NetMotion Mobility and Cisco AnyConnect Comparison

Transcription

1 Product Comparison and Comparison Introduction As technology has evolved, the complex accessibility and security requirements of enterprise mobility have grown, and both and offer strong VPN options for any mobile-first enterprise. A comparison of security features might suggest that the two products are similar they both simplify and secure endpoint access, enable device quarantining, and can control network access by user, application, and device. However, seamless and secure mobility is an expectation that has IT teams requiring more from their VPN than just an encrypted tunnel. A more detailed look the two technologies reveals that they approach remote access quite differently, ranging from their technical infrastructure, to features and add-ons, to cost and usability. For the purposes of this paper, we will first examine as an example of the classic VPN category known as SSL and IPSec, followed by an exploration of and its position as a Mobile Performance Management solution. Finally, a direct technical comparison of and from both an IT and end-user perspective. While both solutions provide secure environments for mobile workers and their devices, this comparison reveals that struggles to support workers who rely exclusively on wireless devices and connections to get their jobs done. Overall, better responds to the requirements of today s mobile workers by tackling the connectivity issues that impact mobile performance., SSL, & IPSec VPNs VPN offers an SSL or IPSec desktop client, a clientless SSL Web VPN portal, and a solution for mobile phones and tablets. Support for all major desktop and mobile platforms and its integration with other products makes the VPN of choice for many mobile enterprises. And because holds a large share of the market, it is an attractive solution for enterprises familiar with the brand name. However, is not a unique breed of VPN. Rather, is a hardware-based VPN tool that offers an SSL or IPsec desktop client. SSL and IPSec VPNs like are typically bundled with multipurpose appliances that sit on the network edge. Since the devices are frequently purchased for other uses (such as ASA Firewall), alone, the VPN s capabilities can be limited. SSL and IPSec VPNs are legacy technologies that were built to support workers connecting from remote corporate offices, and to provide temporary connections for employees working from home. However, the challenges of contemporary mobile workers have outpaced the solutions that SSL and IPSec technology provides. Securing remote connections on fast, static networks has become a feature of all mobile VPN clients, but modern workers are moving further away from their offices and connecting to networks that are unreliable and insecure in order to get their work done. Today s mobile workers must contend with the realities of operating in a truly wireless workplace. Public networks experience heavy congestion and are subject to all kinds of phishing attacks. Cross-network roaming often leads to service disruptions that will disconnect workers and cause their applications to crash. Remotely participating in team meetings can be clunky and data-intensive, and heavy packet loss can cause delays in video streaming or dropped calls. Hardware-based VPNs like also create challenges for IT organizations that invest in and maintain them. Vendor hardware carries pricey annual maintenance contracts on top of the software purchase, and scalability can be costly when additional machines, licenses, or products are required to accommodate more mobile workers and scenarios. Overall, the total cost of ownership (TCO) including administration, maintenance, capacity planning, and the cost of additional software renders hardware-based clients like more expensive and time-consuming than software alternatives.

