What is SSL VPN?

SSL VPN is a remote-access VPN protocol that lets users connect over a standard HTTPS port instead of a dedicated IPsec port, so tunnels reach through firewalls that block other VPN traffic. Versa’s implementation is proprietary, built on TLS and DTLS rather than the legacy SSL protocol, and terminates on Versa SASE gateways for SASE client users.

Key takeaways

• Runs over port 443, so it passes through firewalls that block IPsec.
• Built on TLS and DTLS 1.2 rather than the legacy SSL protocol.
• The SASE client can order TLS, DTLS, and IPsec as fallback tunnels.
• SSL VPN profiles set certificates, address pools, and cipher suites.
• Trusted network detection can bypass SSL VPN where tunnels already exist.

On this page: Why it matters · How it works · Types · SSL VPN & Versa · FAQ

Why is SSL VPN important?

Remote-access VPNs only work if they can establish a tunnel from wherever a user happens to be – a hotel network, an airport lounge, or a country that filters non-web protocols. IPsec depends on UDP ports and the ESP protocol, which restrictive networks routinely block, stranding remote workers. SSL VPN tunnels over TCP 443, the port ordinary HTTPS uses – a port firewalls almost never close, since that would also break the web.

For a Versa SASE client user, that reachability decides whether Zero Trust access is available at all. SSL VPN gives the client a second, near-universally reachable path to the gateway, and administrators can order TLS, DTLS, and IPsec so a working tunnel is found.

What is SSL VPN?

Despite the name, Versa’s SSL VPN is not built on the deprecated SSL protocol. It uses Transport Layer Security (TLS) for TCP-based tunnels and Datagram Transport Layer Security (DTLS) for UDP-based tunnels. The SSL VPN profile’s common configuration documents TLS 1.2 and DTLS 1.2; the Secure Access Service gateway profiles separately expose selectable minimum/maximum versions reaching TLS 1.3 and DTLS 1.3 (see TLS and DTLS). The “SSL VPN” name persists industry-wide as shorthand for browser-friendly, port-443 access, distinct from IPsec-based VPNs.

A SASE client authenticates using a certificate the administrator uploads to Director – an end-entity certificate and CA chain – then negotiates a TLS or DTLS session over the configured port, defaulting to 443. The gateway assigns an address from an IPAM pool, and the profile’s accessible-subnets list sets which internal networks the tunnel reaches. Sessions rekey on an administrator-defined interval of 120 to 86,400 seconds.

Types of SSL VPN

Versa’s SSL VPN offers two tunnel types, selectable independently or together. TLS tunnels run over TCP and behave like ordinary HTTPS connections, the most compatible option – they traverse virtually any firewall or NAT device that allows web browsing. DTLS tunnels run over UDP, avoiding TCP-over-TCP overhead for lower latency, at the cost of being marginally more likely to meet a TCP-only network.

Administrators can select TLS only, DTLS only, or both – and, from Release 12.2.1 onward, set the order the SASE client tries them in. A common pattern orders DTLS first and falls back to TLS, then IPsec. Each tunnel type carries its own protocol version, port, rekey interval, and cipher suites spanning AES-GCM, AES-CBC, and ChaCha20-Poly1305.

SSL VPN & Versa

SSL VPN is one of two tunnel protocols the Versa SASE client uses to reach Versa cloud gateways – the other is IPsec – and administrators set which protocols are available, and in what order, through SSL VPN profiles. In Concerto, client-based access rules select TLS and/or DTLS as VPN types; in Director, the profile sets the certificate, address pool, and protocol details. TLS and DTLS tunnels are disabled by default on the endpoint and must be enabled in the client’s app settings.

SSL VPN also interacts with Versa’s trusted-network features. When a device already sits behind a trusted, tunnel-protected network – a branch with an existing SD-WAN or IPsec connection to the gateway – trusted network detection can bypass SSL VPN (and IPsec) entirely, avoiding a redundant tunnel.

Frequently asked questions

What is the difference between SSL VPN and IPsec VPN?

SSL VPN tunnels over port 443, the same port as normal HTTPS traffic, so it reaches through firewalls that block IPsec’s UDP ports and ESP protocol. IPsec is generally more efficient once established. The SASE client can use either, or fail over between them, to guarantee connectivity.

Is Versa’s SSL VPN actually based on the SSL protocol?

No. SSL was deprecated years ago on security grounds. Versa’s SSL VPN is built on TLS and DTLS – the SSL VPN profile documentation lists version 1.2 for both, while the Secure Access Service gateway profiles expose selectable version ranges reaching 1.3. The “SSL VPN” name is an industry convention for port-443, browser-friendly remote access, not a description of the underlying protocol.

What is the difference between TLS and DTLS tunnels?

TLS runs over TCP and behaves like standard HTTPS, giving maximum firewall compatibility. DTLS runs over UDP, avoiding TCP-over-TCP overhead for lower latency on real-time traffic. Administrators can enable one or both, and set which tunnel type the client tries first.

Why does SSL VPN generally use port 443?

Port 443 is the standard HTTPS port that essentially every network permits, since blocking it would also block normal web browsing. Running SSL VPN over 443 lets the SASE client tunnel from restrictive networks where IPsec’s ports are commonly blocked.

How does SSL VPN relate to trusted network detection?

Trusted network detection and the trusted network hostname feature let the SASE client bypass SSL VPN (and IPsec) when the device is already on a network with an existing tunnel to the gateway, avoiding a redundant tunnel for traffic that is already protected.

More on SSL VPN

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SSL VPN, these are worth looking at next.