remote workers seems straightforward enough.
But network managers who have taken VPNs beyond the pilot stage and into full deployment know firsthand that managing VPN encryption, maintaining data tunnel integrity and validating software on hundreds or thousands of client computers and office firewalls can be a formidable job.
Last week, two VPN vendors that are trying to secure and broaden their market positions - Redwood City, Calif.-based Check Point Software Ltd. and San Jose-based Cisco Systems Inc. - introduced enhancements to their management software that they say will make corporate VPNs easier to deploy, update and monitor.
John Shelest, a senior network engineer at Equity Residential Properties Trust, a real estate investment trust that owns and manages more than 1,100 properties throughout the U.S., said his Check Point VPN has enabled his company to securely connect its remote offices to its Chicago headquarters.
It isn't easy to keep VPN client software updated for 1,100 users and to validate those changes in addition to changes on the company's eight firewalls, said Shelest. He has been beta-testing Check Point's Next Generation (NG) infrastructure management software and said NG resolves many of the complexities of managing a Check Point VPN. NG lets him push software changes out to remote PCs without end-user intervention, Shelest explained.
He added that he also likes the NG graphical user interface, which makes it easier to define user security policies and lets him turn over firewall management to less-experienced staffers.
Paul Forbes, a network engineer at Global Positioning System manufacturer Trimble Navigation Ltd. in Sunnyvale, Calif., has been testing Cisco's CiscoWorks2000 VPN/Security Management Solution (VMS), which includes a monitor that gives a dashboard display of VPN performance and status, as well as tools for managing VPN hardware and software changes.
While some users may like Cisco's VMS interface and the product's VPN monitoring capabilities, which can spot site-to-site VPN tunnel failures and report the number of concurrent tunnels and who's logged onto a remote access VPN, Forbes said he prefers Cisco Secure Policy Manager (CSPM), which requires more technical savvy to use.
"[CSPM] allows you to actively configure and manage all of the security aspects of network devices," Forbes said.
Cisco said its VMS product is available for $8,000 and includes CSPM. Check Point's NG will be available in the second quarter and will be priced at between $3,500 and $20,000, depending on the number of network nodes.