2 & Mobile Performance Management is a software-based VPN client that was purpose-built for mobile workforces. is uniquely configured to support wireless connectivity through application awareness, always-on connectivity, data optimization, and other features that define Mobile Performance Management. Mobile Performance Management is a critical component of mobile-first initiatives because it solves several mobility-related issues that impact overall worker productivity and enterprise operations. With wireless connections, unknown network conditions are an unavoidable variable that can have the greatest effect on worker productivity. solves this by insulating applications from network instability. By delivering an always-on connectivity experience, helps field workers roam seamlessly between Wi-Fi and mobile operator networks without calls dropping or applications crashing. can also minimize the effects of packet loss by reconstructing dropped packets and prioritizing applications over congested networks so your workers don t have to fight for bandwidth to access the tools they need. also carries features that benefit field service organizations. With, helpdesks can reduce wait times for remote employees by more fully owning their team s mobile deployment. Policy enforcement capabilities enable IT to control end user experience by sensing connection changes and prioritizing application traffic, and dynamically controlling device behavior to optimize for weak or spotty connections. will also proactively resolve issues before they arise through add-ons that track usage patterns and send alerts when they encounter inconsistencies. Support teams can receive data on their mobile deployment so that they can make informed decisions to help them manage and scale their mobile fleet. Adopting a software-based solution like provides a more flexible and mobile-centric VPN experience overall. With a software solution, enterprises can save on installation and maintenance and scale quickly with their business. Virtualized hardware avoids costly installations and annual upgrades, and devices can be provisioned in seconds with universal licensing that accommodates all OS configurations. Investing in guarantees the same reliable performance, control, and security that IT can exert over their wired networks without all the hidden costs and add-ons that are essential to powering a tool like. Connectivity Seamless roaming (Wi-Fi, mobile operator, wired network) : End users will most likely experience application disconnects when switching between networks. If they try to roam onto an unauthorized network without disconnecting the VPN, their device will lose all network connectivity. This means that users must concentrate on monitoring and managing wireless connections instead of doing their jobs. Lost time and productive hours for end users. Additional back office support resources are required to handle field connectivity issues. With roaming is not seamless. When a device roams from one network to another, encounters a coverage gap, or is suspended, actually disconnects the tunnel. Additionally, does not support switching from an external cellular connection to an internal network connection (wireless or Wi-Fi). : End users aren t delayed due to connectivity issues. Applications are unaffected by weak signals or connectivity lapses, which means that users can continue to access data and get work done regardless of network quality. Increased user productivity and fewer calls to back office enables seamless transitions for devices roaming between mobile operator, Wi-Fi, and wired networks. With, devices can move across internal and external networks without affecting application connectivity. If more than one network is available, will autoselect the one best-suited for mobile connectivity.

3 Session Persistence : If the VPN connection is degraded or disconnected, the end user might have to reboot the machine, reauthenticate, or attempt to troubleshoot the underlying network connection. End users waste productive hours reconnecting to the network and re-entering data. Support organizations also waste time troubleshooting routine connectivity issues. cannot provide application resilience or error control once a connection is established. With, extended gaps in coverage will cause the device to disconnect, which leads applications to stall and crash, and forces users to reauthenticate. Packet loss over weak areas of service also results in error messages followed by a hard disconnect of the VPN. : With, the VPN experience is almost indistinguishable from the traditional, internally connected experience. Increased user productivity and fewer calls to back office sustains connectivity through any service lapses in the underlying network for up to 7 days. guarantees persistence through coverage gaps, areas of weak signal strength, or when users suspend their devices, so applications experience stable performance in any environment. also masks packet loss in areas of weak coverage, which provides stable application performance in all situations. Wireless Speed : End users experience longer wait times sending and receiving data, and cannot access applications that require heavy data loads. Mobile workers waste time on dropped connections and costs increase when data is sent over areas of weak connectivity. deploys proprietary compression technology that performs 3x slower than over 3G and 4G networks. does not accelerate image download speed or insulate applications from packet loss, which means that real-time applications perform poorly in areas of weak connectivity. : End users experience the best possible wireless connectivity and don t need to re-open applications and re-enter data throughout their day. Mobile workers are able to do their jobs remotely without being stalled by connectivity lapses. s data compression technique lowers costs on metered networks and reduces bytes using text compression and image acceleration, which improves performance over wireless networks. loads images up to 6x faster on wireless networks than and is much faster at transmitting data when high latency (WWAN connections) are present so that users can access real-time applications in areas of weak connectivity.

