# IPSec VPN v. SSL access to FactoryPMI

**URL:** <https://forum.inductiveautomation.com/t/ipsec-vpn-v-ssl-access-to-factorypmi/672>\
**Category:** Archived Topics\
**Created:** [May 14, 2008, 3:40pm UTC](https://forum.inductiveautomation.com/t/ipsec-vpn-v-ssl-access-to-factorypmi/672 "2008-05-14T15:40:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![AlThePal](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/althepal/32/3603_2.png) [@AlThePal](https://forum.inductiveautomation.com/u/AlThePal)\
**Post date:** [May 14, 2008, 3:40pm UTC](https://forum.inductiveautomation.com/t/ipsec-vpn-v-ssl-access-to-factorypmi/672/1 "2008-05-14T15:40:00Z")

</div>

A customer is proposing giving remote access to FactoryPMI by forwarding all traffic on the relevant port to the FactoryPMI server. This then puts all the security responsibility onto FactoryPMI. I need to be sure that this doesn’t become a back door onto his network.

I’m just back from a seminar outlining the use of IPSec-based VPNs. This approach was nice because it stopped unauthorised traffic before it got onto the network. How does using SSL to access FactoryPMI compare in terms of security? If we implemented an IPSec-based VPN, am I correct in thinking there would then be no reason to enable SSL for FactoryPMI?

---

<div class="post-metadata">

**Author:** ![Carl.Gould](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/carl.gould/32/7262_2.png) [@Carl.Gould](https://forum.inductiveautomation.com/u/Carl.Gould)\
**Post date:** [May 14, 2008, 4:12pm UTC](https://forum.inductiveautomation.com/t/ipsec-vpn-v-ssl-access-to-factorypmi/672/2 "2008-05-14T16:12:52Z")

</div>

> [@AlThePal](#):
>
> If we implemented an IPSec-based VPN, am I correct in thinking there would then be no reason to enable SSL for FactoryPMI?

That is correct - you also wouldn't port forward the HTTP port over from the public internet - the FPMI server would have an internal LAN address.

> [@AlThePal](#):
>
> How does using SSL to access FactoryPMI compare in terms of security?

FactoryPMI's SSL implementation is based on Apache Tomcat, which is a very widely-used (and thus well-tested) product.

Stepping back a bit, SSL and VPN aren't equivalent technologies. SSL provides encryption for HTTP traffic. On a port-forwarded setup, outside parties only have access to the FPMI server through its HTTP port. So, only HTTP requests can be made. VPNs put the computer "virtually" on the host network, and then encrypt all communication.