SSL VPN or IPsec client for remote access? How do they differ?
Show the answer
Say this first
An SSL (TLS) VPN runs over TCP 443, usually with DTLS on UDP 443 for performance, so it passes through almost any hotel or guest network. It can be clientless through a browser portal or use a full tunnel client. An IPsec client uses IKE on UDP 500 and ESP or UDP 4500, which some networks block, but it is standards based, and IKEv2 clients are built into Windows, macOS, iOS and Android. Both can give full network access with per-user AAA and posture checks.
Go deeper
| SSL/TLS VPN | IPsec client (IKEv2) | |
|---|---|---|
| Transport | TCP 443, plus DTLS on UDP 443 | UDP 500 and 4500, or ESP |
| Passes restrictive networks | almost always | sometimes blocked |
| Clientless browser mode | yes, for web apps | no |
| Client | vendor client (Cisco Secure Client, GlobalProtect, FortiClient) | built into the OS, or vendor |
| User authentication | AAA, SAML, MFA, certificates | EAP, certificates |
TCP over TCP
If the tunnel itself runs over TCP and carries TCP, both layers retransmit on loss and throughput collapses on lossy links. That is why SSL VPN clients prefer DTLS over UDP and fall back to TLS only when UDP is blocked.
Vendor notes
Cisco Secure Client uses TLS plus DTLS by default and can use IKEv2. GlobalProtect tries an IPsec tunnel on UDP 4501 first and falls back to SSL.
They will ask next
What is posture assessment?
The headend checks the device before or after it connects: OS patch level, disk encryption, endpoint protection running, company-managed or not. The result decides full, limited or no access.
Where does zero trust network access fit?
ZTNA gives access to specific applications after checking user and device, instead of placing the device on the network. Many companies are moving from network-level remote-access VPN to it for most apps.
Traps
- Saying SSL VPN is always clientless. Most deployments use a full tunnel client.