3. Site interconnection

For SSL VPN site interconnection, IP packets must be encapsulated in a protocol compatible with TCP. No standard exists, but a solution does exist in the public domain: STunnel [4] enables a PPP (and therefore IP) flow to be encapsulated in an SSL connection.

There are two main architectures for interconnecting sites: full-mesh VPNs and star-mesh VPNs.

In the first case (figure 2 ), all gateways are interconnected. For each tunnel, it is necessary to define a server and open port 443 on the firewall inbound to the SSL gateway. This architecture has the advantage of optimizing the flow path, but requires modifications to virtually all firewalls.

In the second case (figure