Examkin

Question

Difficulty: MediumVirtual Private Networks and Remote Access Security

A network administrator configures a clientless SSL/TLS VPN on the corporate gateway to allow remote contractors access to internal management applications. The contractors can successfully authenticate and access internal web portals using their web browsers. However, they report being unable to connect to internal servers using native SSH desktop applications. Which of the following best explains why native SSH sessions fail in this deployment?

  1. Clientless SSL/TLS VPNs operate at the Application layer via a web browser and do not provide network-layer IP encapsulation or routing for standalone desktop applications.Answer
  2. B
    Clientless SSL/TLS VPNs operate strictly at the Data Link layer, which prevents Layer 3 IP packet encapsulation and Layer 4 TCP port translation required by SSH clients.
  3. C
    SSL/TLS VPN tunnels only support connectionless UDP traffic, causing connection-oriented TCP applications like SSH to be blocked at the gateway.
  4. D
    The gateway rewrites all outbound traffic headers from SSH port 22 to HTTPS port 443, causing internal SSH servers to reject the incoming packets.

Answer

Clientless SSL/TLS VPNs operate at the Application layer via a web browser and do not provide network-layer IP encapsulation or routing for standalone desktop applications.
A clientless SSL/TLS VPN relies on a standard web browser to provide remote access to web-based services (HTTP/HTTPS) operating at the Application layer. Because no virtual network adapter or client software is installed on the user host, network-layer (Layer 3) IP routing and packet encapsulation are not established. Consequently, standalone client applications such as native SSH, RDP, or FTP clients cannot send traffic through the tunnel.

Step-by-Step Solution

1
Analyze the VPN architecture type described in the scenario.
The scenario specifies a clientless SSL/TLS VPN accessed through a web browser.
Clientless VPNs rely on standard web browsers operating at the Application layer (Layer 7) without requiring client software installation.
2
Evaluate the capabilities and limitations of clientless SSL/TLS VPNs regarding non-web traffic.
Clientless SSL VPNs proxy web applications (HTTP/HTTPS) presented inside the browser interface, but do not create a virtual network interface card (NIC) to route system-wide Layer 3/4 traffic.
Standalone desktop applications like native SSH clients require Layer 3 network tunneling (such as client-based SSL VPNs or IPsec) to route traffic through the gateway.
3
Identify the correct reason for the SSH connection failure.
Native SSH client applications cannot transmit packets through the browser-bound clientless tunnel.
Full IP encapsulation is required for desktop client software, which is absent in a clientless SSL deployment.

Key Concept

Clientless SSL/TLS VPN vs. Client-based VPN Architecture
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic