Good day, we are currently running Palo Alto Firewalls with Site-to-Site IPSec VPN tunnels between offices. ANd with GlobalProtect IPSec VPN for remote users wishing to connect to the Office LAN.
I’m looking for alternatives that might be faster, and perhaps easier to manage.
Is there some kinda of implementation with wireguard that would work well for us?
One thought I had was run an OPNSense or PFsense VM in the office and create wireguard site-to-site links. Or create a Linux VM of some kind with wireguard.
For the employees working remotely, what might be a good option?
Is there a way to authenticate users with some form of wireguard? I like tailscale, but I think its far to costly for what we want to do.
Thanks
Look into ZTNA solutions that implement Wireguard or others like OpenZiti or NetBird and Co.
Palos are just about the simplest, most reliable, and best performing security devices you can get. What is going so wrong with your setup that you’d consider Wg? And if cost is your primary driver, OpenVPN is a pretty polished and free VPN with decent built-in management tools.
I love Wg and I use it for my personal setups, but it’s not scalable or manageable enough for the enterprise.
Something like defguard could be interesting because a standalone Wg would be nightmare to manage with all the users
check out https://hub.docker.com/r/wgportal/wg-portal no MFA yet but this is a good solution works great
IMHO, IPSec is still the most performant for site-to-site VPNs.
Since you are thinking of using OPNSense to run WG, the simplest setup to achieve WG with authentication is to just use Captive Portal. The caveat is, the tunnel is already established before authentication though blocked at the firewall level.
OpenZiti is a great open source and ‘free’ option. NetFoundry would be its enterprise equivalent. OP, whats the use case (just remote access??) and scale??
It 100% is as scalable as OpenVPN and it can be processed faster, sometimes almost twice as fast. OpenVPN is a dying protocol.
Palos are reliable, and have decent performance, but they are far from simple. I’d love something that can establish and maintain a reliable VPN connection regardless of the underlying infrastructure.
Right now changing an IP address of a network connection requires changing like 20-30 things in a firewall in multiple locations. We also have regular errors when pushing configs, plus cost is an issue. ANd we only use about 5-10% of what a Palo Alto offers.
Yea im starting to see how just basic wireguard isnt well suited to end users since you have to manage keys for each user.
It would be decently suited for site-to-site however.
IPSec is ok, but its a very (30+ years?) old protocol with slower, less secure encryption than what wireguard offers, and also has more packet overhead.
Not so much OpenVPN, but IPSec to be specific. Its an old a slow protocol from the early 90s? Times change.
I’m not talking about protocol efficiency or ‘speed.’
Does Wg support user-based authentication? Can it even assign dynamic IP addresses? Does it have any manageability features at all? No, no and no. These are basic requirements for enterprise access VPNs.
If you want to hand-write a wg config for every remote user, then fine, I guess it’s it’s ‘scalable.’
Separating your vpn from your router is always a good idea. Why not run wg in a VM for site-to-site. You get performance, security, and complete control. The only downside is you have to put hands on a keyboard to get it done.
Simple is relative. It all depends on your skill level and requirements. I can say with confidence that you won’t regret learning how to use your Palo.
Yeah for a site2site it’s the most secure/fastest option available
Well, we have multiple site-to-site VPNs, and IPSec still, seems to be the most performant compared against OpenVPN. For RoadWarrior setup, we are now shifting from OpenVPN to WG.
Ipsec is faster than OpenVPN. IPsec is used at the enterprise level…even Palo Alto talks about it.
IPsec vs. OpenVPN: What Are the Differences? - Palo Alto Networks.
It’s not hard to beat openvpn. Wireguard is definitely faster and less cumbersome than ipsec. That was a well meant over engineered protocol that needed even extra engineering to make it work a bit better.
The only real useful part: opportunistic encryption unfortunately never worked out due to the requirements.