OpenConnect

OpenConnect is an open-source software application for connecting to virtual private networks (VPN), which implement secure point-to-point connections.

It was originally written as an open-source replacement for Cisco's proprietary AnyConnect SSL VPN client, which is supported by several Cisco routers.

The OpenConnect client added support for Juniper Networks' SSL VPN in version 7.05, then for Palo Alto Networks' GlobalProtect VPN in version 8.00, for
Pulse/Junos VPN in version 8.04, and for Fortinet FortiGate, F5 BiGIP, and Array Networks in version 8.20.

Protocols

Cisco AnyConnect

Cisco AnyConnect VPNs utilize TLS to authenticate and configure routing, then DTLS to efficiently encrypt and transport the tunneled VPN traffic, and can fall back to TLS-based transport where firewalls block UDP-based traffic. The DTLS protocol used by Cisco AnyConnect servers was based on a non-standard, pre-release draft of DTLS 1.0, until support for the DTLS 1.2 standard was added in 2018.

DTLS

Cisco's proprietary AnyConnect clients and servers were originally built against a patched, 2007 release of OpenSSL 0.9.8f, which implemented a pre-release version of DTLS that was not compatible with DTLS 1.0 as standardized in /tools.ietf.org/html/rfc4347 RFC 4347 Because of this, it was difficult to make OpenConnect implement a Cisco-compatible version of DTLS without linking against OpenSSL.

Explicit support for Cisco's non-standard version of DTLS was included in OpenSSL 0.9.8m (where it is known as ) and then GnuTLS 3.2.1 (where it is known as ). Newer versions of Cisco's AnyConnect clients and servers support DTLS 1.2 in its standardized on-the-wire form ( /tools.ietf.org/html/rfc6347 RFC 6347, though they continue to use a non-standard mechanism (based on session resumption) for DTLS key exchange.

Modern versions of OpenConnect can be built to use ''either'' the GnuTLS or OpenSSL for TLS, DTLS, and cryptographic primitives.

Other protocols

The OpenConnect client also implements Juniper, Junos Pulse, and GlobalProtect VPN protocols. These have a very similar structure to the AnyConnect protocol: they authenticate and configure routing over TLS, except that they use ESP for efficient, encrypted transport of tunneled traffic (instead of DTLS), but they too can fall back to TLS-based transport.

As of version 8.20, it also implements Fortinet FortiGate and F5 BiGIP, which use TLS and DTLS, and are additionally based on the Point-to-point protocol (PPP).

, support for several other proprietary VPN protocols is in development:
* Array Networks

* SonicWall NX ( PPP-based)

* Check Point

Architecture

The OpenConnect client is written primarily in C, and it contains much of the infrastructure necessary to add additional VPN protocols operating in a similar flow, and to connect to them via a common user interface:

* Initial connection to the VPN server via TLS
* Authentication phase via HTTPS (using HTML forms, client certificates, XML, etc.)
* Server-provided routing configuration, in a protocol-agnostic format, which can be processed by
vpnc-script
* Data transport phase via a UDP-based tunnel (DTLS or ESP), with fallback to a TLS-based tunnel
** Built-in event loop to handle Dead Peer Detection, keepalive, rekeying, etc.
OpenConnect can be built to use ''either'' the GnuTLS or OpenSSL libraries for TLS, DTLS and cryptographic primitives.

Platforms

OpenConnect is available on Solaris, Linux, OpenBSD, FreeBSD, MacOS, and has graphical user interface clients for Windows, GNOME, and KDE. A graphical client for OpenConnect is also available for Android devices,
and it has been integrated into router firmware packages such as OpenWrt.

Server

, the OpenConnect project also offers an AnyConnect-compatible server, ocserv, and thus offers a full client-server VPN solution.

OpenConnect and ocserv now implement an extended version of the AnyConnect VPN protocol, which has been proposed as an Internet Standard. Both OpenConnect and ocserv strive to maintain backwards-compatibility with Cisco AnyConnect servers and clients.

Notable uses

OpenConnect's implementation of the AnyConnect protocol is sufficiently complete, such that some of Cisco's own IP phone devices embed a very old release of OpenConnect in order to connect to Cisco SSL VPNs.

References

External links

OpenConnect project homepage
* https://wiki.archlinux.org/title/OpenConnect

{{DEFAULTSORT:Openconnect
Tunneling protocols
Free security software
Unix network-related software
Virtual private networks