Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

wireless security VPN client -vs-Citrix ICA client

I'm researching as to which method will be preferable for our "internal" wireless deployment.

I'm trying to create a brief "Pros and Cons" for each method

VPN = IPSEC tunnel

ICA =128 bit encryption.

any thoughts

Community Member

Re: wireless security VPN client -vs-Citrix ICA client

This is primarily a placement concern.

If you are going to use the ICA client, you will need to firewall your wireless network from your private, wired network.

This might not be necessary if you are using a VPN appliance with firewall features built-in, like the Cisco and Nortel boxes.

Personally, I can't stand remote user VPNs, so I would recommend using secure ICA and firewall the wireless equipment. You can use a spare firewall interface for this, but make sure that the firewall policy only permits tcp 1494 from the wireless network to the private network. You will need to configure your ICA client with an IP address, not a DNS name (because you aren't permitting DNS traffic). Do not permit any traffic from the wireless network to the Internet or any other networks - let them get Internet surf in the ICA window.

Most people would argue for IPSEC VPN with 3DES. I think that is definatly more secure, but will require more planning and support. The ICA client is much easier to install than most RUVPN clients and you don't need to worry about cached logon credentials, password sync, etc. Bottom line: ICA is going to be much easier to maintain and manage and the users will probably find it a lot easier to use.

You may also consider using two-factor authentication with either solution. That would bring the risk down considerably. SecurID agents work on Citrix and in most RUVPNs.

Hope this helps.

Community Member

Re: wireless security VPN client -vs-Citrix ICA client

One-time-use certificates with Citrix will fix exactly the problem that has raised so many concerns with WEP - intercepting and mis-using keys.

CreatePlease to create content