“The difference between the Cisco WebVPN and SSL VPN Client is that Cisco WebVPN uses SSL/TLS and port forwarding via a java app for application support, it also only supports unicast TCP traffic, no IP address is assigned to the client, and all the web-browsing down the tunnel is done with an SSL web-mangle that allows you to stuff things into the SSL session.”
SSL VPNs are the future of VPN technology. While they are still brand new, “bleeding edge” sort of technology, they will eventually be how we run our VPN connections for most organizations. The concept is simple: HTTPS (SSL-based) web pages have used adequate encryption for years…why not harness the technology to create a “client-less VPN system,” tunneling applications through the SSL connection.
For a user to connect to a SSL VPN, no client installation is necessary. Rather, they simply access a web page, authenticate, and minimize the web browser window. They’re now on the corporate VPN.
There’s more to it than this (such as JAVA client downloads may be necessary for full port forwarding capabilities, etc…). Cisco just published an excellent explanation / configuration document for the WebVPN/SSL VPN technology.
IMHO, Mikrotik needs this to compete with Sonicwall and Cisco ASA… PLEASE add soon… Another
missing feature we need to market to our Cisco / Sonicwall clients… this and VPNC support so we can
just swap out ASA firewalls and have clients retain their Cisco VPN software to connect to the new Tik…
Cisco VPN Client is just a piece of IPsec (IKEv1) VPN software, so the same should be setup on Mikrotik. Look here for some guidelines on how to setup a road-warrior IPsec VPN. If you are fine with using just PSK (Group Authentication in Cisco terminology) then (technically) you can even use the same Cisco VPN Client software to connect to Mikrotik devices. Mutual Group Authentication, however, can not be used with Mikrotik devices, as Mikrotik only supports standard Hybrid authentication scheme, while Cisco’s Mutual Group Authentication is a non-standard combination of Hybrid and PSK schemes.
Some limitations are:
No RADIUS support for user authentication (XAuth).
No Split-DNS support (though you can configure it on the client side when using Shrew Soft VPN client).
NAT-T is only partially supported, multiple clients behind a single NAT device will not be able to connect to the same VPN gateway simultaneously.
For me, actually, (1) and (3) above are serious enough to not even think about migration from ASA to any of the Mikrotik gears. The disadvantages of ASA are price tag and configuration complexity, but, to be honest, ASA devices are rather good for what they are designed for.