4 Voice & Video Optimizations : End users are unable to participate in business-critical calls and access the content that they need in order to get work done. Mobile workers waste time on dropped connections and are unable to participate in business remotely if connectivity if compromised. recommends DTLS to support real-time applications such as voice, VoIP, and video, which does not provide effective compression. DTLS also can t provide resilience or error control, and will fail if it encounters too many network errors. This means that voice and video performance suffers unless network conditions are ideal. : End users stay connected even in areas of high packet loss, which means that they are able to stream video and contact their teams remotely no matter where they are. Less time is spent trying to manage connections, and remote workers are able to connect and communicate more efficiently with their teams. s packet loss recovery algorithms enable voice, VoIP, video, and streaming applications to continue to operate even with 50% packet loss on slow and unreliable networks. Diagnostics : End users lose time and productive work hours dealing with unidentifiable connectivity issues. Both support organizations and end users experience more downtime, which causes delays in field activity and can cost the business in field revenue. has extremely limited diagnostic functionality that points out whether the user can or can t connect without supportive troubleshooting. : End users experience minimized downtime and improved mean time-to-repair, thanks to quicker identification of problems and the insight to solve them accurately. Less time is spent trying to manage connections, and remote workers are able to connect and communicate more efficiently with their teams. can automatically detect network issues and run diagnostics to analyze and determine whether issues are caused by the device, network or application. Find and pinpoint problems in devices, adapters and networks and resolve them quickly with real-time status reports on network usage, network errors and device status. Elastic Computing : End users might not be running the latest version of the VPN if administrators are slow to upgrade, which might compromise VPN speed and usability Financial constraint for IT organizations who are forced to make big hardware investments every 3-5 years. runs on a hardware appliance. Hardware lifecycle typically runs 3-5 years, and requires investment in a new appliance to be upgraded. Scalability is also costly, as additional appliances need to by purchased and configured in order to serve more workers. : End users are always running the latest version of the software and getting the best user experience. IT makes a one-time investment in the software and has unlimited access to upgrades. is a software solution that supports flexible deployment options. Server software cost is a one-time purchase and permits elastic computing in private and public clouds using virtual machines. This means that upgrading software versions or adding capacity or redundancy is simple and cost effective.

5 Reporting & Analytics : Lack of visibility into end user experience means that support organization aren t up-to-date on the needs of their mobile fleet. The lack of visibility with increases workload for support teams and delays time-to-resolution for mobile issues. has some logging functionality but it s reporting feature-set is rudimentary. Data on VPN performance or client usage is not available unless you invest in supplementary solutions (option to onboard a manual Splunk integration), and real-time alerts are not available. : The end user experience is constantly being evaluated and optimized to support mobility. enables support organizations to know more about their mobile deployment. Real-time analytics and proactive alerting enables quick issue resolution and more informed mobility decisions. Native, centralized console to view analytics of devices and users. can support real-time data collection to power custom reports and alerts. Visualize trends through custom dashboards and reports tailored for mobile workforces. Maintain an accurate inventory of all mobile devices, with detailed information about each user s device configuration, including phone number, ESN and firmware. Track networks, users, devices, and applications inside and outside the corporate firewall. Custom-built alerts, queries and dashboards can also tackle your individualized operational needs. Support : If an issue can t be resolved in-house, end users might be forced to wait days while support teams look for answers through Delays in support can be frustrating and time consuming, and take focus away from other work. uses a multi-tier triage system for inbound calls and servicing support queues. With, customers experience multiple hand-offs, protracted support calls, and long turn-around times for routine problems. s main support is handled offshore, and they most recently received an NPS (Net Promoter Score) of 38. : End users won t be stuck waiting if their instance is experiencing issues. Your organization won t waste time trying to fix their instance and can focus on other IT tasks. s support engineers are locally-based and can resolve most issues without escalating. s escalation engineers also work in close proximity to the support engineers and they both report to the CTO to ensure collaboration. There is no triaging of inbound calls, and customers won t be transferred multiple times. most recently received an NPS score of 91.

