HP Access Control Client Software manual They have?

Designing Access Controls

Make Decisions about Remote Access (VPN)

	User Type and Sophistication
	Which users are connecting to the network, and what level of expertise do
	they have?
	Although you can make a VPN available to whomever you choose, remote access
	is commonly reserved for members of your organization. (That is, you do not
	provide VPN connections for guest users.) Therefore, you can typically expect
	a certain degree of interaction with the users.
	However, members of your organization might have widely differing technical
	skills, and a VPN client can be complicated to set up. At the least, the user must
	specify the IP address of the VPN gateway and possibly a preshared key. For an
	IPsec or L2TP/IPsec VPN, the user might also need to create a security policy
	that matches the policy on the VPN gateway. Even the most sophisticated users
	will require you to inform them of the correct settings. A typical user will
	probably need detailed instructions for setting up the VPN client.
	Typical users might find a PPTP VPN connection slightly easier to set up than
	one that relies on IPsec. They will still need some instructions—and you must
	inform them of your VPN gateway’s IP address—but they might be able to use
	the default settings established through the Windows Network Connection
	Wizard.
	Setting up L2TP/IPsec, on the other hand, can be complicated by the fact that
	users must specify options for both IPsec and for L2TP. If you are using preshared
	keys for the IPsec authentication method, some users might not understand that
	they have to enter that preshared key and their Windows domain credentials.
	In the end, some find vendor VPN clients easier to use; others prefer the native
	clients included with their endpoints’ OS. Members of your IT staff should
	select a preferred VPN client. You may also want to ask users if they have any
	particular preferences. Some of them may have experience using a VPN and
	may be able to provide a user’s perspective.
N o t e	The ProCurve VPN Client offers an attractive alternative to instructing less
	technically savvy users in configuring an IPsec VPN connection. You can
	create a customized policy that already includes necessary settings and perhaps
	a preshared key. Then export that policy to the client’s setup files—ready to be
	selected when each user installs the client.
	As for an authentication method, user type and sophistication do not greatly
	affect the choice. Whether a digital certificate or preshared key (password) is
	easier for the user to configure depends on whether the user’s endpoint already

3-42