Remote Desktop Gateway V.S. VPN

Hello all,

I had a conversation with someone about VPN and the topic of Remote Desktop Gateway came up. I am new to RDG and not sure of the pros/cons V.S. a Cisco VPN client.

From what I understand (Please correct me if I am wrong), they both use SSL encryption over 443. However, the VPN requires a special client and then configured as such VS an RDG pointer that anyone with a windows box can configure. Also, RDG can be configured to only point to a single Terminal Server, where as VPN is like sitting in the network while remote.

RDG also uses AD credentials, where as a VPN can have two sets

Do both of them require an SSL cert on the client? and if so, what is the difference between RDG and VPN on that?

Also, what are the differences overall in speed, security, administration, monitoring and reporting?

Okay, so…

From what I understand (Please correct me if I am wrong), they both use SSL encryption over 443.

Not having worked with Cisco VPNs in a while, I’m not 100% sure this is their default, but it can be set this way if you need it to be.

However, the VPN requires a special client and then configured as such VS an RDG pointer that anyone with a windows box can configure. Also, RDG can be configured to only point to a single Terminal Server, where as VPN is like sitting in the network while remote.

Interpreted here… Using a VPN is like sitting in your network remotely, correct. RDG is a direct tunnel for the purpose of RDP. It also has the benefit of being more trusted than exposing RDP publicly.

Yes, the Cisco SSL VPN requires a client. However, an IPSec/L2TP VPN client exists in almost every OS you care about if you weren’t stuck to a Cisco VPN.

RDG also uses AD credentials, where as a VPN can have two sets

SSO is a good thing. You could always make the Cisco VPN client auth to AD.

Do both of them require an SSL cert on the client? and if so, what is the difference between RDG and VPN on that?

RDG doesn’t require a client cert. The Cisco will if you use certificate authentication. Keep in mind that this is generally not a paid, publicly trusted cert, but a self-signed CA certificate. (Free of charge to generate)

Also, what are the differences overall in speed, security, administration, monitoring and reporting?

  • Speed: You won’t notice.
  • Security: Pretty much the same.
  • Administration: RDG is easier to set up, in my opinion. Once up, they’re both cake.
  • Monitoring: RDG will give you session stats, while a VPN is general network targeted.
  • Reporting: More or less same as above.

Your main point to think about here is this: A VPN server gets you on your LAN. An RDG server puts you securely into only the RDP server. You need to decide what the business needs.

What issue are you trying to solve? There are different reasons to use either/both in an environment.

Thanks everyone! This is all super helpful information!

This last point is probably the most important. The VPN will allow you access to anything on your network from the computer with the client installed if set up correctly. RDG doesn’t necessarily allow this, especially not on the scale a VPN would allow. IMO VPN is also more user friendly. Some non-techy folks go full retard when they realize they have a window with a computer screen on their computer screen.

The important thing is to note that it can have access to the whole network. It is capable of being locked down or having access to 100% of your network resources.