6 Policy Management : End user s needs aren t being met due to limited policy flexibility. limits the number of actions support teams can take to assist their mobile fleet. has limited policy capabilities. It is unable to manipulate traffic at the application level and is not network-aware, which means it cannot use local conditions of the client to selectively enforce action(s). Example: An application cannot be blocked while a device is connected via cellular. Instead, would have to block all network traffic at all times to the specific IP address regardless of the network the client is on. : End user s experience can be highly customized to improve their mobile connection and productivity remotely. helps support organizations meet the unique needs of their mobile fleet with highly customizable and programmable controls. includes robust policy options based on device, user, group, time, network type or condition. is network-aware, and can auto-enforce rules to improve data transmission on networks that aren t ideal for mobility. enables administrators to manipulate and prioritize traffic at the application level so that business critical apps are always stable. Example: can block highbandwidth applications on slow or metered networks, and trigger a notification to inform the user that they cannot use application X on Y network. Once the user returns to a Wi-Fi network, will re-admit the application. NAC (Network Access Control) : End users might have their network access terminated for minor issues because does not offer varying levels of enforcement. FirePower policies are difficult to implement and can require a dedicated resource. NAC is limited to the FirePower module. This module serves more as an IDS (Intrusion Detection System) than a mobile-centric NAC product. can t interrogate a device before it connects; can only analyze traffic flow after the device is connected. : When problems are detected, end users can continue to work on their device while the issue is being repaired instead of being force-disconnected. NAC rules are wizard-based and can be deployed by any support team. Devices are interrogated before they connect to the network to ensure compliance with internal security policies. When concerns are detected, NAC can either repair the issue or restrict network access to minimize exposure. NAC can detect or update anti-virus software, or limit network access if a device isn t fully protected.

7 Hotspot Accessibility (Captive Portals) : End users can experience connectivity issues if they are unfamiliar with the manual disconnect procedure or fail to disconnect the VPN efficiently. Lost time and productive hours for end users. Additional back office support resources are required to handle field connectivity issues. requires the end user to manually disconnect the VPN in order to perform hotspot authentication. : End users are not required to disconnect the VPN to access captive portal hotspots. Increased user productivity and fewer calls to back office automatically checks for captive portals and enables portal authentication outside of the VPN tunnel without manual configuration. Client Management : End users are disrupted and lose time waiting for IT Decreased productivity for mobile workers and more work for support teams. Issue resolution time is often higher and more time is wasted on repetitive troubleshooting. Clients are difficult to manage due to lack of visibility and data. Locating the information necessary to troubleshoot end user issues is difficult, and often users have to bring their devices in from the field to receive proper troubleshooting. : Troubleshooting can take place while end users are still mobile so that device downtime is minimized. Resolving connectivity issues is less complicated which saves the organization time and resources. can automatically perform a root-cause analysis when the end user client experiences issues. can remotely deploy end-to-end connectivity tests that target each potential point of concern: device adaptor, local connection, internet corporate firewall, etc. Load Balancing/HA : End users can be impacted during server infrastructure failure if administrator hasn t taken the time to deploy a backup appliance. Growing an deployment is costly, as it requires a significant investment in hardware and design resources. does not support separate failover or load-balancing as an active/ active disaster recovery site. Some level of HA can be achieved but is difficult to configure and can require a replacement appliance or significant changes to the network design. : End users experience virtually no downtime in the event of a catastrophic failure, a server failure, or the need to perform maintenance or upgrade a system. It is very easy to grow a deployment as the business evolves. Adding loadbalancing or HA functionality is as easy as adding another VPN server (virtual or physical). supports multisite deployments, which means increased redundancy and up-time for your team.

8 Authentication : End user is required to choose a specific profile for authentication. If they choose the incorrect one they will not be able to connect. Additional calls to back office supports most authentication methods, but only one form of authentication per VPN profile. : End user has a seamless experience because the administrator decides what form of authentication they encounter. Fewer calls to back office works with most authentication methods and is configurable per-app, per-device or device group. supports NTLM, RADIUS, PKI x.509 v3 certificates, RSA, etc. Implementation : End users need to be trained to resolve issues when operating the client. requires additional technical resources to setup and manage the tool. The configuration wizard for the VPN does not provide a complete end-to-end setup of the client and do not touch on any of it s advanced configuration options. Several support calls are required to setup. : Users do not require training to use. Minimal technical resources required. installs with a setup wizard on a single server, and can be up and running in 20 minutes. Settings, policies, and rules are all pre-configured on the server and can be pushed down to the client without end user interference Oct Software, Inc. All rights reserved.